Week 42, 2026

12–18 October 2026

New CVEs: 5,487
Critical: 380
High: 2,377
Newly exploited: 9
Advisories: 694
Malicious pkgs: 137

Newly exploited 9

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.3
CVE-2026-102764 KEV Oct 16, 2026 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
BeyondTrust · Remote Support

EPSS 78%
Medium 5.4
CVE-2025-61624 KEV Oct 16, 2026 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0…
Fortinet · FortiOS · FortiProxy · FortiPAM

EPSS 1.3%
Critical 9.3
CVE-2026-21589 KEV Oct 15, 2026 This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. C…
Atlassian · Confluence Data Center · Jira Service Management Data Center · Bitbucket Data Center

EPSS 100%
Critical 10.0
CVE-2026-105134 KEV Oct 14, 2026 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
Ahsay · AhsayCBS

EPSS 82%
Critical 9.8
CVE-2026-76519 KEV Oct 14, 2026 Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Cisco · Cisco Secure Email

EPSS 2.2%
High 8.5
CVE-2026-0322 KEV Oct 14, 2026 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
Palo Alto Networks · PAN-OS · Prisma Access · Cloud NGFW

EPSS 1.7%
High 7.3
CVE-2026-105133 KEV Oct 14, 2026 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
Ahsay · AhsayCBS

EPSS 79%
High 8.8
CVE-2026-96951 KEV Oct 13, 2026 Windows Shell Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 9.8%
High 8.6
CVE-2026-104935 KEV Oct 13, 2026 Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact I…
ivanti · Connect Secure

EPSS 89%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.3
CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
BeyondTrust · Remote Support

EPSS 78%
Critical 9.2
CVE-2026-110447 Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September…
Collabora · Collabora Online - Built-in CODE Server

EPSS 73%
Critical 10.0
CVE-2026-97229 Integer Overflow or Wraparound in GitLab
GitLab · GitLab

EPSS 65%
Critical 9.8
CVE-2026-59774 Gitea Org-mode file disclosure and code execution
Gitea · Gitea

EPSS 28%
Critical 10.0
CVE-2026-94169 WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability
Theme-one · The Grid

EPSS 4.4%
Critical 9.8
CVE-2020-37282 office-converter through 1.0.2 OS Command Injection via fileName in generatePdf
vworld4u · office-converter

EPSS 3.4%
Critical 9.1
CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2
Stirling-Tools · Stirling-PDF

EPSS 3.4%
Critical 9.8
CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()
ArsalanDotMe · video-stitch

EPSS 3.2%
Critical 10.0
CVE-2026-110957 Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection
WAVLINK · WL-WN530BE2-A

EPSS 3.1%
Critical 9.8
CVE-2026-110650 Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths
anshulkharb · thumbnail

EPSS 3%
Critical 10.0
CVE-2026-110536 D-Link DIR-868L HNAP CGI cgibin system os command injection
D-Link · DIR-868L

EPSS 2.9%
Critical 9.8
CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
RVC-Boss · GPT-SoVITS

EPSS 2.9%
Critical 9.8
CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType
ChetanXpro · nodejs-whisper

EPSS 2.7%
Critical 9.8
CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language
ariym · whisper-node

EPSS 2.7%
Critical 9.8
CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir
mborne · @mborne/extract

EPSS 2.7%

All 380 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.6
CVE-2026-104935 Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact I…
ivanti · Connect Secure

EPSS 89%
High 7.2
CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
Netgate · pfSense CE

EPSS 11%
High 8.8
CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 9.8%
High 7.2
CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Netgate · pfSense CE

EPSS 8.6%
High 7.2
CVE-2026-111217 Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
Netgate · pfSense CE

EPSS 7%
High 7.2
CVE-2026-111226 Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
Netgate · pfSense CE

EPSS 6.5%
High 7.2
CVE-2026-111229 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
Netgate · pfSense CE

EPSS 6.4%
High 7.2
CVE-2026-111215 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
Netgate · pfSense CE

EPSS 6.2%

Advisories

WID-SEC-2026-3892 Microsoft Windows und Windows Server: Mehrere Schwachstellen 1127 CVEs
USN-8917-1 linux, linux-aws, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-oracle, linux-realtime vulnerabilities 1050 CVEs
USN-8918-1 linux-azure, linux-azure-fde, linux-azure-fips vulnerabilities 1049 CVEs
SUSE-SU-2026:4706-1 Security update for the Linux Kernel 508 CVEs
SUSE-SU-2026:4640-1 Security update for the Linux Kernel 508 CVEs
SUSE-SU-2026:24316-1 Security update for the Linux Kernel 479 CVEs
SUSE-SU-2026:24182-1 Security update for the Linux Kernel 479 CVEs
SUSE-SU-2026:24315-1 Security update for the Linux Kernel 473 CVEs
SUSE-SU-2026:24181-1 Security update for the Linux Kernel 473 CVEs
openSUSE-SU-2026:22091-1 Security update for the Linux Kernel 401 CVEs