{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: newest CVEs","home_page_url":"https://patchfirst.co/","feed_url":"https://patchfirst.co/feed.json","description":"Newest CVEs with exploitation evidence, EPSS and ATT&CK techniques.","_patchfirst":{"generatedAt":"2026-10-31T05:11:25Z"},"items":[{"id":"CVE-2026-117656","url":"https://patchfirst.co/cve/CVE-2026-117656/","title":"CVE-2026-117656: Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth…","content_text":"pow-auth · assent Not in CISA KEV. CVSS 9.3 CRITICAL. Priority 6.5.","date_published":"2026-10-31T00:16:51.000Z","date_modified":"2026-10-31T00:16:51.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-117656","published":"2026-10-31T00:16:51Z","modified":"2026-10-31T00:16:51Z","title":"Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth…","vendor":"pow-auth","product":"assent","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.5}},{"id":"CVE-2026-63377","url":"https://patchfirst.co/cve/CVE-2026-63377/","title":"CVE-2026-63377: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language","content_text":"fctr-id · okta-ai-agent Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T23:17:14.000Z","date_modified":"2026-10-30T23:17:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-63377","published":"2026-10-30T23:17:14Z","modified":"2026-10-30T23:17:14Z","title":"TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language","vendor":"fctr-id","product":"okta-ai-agent","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-62863","url":"https://patchfirst.co/cve/CVE-2026-62863/","title":"CVE-2026-62863: MoLing is a computer-use and browser-use based MCP server","content_text":"gojue · moling Not in CISA KEV. CVSS 9.6 CRITICAL. Priority 6.7.","date_published":"2026-10-30T21:17:14.000Z","date_modified":"2026-10-30T21:17:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62863","published":"2026-10-30T21:17:14Z","modified":"2026-10-30T21:17:14Z","title":"MoLing is a computer-use and browser-use based MCP server","vendor":"gojue","product":"moling","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.7}},{"id":"CVE-2026-62853","url":"https://patchfirst.co/cve/CVE-2026-62853/","title":"CVE-2026-62853: ThingLinks is an enterprise IoT platform","content_text":"mqttsnet · thinglinks Not in CISA KEV. CVSS 9.9 CRITICAL. Priority 6.9.","date_published":"2026-10-30T21:17:14.000Z","date_modified":"2026-10-30T21:17:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62853","published":"2026-10-30T21:17:14Z","modified":"2026-10-30T21:17:14Z","title":"ThingLinks is an enterprise IoT platform","vendor":"mqttsnet","product":"thinglinks","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-78403","url":"https://patchfirst.co/cve/CVE-2026-78403/","title":"CVE-2026-78403: Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows…","content_text":"Thalesgroup · Sentinel Keys Server Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T20:17:17.000Z","date_modified":"2026-10-30T20:17:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-78403","published":"2026-10-30T20:17:17Z","modified":"2026-10-30T20:17:17Z","title":"Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows…","vendor":"Thalesgroup","product":"Sentinel Keys Server","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-61850","url":"https://patchfirst.co/cve/CVE-2026-61850/","title":"CVE-2026-61850: Kargo manages and automates the promotion of software artifacts","content_text":"akuity · kargo Not in CISA KEV. CVSS 9.3 CRITICAL. Priority 6.5.","date_published":"2026-10-30T20:17:11.000Z","date_modified":"2026-10-30T20:17:11.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61850","published":"2026-10-30T20:17:11Z","modified":"2026-10-30T20:17:11Z","title":"Kargo manages and automates the promotion of software artifacts","vendor":"akuity","product":"kargo","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.5}},{"id":"CVE-2026-61620","url":"https://patchfirst.co/cve/CVE-2026-61620/","title":"CVE-2026-61620: HoneySQL turns Clojure data structures into SQL","content_text":"seancorfield · honeysql Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T20:17:10.000Z","date_modified":"2026-10-30T23:17:11.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61620","published":"2026-10-30T20:17:10Z","modified":"2026-10-30T23:17:11Z","title":"HoneySQL turns Clojure data structures into SQL","vendor":"seancorfield","product":"honeysql","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-116241","url":"https://patchfirst.co/cve/CVE-2026-116241/","title":"CVE-2026-116241: pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \\copy (...) TO command and checks that the…","content_text":"pgadmin.org · pgAdmin 4 Not in CISA KEV. CVSS 9.9 CRITICAL. Priority 6.9.","date_published":"2026-10-30T20:17:03.000Z","date_modified":"2026-10-30T20:17:03.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116241","published":"2026-10-30T20:17:03Z","modified":"2026-10-30T20:17:03Z","title":"pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \\copy (...) TO command and checks that the…","vendor":"pgadmin.org","product":"pgAdmin 4","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-90888","url":"https://patchfirst.co/cve/CVE-2026-90888/","title":"CVE-2026-90888: Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions","content_text":"leadsnap · LeadSnap Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T19:20:18.000Z","date_modified":"2026-10-30T19:22:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-90888","published":"2026-10-30T19:20:18Z","modified":"2026-10-30T19:22:27Z","title":"Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions","vendor":"leadsnap","product":"LeadSnap","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-39738","url":"https://patchfirst.co/cve/CVE-2026-39738/","title":"CVE-2026-39738: Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions","content_text":"FunnelKit · FunnelKit Automations Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T19:18:24.000Z","date_modified":"2026-10-30T19:22:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-39738","published":"2026-10-30T19:18:24Z","modified":"2026-10-30T19:22:27Z","title":"Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions","vendor":"FunnelKit","product":"FunnelKit Automations","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-39732","url":"https://patchfirst.co/cve/CVE-2026-39732/","title":"CVE-2026-39732: Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions","content_text":"Ivijan-Stefan Stipic · Transliterator Not in CISA KEV. CVSS 9.3 CRITICAL. Priority 6.5.","date_published":"2026-10-30T19:18:24.000Z","date_modified":"2026-10-30T19:22:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-39732","published":"2026-10-30T19:18:24Z","modified":"2026-10-30T19:22:27Z","title":"Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions","vendor":"Ivijan-Stefan Stipic","product":"Transliterator","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.5}},{"id":"CVE-2026-119526","url":"https://patchfirst.co/cve/CVE-2026-119526/","title":"CVE-2026-119526: Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection","content_text":"ThemeREX · Royal Event Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T19:18:20.000Z","date_modified":"2026-10-30T19:22:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-119526","published":"2026-10-30T19:18:20Z","modified":"2026-10-30T19:22:27Z","title":"Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection","vendor":"ThemeREX","product":"Royal Event","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9,"vendorSlug":"themerex"}},{"id":"CVE-2026-116386","url":"https://patchfirst.co/cve/CVE-2026-116386/","title":"CVE-2026-116386: Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions","content_text":"Cozy Vision Technologies Pvt. Ltd. · SMS Alert Order Notifications Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T19:18:13.000Z","date_modified":"2026-10-30T19:22:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116386","published":"2026-10-30T19:18:13Z","modified":"2026-10-30T19:22:27Z","title":"Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions","vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-61826","url":"https://patchfirst.co/cve/CVE-2026-61826/","title":"CVE-2026-61826: Bazarr is a companion application to Sonarr and Radarr","content_text":"morpheus65535 · bazarr Not in CISA KEV. CVSS 10.0 CRITICAL. Priority 7.0.","date_published":"2026-10-30T17:17:27.000Z","date_modified":"2026-10-30T19:39:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61826","published":"2026-10-30T17:17:27Z","modified":"2026-10-30T19:39:14Z","title":"Bazarr is a companion application to Sonarr and Radarr","vendor":"morpheus65535","product":"bazarr","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":7}},{"id":"CVE-2026-112816","url":"https://patchfirst.co/cve/CVE-2026-112816/","title":"CVE-2026-112816: Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15…","content_text":"Canonical · LXD Not in CISA KEV. CVSS 10.0 CRITICAL. Priority 7.0.","date_published":"2026-10-30T17:17:14.000Z","date_modified":"2026-10-31T04:18:16.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-112816","published":"2026-10-30T17:17:14Z","modified":"2026-10-31T04:18:16Z","title":"Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15…","vendor":"Canonical","product":"LXD","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"4.0"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":7}},{"id":"CVE-2026-119706","url":"https://patchfirst.co/cve/CVE-2026-119706/","title":"CVE-2026-119706: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…","content_text":"InternLM · lmdeploy Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T16:17:51.000Z","date_modified":"2026-10-30T16:17:51.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-119706","published":"2026-10-30T16:17:51Z","modified":"2026-10-30T16:17:51Z","title":"InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…","vendor":"InternLM","product":"lmdeploy","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-93327","url":"https://patchfirst.co/cve/CVE-2026-93327/","title":"CVE-2026-93327: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…","content_text":"Google Cloud · Application Integration Not in CISA KEV. CVSS 9.4 CRITICAL. Priority 6.6.","date_published":"2026-10-30T15:16:56.000Z","date_modified":"2026-10-30T19:37:07.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-93327","published":"2026-10-30T15:16:56Z","modified":"2026-10-30T19:37:07Z","title":"A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…","vendor":"Google Cloud","product":"Application Integration","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.6}},{"id":"CVE-2026-61738","url":"https://patchfirst.co/cve/CVE-2026-61738/","title":"CVE-2026-61738: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs","content_text":"socfortress · CoPilot Not in CISA KEV. CVSS 10.0 CRITICAL. Priority 7.0.","date_published":"2026-10-30T15:16:53.000Z","date_modified":"2026-10-30T17:13:54.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61738","published":"2026-10-30T15:16:53Z","modified":"2026-10-30T17:13:54Z","title":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs","vendor":"socfortress","product":"CoPilot","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":7}},{"id":"CVE-2026-61737","url":"https://patchfirst.co/cve/CVE-2026-61737/","title":"CVE-2026-61737: ng-antd-admin is an Angular and NestJS administration system template","content_text":"huajian123 · ng-antd-admin Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T15:16:53.000Z","date_modified":"2026-10-30T19:39:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61737","published":"2026-10-30T15:16:53Z","modified":"2026-10-30T19:39:14Z","title":"ng-antd-admin is an Angular and NestJS administration system template","vendor":"huajian123","product":"ng-antd-admin","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-61730","url":"https://patchfirst.co/cve/CVE-2026-61730/","title":"CVE-2026-61730: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs","content_text":"socfortress · CoPilot Not in CISA KEV. CVSS 9.3 CRITICAL. Priority 6.5.","date_published":"2026-10-30T15:16:53.000Z","date_modified":"2026-10-30T17:13:54.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61730","published":"2026-10-30T15:16:53Z","modified":"2026-10-30T17:13:54Z","title":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs","vendor":"socfortress","product":"CoPilot","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.5}},{"id":"CVE-2026-61729","url":"https://patchfirst.co/cve/CVE-2026-61729/","title":"CVE-2026-61729: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs","content_text":"socfortress · CoPilot Not in CISA KEV. CVSS 9.4 CRITICAL. Priority 6.6.","date_published":"2026-10-30T15:16:53.000Z","date_modified":"2026-10-30T17:13:54.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61729","published":"2026-10-30T15:16:53Z","modified":"2026-10-30T17:13:54Z","title":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs","vendor":"socfortress","product":"CoPilot","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.6}},{"id":"CVE-2026-61728","url":"https://patchfirst.co/cve/CVE-2026-61728/","title":"CVE-2026-61728: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs","content_text":"socfortress · CoPilot Not in CISA KEV. CVSS 9.9 CRITICAL. Priority 6.9.","date_published":"2026-10-30T15:16:52.000Z","date_modified":"2026-10-30T17:13:54.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61728","published":"2026-10-30T15:16:52Z","modified":"2026-10-30T17:13:54Z","title":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs","vendor":"socfortress","product":"CoPilot","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-119660","url":"https://patchfirst.co/cve/CVE-2026-119660/","title":"CVE-2026-119660: MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…","content_text":"yincongcyincong · MuseBot Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T15:16:50.000Z","date_modified":"2026-10-30T19:23:25.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-119660","published":"2026-10-30T15:16:50Z","modified":"2026-10-30T19:23:25Z","title":"MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…","vendor":"yincongcyincong","product":"MuseBot","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-110799","url":"https://patchfirst.co/cve/CVE-2026-110799/","title":"CVE-2026-110799: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores","content_text":"givanz · Vvveb Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T15:16:44.000Z","date_modified":"2026-10-30T16:17:37.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-110799","published":"2026-10-30T15:16:44Z","modified":"2026-10-30T16:17:37Z","title":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores","vendor":"givanz","product":"Vvveb","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2015-20130","url":"https://patchfirst.co/cve/CVE-2015-20130/","title":"CVE-2015-20130: Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…","content_text":"Netsweeper · Netsweeper Not in CISA KEV. CVSS 6.1 MEDIUM. Priority 54.3.","date_published":"2026-10-30T15:16:44.000Z","date_modified":"2026-10-30T19:14:38.000Z","tags":[],"_patchfirst":{"id":"CVE-2015-20130","published":"2026-10-30T15:16:44Z","modified":"2026-10-30T19:14:38Z","title":"Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…","vendor":"Netsweeper","product":"Netsweeper","tier":"core","cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"epss":null,"kev":null,"vulncheckKev":{"dateAdded":"2026-10-30"},"exploited":true,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":54.3}},{"id":"CVE-2010-20125","url":"https://patchfirst.co/cve/CVE-2010-20125/","title":"CVE-2010-20125: DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…","content_text":"DedeCMS · DedeCMS Not in CISA KEV. CVSS 7.5 HIGH. Priority 50.2.","date_published":"2026-10-30T15:16:43.000Z","date_modified":"2026-10-30T19:23:25.000Z","tags":[],"_patchfirst":{"id":"CVE-2010-20125","published":"2026-10-30T15:16:43Z","modified":"2026-10-30T19:23:25Z","title":"DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…","vendor":"DedeCMS","product":"DedeCMS","tier":"core","cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"epss":null,"kev":null,"vulncheckKev":{"dateAdded":"2026-10-30"},"exploited":true,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":50.2}},{"id":"CVE-2026-119597","url":"https://patchfirst.co/cve/CVE-2026-119597/","title":"CVE-2026-119597: OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers…","content_text":"AIDotNet · OpenDeepWiki Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 6.9.","date_published":"2026-10-30T14:16:47.000Z","date_modified":"2026-10-30T19:23:25.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-119597","published":"2026-10-30T14:16:47Z","modified":"2026-10-30T19:23:25Z","title":"OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers…","vendor":"AIDotNet","product":"OpenDeepWiki","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":6.9}},{"id":"CVE-2026-116366","url":"https://patchfirst.co/cve/CVE-2026-116366/","title":"CVE-2026-116366: An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user…","content_text":"ClickHouse · ClickHouse Not in CISA KEV. CVSS 9.5 CRITICAL. Priority 7.3.","date_published":"2026-10-30T11:17:32.000Z","date_modified":"2026-10-30T19:37:07.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116366","published":"2026-10-30T11:17:32Z","modified":"2026-10-30T19:37:07Z","title":"An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user…","vendor":"ClickHouse","product":"ClickHouse","tier":"core","cvss":{"score":9.5,"severity":"CRITICAL","version":"4.0"},"epss":null,"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":7.3}},{"id":"CVE-2025-31704","url":"https://patchfirst.co/cve/CVE-2025-31704/","title":"CVE-2025-31704: A vulnerability has been found in the Dahua Intelligent Connection Center","content_text":"Dahua · Intelligent Connection Center Not in CISA KEV. CVSS 9.8 CRITICAL. Priority 52.5.","date_published":"2026-10-30T11:17:31.000Z","date_modified":"2026-10-30T19:39:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2025-31704","published":"2026-10-30T11:17:31Z","modified":"2026-10-30T19:39:14Z","title":"A vulnerability has been found in the Dahua Intelligent Connection Center","vendor":"Dahua","product":"Intelligent Connection Center","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":null,"kev":null,"vulncheckKev":{"dateAdded":"2026-10-30"},"exploited":true,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":52.5,"vendorSlug":"dahua"}},{"id":"CVE-2026-82104","url":"https://patchfirst.co/cve/CVE-2026-82104/","title":"CVE-2026-82104: In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9…","content_text":"Teltonika Networks · RUT Not in CISA KEV. EPSS 0.4% (percentile 35.9). CVSS 9.4 CRITICAL. Priority 14.4.","date_published":"2026-10-30T08:17:00.000Z","date_modified":"2026-10-30T17:45:50.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-82104","published":"2026-10-30T08:17:00Z","modified":"2026-10-30T17:45:50Z","title":"In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9…","vendor":"Teltonika Networks","product":"RUT","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00416,"percentile":0.35876},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.4}},{"id":"CVE-2026-103039","url":"https://patchfirst.co/cve/CVE-2026-103039/","title":"CVE-2026-103039: The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including…","content_text":"Gravity Forms · Gravity Forms Not in CISA KEV. EPSS 0.5% (percentile 43.4). CVSS 9.8 CRITICAL. Priority 61.2.","date_published":"2026-10-30T07:16:30.000Z","date_modified":"2026-10-30T16:17:35.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103039","published":"2026-10-30T07:16:30Z","modified":"2026-10-30T16:17:35Z","title":"The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including…","vendor":"Gravity Forms","product":"Gravity Forms","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00508,"percentile":0.43387},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-30"},"exploited":true,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":61.2}},{"id":"CVE-2026-118539","url":"https://patchfirst.co/cve/CVE-2026-118539/","title":"CVE-2026-118539: Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing","content_text":"Drupal · Commerce Core Not in CISA KEV. EPSS 0.2% (percentile 12.8). CVSS 6.5 MEDIUM. Priority 52.8.","date_published":"2026-10-30T04:18:18.000Z","date_modified":"2026-10-31T04:18:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118539","published":"2026-10-30T04:18:18Z","modified":"2026-10-31T04:18:17Z","title":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing","vendor":"Drupal","product":"Commerce Core","tier":"core","cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"epss":{"score":0.00222,"percentile":0.12836},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-28"},"exploited":true,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":["Packagist:https://packages.drupal.org/8"],"euvdExploited":false,"priority":52.8,"vendorSlug":"drupal"}},{"id":"CVE-2026-107249","url":"https://patchfirst.co/cve/CVE-2026-107249/","title":"CVE-2026-107249: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…","content_text":"Drupal · Block AJAX Not in CISA KEV. EPSS 0.2% (percentile 8.6). CVSS 9.8 CRITICAL. Priority 9.3.","date_published":"2026-10-30T04:17:43.000Z","date_modified":"2026-10-30T20:16:54.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-107249","published":"2026-10-30T04:17:43Z","modified":"2026-10-30T20:16:54Z","title":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…","vendor":"Drupal","product":"Block AJAX","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00189,"percentile":0.08567},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":["Packagist:https://packages.drupal.org/8"],"euvdExploited":false,"priority":9.3,"vendorSlug":"drupal"}},{"id":"CVE-2026-119263","url":"https://patchfirst.co/cve/CVE-2026-119263/","title":"CVE-2026-119263: Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.2% (percentile 9.7). CVSS 9.6 CRITICAL. Priority 9.3.","date_published":"2026-10-30T01:16:45.000Z","date_modified":"2026-10-31T04:18:18.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-119263","published":"2026-10-30T01:16:45Z","modified":"2026-10-31T04:18:18Z","title":"Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00198,"percentile":0.09689},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":9.3,"vendorSlug":"google"}},{"id":"CVE-2026-119261","url":"https://patchfirst.co/cve/CVE-2026-119261/","title":"CVE-2026-119261: Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.2% (percentile 11.6). CVSS 9.6 CRITICAL. Priority 9.7.","date_published":"2026-10-30T01:16:44.000Z","date_modified":"2026-10-31T04:18:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-119261","published":"2026-10-30T01:16:44Z","modified":"2026-10-31T04:18:17Z","title":"Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00213,"percentile":0.11601},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":9.7,"vendorSlug":"google"}},{"id":"CVE-2026-118527","url":"https://patchfirst.co/cve/CVE-2026-118527/","title":"CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","content_text":"Ivanti · Connect Secure In CISA KEV since 2026-10-30. Priority 45.0.","date_published":"2026-10-30T00:00:00.000Z","date_modified":"1970-01-01T00:00:00.000Z","tags":["kev","T1190","T1105"],"_patchfirst":{"id":"CVE-2026-118527","published":"2026-10-30T00:00:00Z","modified":null,"title":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","vendor":"Ivanti","product":"Connect Secure","tier":"core","cvss":null,"epss":null,"kev":{"dateAdded":"2026-10-30","ransomware":false},"vulncheckKev":{"dateAdded":"2026-10-30"},"exploited":true,"reportCount":0,"techniqueIds":["T1190","T1105"],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":45,"vendorSlug":"ivanti"}},{"id":"CVE-2023-22793","url":"https://patchfirst.co/cve/CVE-2023-22793/","title":"CVE-2023-22793: A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the…","content_text":"Veeam · Management Pack for Microsoft System Center Not in CISA KEV. EPSS 0.5% (percentile 44.5). CVSS 9.3 CRITICAL. Priority 16.1.","date_published":"2026-10-29T23:16:54.000Z","date_modified":"2026-10-30T19:37:07.000Z","tags":[],"_patchfirst":{"id":"CVE-2023-22793","published":"2026-10-29T23:16:54Z","modified":"2026-10-30T19:37:07Z","title":"A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the…","vendor":"Veeam","product":"Management Pack for Microsoft System Center","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00526,"percentile":0.44533},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16.1,"vendorSlug":"veeam"}},{"id":"CVE-2026-61645","url":"https://patchfirst.co/cve/CVE-2026-61645/","title":"CVE-2026-61645: Docat is a tool for hosting versioned static documentation","content_text":"docat-org · docat Not in CISA KEV. EPSS 0.4% (percentile 35.3). CVSS 9.1 CRITICAL. Priority 14.1.","date_published":"2026-10-29T22:17:04.000Z","date_modified":"2026-10-30T19:39:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61645","published":"2026-10-29T22:17:04Z","modified":"2026-10-30T19:39:14Z","title":"Docat is a tool for hosting versioned static documentation","vendor":"docat-org","product":"docat","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0041,"percentile":0.35278},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.1}},{"id":"CVE-2026-103093","url":"https://patchfirst.co/cve/CVE-2026-103093/","title":"CVE-2026-103093: ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform","content_text":"ServiceNow · ServiceNow AI Platform Not in CISA KEV. EPSS 0.4% (percentile 37.2). CVSS 9.4 CRITICAL. Priority 14.7.","date_published":"2026-10-29T19:17:15.000Z","date_modified":"2026-10-30T17:44:35.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103093","published":"2026-10-29T19:17:15Z","modified":"2026-10-30T17:44:35Z","title":"ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform","vendor":"ServiceNow","product":"ServiceNow AI Platform","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00429,"percentile":0.37194},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.7,"vendorSlug":"servicenow"}},{"id":"CVE-2026-118769","url":"https://patchfirst.co/cve/CVE-2026-118769/","title":"CVE-2026-118769: Botan is a C++ cryptography library","content_text":"randombit · botan Not in CISA KEV. EPSS 0.4% (percentile 30.3). CVSS 9.2 CRITICAL. Priority 13.2.","date_published":"2026-10-29T18:17:29.000Z","date_modified":"2026-10-30T19:37:07.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118769","published":"2026-10-29T18:17:29Z","modified":"2026-10-30T19:37:07Z","title":"Botan is a C++ cryptography library","vendor":"randombit","product":"botan","tier":"core","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00365,"percentile":0.30341},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":13.2}},{"id":"CVE-2026-118762","url":"https://patchfirst.co/cve/CVE-2026-118762/","title":"CVE-2026-118762: Monkeytype is a minimalistic and customizable typing test","content_text":"monkeytypegame · monkeytype Not in CISA KEV. EPSS 0.3% (percentile 25.0). CVSS 9.3 CRITICAL. Priority 12.2.","date_published":"2026-10-29T17:18:07.000Z","date_modified":"2026-10-29T17:18:07.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118762","published":"2026-10-29T17:18:07Z","modified":"2026-10-29T17:18:07Z","title":"Monkeytype is a minimalistic and customizable typing test","vendor":"monkeytypegame","product":"monkeytype","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0032,"percentile":0.24996},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":12.2}},{"id":"CVE-2026-107058","url":"https://patchfirst.co/cve/CVE-2026-107058/","title":"CVE-2026-107058: An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another…","content_text":"Not in CISA KEV. EPSS 0.5% (percentile 41.9). CVSS 9.8 CRITICAL. Priority 15.9.","date_published":"2026-10-29T17:17:58.000Z","date_modified":"2026-10-30T19:39:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-107058","published":"2026-10-29T17:17:58Z","modified":"2026-10-30T19:39:14Z","title":"An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another…","vendor":null,"product":null,"tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00487,"percentile":0.4191},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":15.9}},{"id":"CVE-2026-93680","url":"https://patchfirst.co/cve/CVE-2026-93680/","title":"CVE-2026-93680: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…","content_text":"IBM · Langflow OSS Not in CISA KEV. EPSS 2.3% (percentile 83.0). CVSS 9.8 CRITICAL. Priority 29.1.","date_published":"2026-10-29T16:20:06.000Z","date_modified":"2026-10-30T18:18:20.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-93680","published":"2026-10-29T16:20:06Z","modified":"2026-10-30T18:18:20Z","title":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…","vendor":"IBM","product":"Langflow OSS","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.02265,"percentile":0.82991},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":29.1,"vendorSlug":"ibm"}},{"id":"CVE-2026-90868","url":"https://patchfirst.co/cve/CVE-2026-90868/","title":"CVE-2026-90868: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…","content_text":"Progress Software · WS_FTP Server Not in CISA KEV. EPSS 1.5% (percentile 74.1). CVSS 9.9 CRITICAL. Priority 22.4.","date_published":"2026-10-29T16:20:04.000Z","date_modified":"2026-10-30T18:18:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-90868","published":"2026-10-29T16:20:04Z","modified":"2026-10-30T18:18:17Z","title":"An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…","vendor":"Progress Software","product":"WS_FTP Server","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.01493,"percentile":0.74123},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":22.4,"vendorSlug":"progress"}},{"id":"CVE-2026-90866","url":"https://patchfirst.co/cve/CVE-2026-90866/","title":"CVE-2026-90866: A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…","content_text":"Progress Software · WS_FTP Server Not in CISA KEV. EPSS 0.7% (percentile 54.2). CVSS 9.1 CRITICAL. Priority 17.9.","date_published":"2026-10-29T16:20:04.000Z","date_modified":"2026-10-30T18:18:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-90866","published":"2026-10-29T16:20:04Z","modified":"2026-10-30T18:18:17Z","title":"A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…","vendor":"Progress Software","product":"WS_FTP Server","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0073,"percentile":0.54231},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":17.9,"vendorSlug":"progress"}},{"id":"CVE-2026-90864","url":"https://patchfirst.co/cve/CVE-2026-90864/","title":"CVE-2026-90864: A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…","content_text":"Progress Software · WS_FTP Server Not in CISA KEV. EPSS 0.5% (percentile 41.3). CVSS 9.1 CRITICAL. Priority 15.3.","date_published":"2026-10-29T16:20:04.000Z","date_modified":"2026-10-30T18:18:16.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-90864","published":"2026-10-29T16:20:04Z","modified":"2026-10-30T18:18:16Z","title":"A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…","vendor":"Progress Software","product":"WS_FTP Server","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00479,"percentile":0.4133},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":15.3,"vendorSlug":"progress"}},{"id":"CVE-2026-90863","url":"https://patchfirst.co/cve/CVE-2026-90863/","title":"CVE-2026-90863: Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7…","content_text":"Progress Software · WS_FTP Server Not in CISA KEV. EPSS 0.7% (percentile 51.4). CVSS 9.1 CRITICAL. Priority 17.3.","date_published":"2026-10-29T16:20:04.000Z","date_modified":"2026-10-30T18:18:16.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-90863","published":"2026-10-29T16:20:04Z","modified":"2026-10-30T18:18:16Z","title":"Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7…","vendor":"Progress Software","product":"WS_FTP Server","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00656,"percentile":0.51394},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":17.3,"vendorSlug":"progress"}},{"id":"CVE-2026-84295","url":"https://patchfirst.co/cve/CVE-2026-84295/","title":"CVE-2026-84295: Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could…","content_text":"Progress Software · WS_FTP Server Not in CISA KEV. EPSS 0.6% (percentile 46.2). CVSS 10.0 CRITICAL. Priority 16.9.","date_published":"2026-10-29T16:19:29.000Z","date_modified":"2026-10-30T18:18:13.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-84295","published":"2026-10-29T16:19:29Z","modified":"2026-10-30T18:18:13Z","title":"Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could…","vendor":"Progress Software","product":"WS_FTP Server","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00553,"percentile":0.462},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16.9,"vendorSlug":"progress"}},{"id":"CVE-2026-62131","url":"https://patchfirst.co/cve/CVE-2026-62131/","title":"CVE-2026-62131: Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions","content_text":"Zoho Flow · Zoho Flow Not in CISA KEV. EPSS 0.3% (percentile 24.3). CVSS 9.8 CRITICAL. Priority 12.4.","date_published":"2026-10-29T16:18:14.000Z","date_modified":"2026-10-30T19:18:32.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62131","published":"2026-10-29T16:18:14Z","modified":"2026-10-30T19:18:32Z","title":"Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions","vendor":"Zoho Flow","product":"Zoho Flow","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00313,"percentile":0.24265},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":12.4}},{"id":"CVE-2026-62018","url":"https://patchfirst.co/cve/CVE-2026-62018/","title":"CVE-2026-62018: Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions","content_text":"ThemeREX · Gunslinger Not in CISA KEV. EPSS 0.4% (percentile 39.1). CVSS 9.8 CRITICAL. Priority 15.4.","date_published":"2026-10-29T16:18:14.000Z","date_modified":"2026-10-29T20:17:32.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62018","published":"2026-10-29T16:18:14Z","modified":"2026-10-29T20:17:32Z","title":"Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions","vendor":"ThemeREX","product":"Gunslinger","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00449,"percentile":0.39063},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":15.4,"vendorSlug":"themerex"}},{"id":"CVE-2026-62017","url":"https://patchfirst.co/cve/CVE-2026-62017/","title":"CVE-2026-62017: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions","content_text":"ThemeREX · Good Homes Not in CISA KEV. EPSS 0.4% (percentile 36.2). CVSS 9.8 CRITICAL. Priority 14.8.","date_published":"2026-10-29T16:18:14.000Z","date_modified":"2026-10-29T18:17:34.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62017","published":"2026-10-29T16:18:14Z","modified":"2026-10-29T18:17:34Z","title":"Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions","vendor":"ThemeREX","product":"Good Homes","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00419,"percentile":0.36207},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.8,"vendorSlug":"themerex"}},{"id":"CVE-2026-62016","url":"https://patchfirst.co/cve/CVE-2026-62016/","title":"CVE-2026-62016: Unauthenticated PHP Object Injection in Gamic <= 1.19 versions","content_text":"ThemeREX · Gamic Not in CISA KEV. EPSS 0.4% (percentile 33.8). CVSS 9.8 CRITICAL. Priority 14.3.","date_published":"2026-10-29T16:18:14.000Z","date_modified":"2026-10-30T19:18:31.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62016","published":"2026-10-29T16:18:14Z","modified":"2026-10-30T19:18:31Z","title":"Unauthenticated PHP Object Injection in Gamic <= 1.19 versions","vendor":"ThemeREX","product":"Gamic","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00396,"percentile":0.33795},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-62015","url":"https://patchfirst.co/cve/CVE-2026-62015/","title":"CVE-2026-62015: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions","content_text":"ThemeREX · Gamezone Not in CISA KEV. EPSS 0.4% (percentile 33.8). CVSS 9.8 CRITICAL. Priority 14.3.","date_published":"2026-10-29T16:18:14.000Z","date_modified":"2026-10-30T19:18:31.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62015","published":"2026-10-29T16:18:14Z","modified":"2026-10-30T19:18:31Z","title":"Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions","vendor":"ThemeREX","product":"Gamezone","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00396,"percentile":0.33795},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-62014","url":"https://patchfirst.co/cve/CVE-2026-62014/","title":"CVE-2026-62014: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions","content_text":"ThemeREX · EmojiNation Not in CISA KEV. EPSS 0.4% (percentile 36.8). CVSS 9.8 CRITICAL. Priority 14.9.","date_published":"2026-10-29T16:18:14.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62014","published":"2026-10-29T16:18:14Z","modified":"2026-10-30T19:18:30Z","title":"Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions","vendor":"ThemeREX","product":"EmojiNation","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00425,"percentile":0.3677},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.9,"vendorSlug":"themerex"}},{"id":"CVE-2026-62013","url":"https://patchfirst.co/cve/CVE-2026-62013/","title":"CVE-2026-62013: Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions","content_text":"ThemeREX · Edge Decor Not in CISA KEV. EPSS 0.4% (percentile 39.1). CVSS 9.8 CRITICAL. Priority 15.4.","date_published":"2026-10-29T16:18:14.000Z","date_modified":"2026-10-29T20:17:32.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62013","published":"2026-10-29T16:18:14Z","modified":"2026-10-29T20:17:32Z","title":"Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions","vendor":"ThemeREX","product":"Edge Decor","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00449,"percentile":0.39063},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":15.4,"vendorSlug":"themerex"}},{"id":"CVE-2026-62012","url":"https://patchfirst.co/cve/CVE-2026-62012/","title":"CVE-2026-62012: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions","content_text":"ThemeREX · Coinpress Not in CISA KEV. EPSS 0.4% (percentile 36.2). CVSS 9.8 CRITICAL. Priority 14.8.","date_published":"2026-10-29T16:18:13.000Z","date_modified":"2026-10-29T18:17:34.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62012","published":"2026-10-29T16:18:13Z","modified":"2026-10-29T18:17:34Z","title":"Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions","vendor":"ThemeREX","product":"Coinpress","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00419,"percentile":0.36207},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.8,"vendorSlug":"themerex"}},{"id":"CVE-2026-62011","url":"https://patchfirst.co/cve/CVE-2026-62011/","title":"CVE-2026-62011: Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions","content_text":"ThemeREX · Bonbon Not in CISA KEV. EPSS 0.4% (percentile 33.8). CVSS 9.8 CRITICAL. Priority 14.3.","date_published":"2026-10-29T16:18:13.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62011","published":"2026-10-29T16:18:13Z","modified":"2026-10-30T19:18:30Z","title":"Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions","vendor":"ThemeREX","product":"Bonbon","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00396,"percentile":0.33794},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-62010","url":"https://patchfirst.co/cve/CVE-2026-62010/","title":"CVE-2026-62010: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions","content_text":"ThemeREX · Avventure Not in CISA KEV. EPSS 0.4% (percentile 33.8). CVSS 9.8 CRITICAL. Priority 14.3.","date_published":"2026-10-29T16:18:13.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62010","published":"2026-10-29T16:18:13Z","modified":"2026-10-30T19:18:30Z","title":"Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions","vendor":"ThemeREX","product":"Avventure","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00396,"percentile":0.33795},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-62009","url":"https://patchfirst.co/cve/CVE-2026-62009/","title":"CVE-2026-62009: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions","content_text":"ThemeREX · Filmax Not in CISA KEV. EPSS 0.4% (percentile 36.8). CVSS 9.8 CRITICAL. Priority 14.9.","date_published":"2026-10-29T16:18:13.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62009","published":"2026-10-29T16:18:13Z","modified":"2026-10-30T19:18:30Z","title":"Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions","vendor":"ThemeREX","product":"Filmax","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00425,"percentile":0.3677},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.9,"vendorSlug":"themerex"}},{"id":"CVE-2026-62008","url":"https://patchfirst.co/cve/CVE-2026-62008/","title":"CVE-2026-62008: Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions","content_text":"ThemeREX · Orpheus Not in CISA KEV. EPSS 0.4% (percentile 36.2). CVSS 9.8 CRITICAL. Priority 14.8.","date_published":"2026-10-29T16:18:13.000Z","date_modified":"2026-10-29T20:17:32.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62008","published":"2026-10-29T16:18:13Z","modified":"2026-10-29T20:17:32Z","title":"Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions","vendor":"ThemeREX","product":"Orpheus","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00419,"percentile":0.36208},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.8,"vendorSlug":"themerex"}},{"id":"CVE-2026-62006","url":"https://patchfirst.co/cve/CVE-2026-62006/","title":"CVE-2026-62006: Unauthenticated PHP Object Injection in Nuts <= 1.12 versions","content_text":"ThemeREX · Nuts Not in CISA KEV. EPSS 0.4% (percentile 36.2). CVSS 9.8 CRITICAL. Priority 14.8.","date_published":"2026-10-29T16:18:13.000Z","date_modified":"2026-10-29T18:17:34.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62006","published":"2026-10-29T16:18:13Z","modified":"2026-10-29T18:17:34Z","title":"Unauthenticated PHP Object Injection in Nuts <= 1.12 versions","vendor":"ThemeREX","product":"Nuts","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00419,"percentile":0.36208},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.8,"vendorSlug":"themerex"}},{"id":"CVE-2026-62005","url":"https://patchfirst.co/cve/CVE-2026-62005/","title":"CVE-2026-62005: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions","content_text":"ThemeREX · Muzicon Not in CISA KEV. EPSS 0.4% (percentile 33.8). CVSS 9.8 CRITICAL. Priority 14.3.","date_published":"2026-10-29T16:18:13.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62005","published":"2026-10-29T16:18:13Z","modified":"2026-10-30T19:18:30Z","title":"Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions","vendor":"ThemeREX","product":"Muzicon","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00396,"percentile":0.33794},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-62004","url":"https://patchfirst.co/cve/CVE-2026-62004/","title":"CVE-2026-62004: Unauthenticated PHP Object Injection in Motorix <= 1.11 versions","content_text":"ThemeREX · Motorix Not in CISA KEV. EPSS 0.4% (percentile 33.8). CVSS 9.8 CRITICAL. Priority 14.3.","date_published":"2026-10-29T16:18:13.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62004","published":"2026-10-29T16:18:13Z","modified":"2026-10-30T19:18:30Z","title":"Unauthenticated PHP Object Injection in Motorix <= 1.11 versions","vendor":"ThemeREX","product":"Motorix","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00396,"percentile":0.33794},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-62003","url":"https://patchfirst.co/cve/CVE-2026-62003/","title":"CVE-2026-62003: Unauthenticated PHP Object Injection in Mission <= 1.22 versions","content_text":"ThemeREX · Mission Not in CISA KEV. EPSS 0.4% (percentile 33.8). CVSS 9.8 CRITICAL. Priority 14.3.","date_published":"2026-10-29T16:18:12.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62003","published":"2026-10-29T16:18:12Z","modified":"2026-10-30T19:18:30Z","title":"Unauthenticated PHP Object Injection in Mission <= 1.22 versions","vendor":"ThemeREX","product":"Mission","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00396,"percentile":0.33795},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-62002","url":"https://patchfirst.co/cve/CVE-2026-62002/","title":"CVE-2026-62002: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions","content_text":"ThemeREX · Meals & Wheels Not in CISA KEV. EPSS 0.5% (percentile 43.6). CVSS 9.8 CRITICAL. Priority 16.3.","date_published":"2026-10-29T16:18:12.000Z","date_modified":"2026-10-29T20:17:31.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62002","published":"2026-10-29T16:18:12Z","modified":"2026-10-29T20:17:31Z","title":"Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions","vendor":"ThemeREX","product":"Meals & Wheels","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00511,"percentile":0.43565},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-62001","url":"https://patchfirst.co/cve/CVE-2026-62001/","title":"CVE-2026-62001: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions","content_text":"ThemeREX · Marcell Not in CISA KEV. EPSS 0.5% (percentile 41.1). CVSS 9.8 CRITICAL. Priority 15.8.","date_published":"2026-10-29T16:18:12.000Z","date_modified":"2026-10-29T18:17:34.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-62001","published":"2026-10-29T16:18:12Z","modified":"2026-10-29T18:17:34Z","title":"Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions","vendor":"ThemeREX","product":"Marcell","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00476,"percentile":0.41133},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":15.8,"vendorSlug":"themerex"}},{"id":"CVE-2026-61998","url":"https://patchfirst.co/cve/CVE-2026-61998/","title":"CVE-2026-61998: Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions","content_text":"ThemeREX · Le Truffe Not in CISA KEV. EPSS 0.5% (percentile 41.1). CVSS 9.8 CRITICAL. Priority 15.8.","date_published":"2026-10-29T16:18:12.000Z","date_modified":"2026-10-30T19:18:29.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61998","published":"2026-10-29T16:18:12Z","modified":"2026-10-30T19:18:29Z","title":"Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions","vendor":"ThemeREX","product":"Le Truffe","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00476,"percentile":0.41133},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":15.8,"vendorSlug":"themerex"}},{"id":"CVE-2026-61997","url":"https://patchfirst.co/cve/CVE-2026-61997/","title":"CVE-2026-61997: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions","content_text":"ThemeREX · Legal Stone Not in CISA KEV. EPSS 0.5% (percentile 43.6). CVSS 9.8 CRITICAL. Priority 16.3.","date_published":"2026-10-29T16:18:12.000Z","date_modified":"2026-10-30T19:18:29.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61997","published":"2026-10-29T16:18:12Z","modified":"2026-10-30T19:18:29Z","title":"Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions","vendor":"ThemeREX","product":"Legal Stone","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00511,"percentile":0.43565},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16.3,"vendorSlug":"themerex"}},{"id":"CVE-2026-61992","url":"https://patchfirst.co/cve/CVE-2026-61992/","title":"CVE-2026-61992: Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions","content_text":"Von Eyal Fitoussi · GEO my WordPress Not in CISA KEV. EPSS 0.4% (percentile 32.7). CVSS 9.8 CRITICAL. Priority 14.1.","date_published":"2026-10-29T16:18:11.000Z","date_modified":"2026-10-30T19:18:29.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61992","published":"2026-10-29T16:18:11Z","modified":"2026-10-30T19:18:29Z","title":"Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions","vendor":"Von Eyal Fitoussi","product":"GEO my WordPress","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00386,"percentile":0.32706},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.1}},{"id":"CVE-2026-61991","url":"https://patchfirst.co/cve/CVE-2026-61991/","title":"CVE-2026-61991: Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions","content_text":"Ajax Load More · AjaxLoadMore Cache Not in CISA KEV. EPSS 0.7% (percentile 54.8). CVSS 10.0 CRITICAL. Priority 18.7.","date_published":"2026-10-29T16:18:11.000Z","date_modified":"2026-10-30T19:18:29.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61991","published":"2026-10-29T16:18:11Z","modified":"2026-10-30T19:18:29Z","title":"Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions","vendor":"Ajax Load More","product":"AjaxLoadMore Cache","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00748,"percentile":0.5484},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":18.7}},{"id":"CVE-2026-54860","url":"https://patchfirst.co/cve/CVE-2026-54860/","title":"CVE-2026-54860: Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions","content_text":"ThemeREX · Ozisti Not in CISA KEV. EPSS 0.5% (percentile 42.2). CVSS 9.8 CRITICAL. Priority 16.0.","date_published":"2026-10-29T16:18:10.000Z","date_modified":"2026-10-30T19:18:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-54860","published":"2026-10-29T16:18:10Z","modified":"2026-10-30T19:18:26Z","title":"Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions","vendor":"ThemeREX","product":"Ozisti","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0049,"percentile":0.42158},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16,"vendorSlug":"themerex"}},{"id":"CVE-2026-54859","url":"https://patchfirst.co/cve/CVE-2026-54859/","title":"CVE-2026-54859: Unauthenticated PHP Object Injection in Preservation <= 1.15 versions","content_text":"ThemeREX · Preservation Not in CISA KEV. EPSS 0.5% (percentile 44.6). CVSS 9.8 CRITICAL. Priority 16.5.","date_published":"2026-10-29T16:18:10.000Z","date_modified":"2026-10-29T20:17:31.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-54859","published":"2026-10-29T16:18:10Z","modified":"2026-10-29T20:17:31Z","title":"Unauthenticated PHP Object Injection in Preservation <= 1.15 versions","vendor":"ThemeREX","product":"Preservation","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00526,"percentile":0.44563},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16.5,"vendorSlug":"themerex"}},{"id":"CVE-2026-54858","url":"https://patchfirst.co/cve/CVE-2026-54858/","title":"CVE-2026-54858: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions","content_text":"ThemeREX · Printy Not in CISA KEV. EPSS 0.5% (percentile 42.2). CVSS 9.8 CRITICAL. Priority 16.0.","date_published":"2026-10-29T16:18:09.000Z","date_modified":"2026-10-29T18:17:33.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-54858","published":"2026-10-29T16:18:09Z","modified":"2026-10-29T18:17:33Z","title":"Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions","vendor":"ThemeREX","product":"Printy","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0049,"percentile":0.42158},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16,"vendorSlug":"themerex"}},{"id":"CVE-2026-54857","url":"https://patchfirst.co/cve/CVE-2026-54857/","title":"CVE-2026-54857: Unauthenticated PHP Object Injection in Quirky <= 1.23 versions","content_text":"ThemeREX · Quirky Not in CISA KEV. EPSS 0.5% (percentile 42.2). CVSS 9.8 CRITICAL. Priority 16.0.","date_published":"2026-10-29T16:18:09.000Z","date_modified":"2026-10-30T19:18:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-54857","published":"2026-10-29T16:18:09Z","modified":"2026-10-30T19:18:26Z","title":"Unauthenticated PHP Object Injection in Quirky <= 1.23 versions","vendor":"ThemeREX","product":"Quirky","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0049,"percentile":0.42158},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16,"vendorSlug":"themerex"}},{"id":"CVE-2026-54856","url":"https://patchfirst.co/cve/CVE-2026-54856/","title":"CVE-2026-54856: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions","content_text":"ThemeREX · RexCoin Not in CISA KEV. EPSS 0.5% (percentile 42.2). CVSS 9.8 CRITICAL. Priority 16.0.","date_published":"2026-10-29T16:18:09.000Z","date_modified":"2026-10-30T19:18:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-54856","published":"2026-10-29T16:18:09Z","modified":"2026-10-30T19:18:26Z","title":"Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions","vendor":"ThemeREX","product":"RexCoin","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0049,"percentile":0.42157},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16,"vendorSlug":"themerex"}},{"id":"CVE-2026-18894","url":"https://patchfirst.co/cve/CVE-2026-18894/","title":"CVE-2026-18894: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…","content_text":"IBM · Langflow OSS Not in CISA KEV. EPSS 0.4% (percentile 37.0). CVSS 9.8 CRITICAL. Priority 14.9.","date_published":"2026-10-29T16:18:08.000Z","date_modified":"2026-10-30T13:23:56.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-18894","published":"2026-10-29T16:18:08Z","modified":"2026-10-30T13:23:56Z","title":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…","vendor":"IBM","product":"Langflow OSS","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00427,"percentile":0.36966},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.9,"vendorSlug":"ibm"}},{"id":"CVE-2026-119145","url":"https://patchfirst.co/cve/CVE-2026-119145/","title":"CVE-2026-119145: Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload…","content_text":"frappe · frappe Not in CISA KEV. EPSS 0.8% (percentile 55.3). CVSS 9.9 CRITICAL. Priority 18.7.","date_published":"2026-10-29T16:18:08.000Z","date_modified":"2026-10-29T17:18:08.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-119145","published":"2026-10-29T16:18:08Z","modified":"2026-10-29T17:18:08Z","title":"Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload…","vendor":"frappe","product":"frappe","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00761,"percentile":0.55292},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":18.7}},{"id":"CVE-2026-112256","url":"https://patchfirst.co/cve/CVE-2026-112256/","title":"CVE-2026-112256: Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server…","content_text":"OpenText · Advanced Authentication Server Not in CISA KEV. EPSS 0.2% (percentile 15.8). CVSS 9.2 CRITICAL. Priority 9.6.","date_published":"2026-10-29T16:17:58.000Z","date_modified":"2026-10-29T16:29:56.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-112256","published":"2026-10-29T16:17:58Z","modified":"2026-10-29T16:29:56Z","title":"Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server…","vendor":"OpenText","product":"Advanced Authentication Server","tier":"core","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00245,"percentile":0.15815},"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":9.6}},{"id":"CVE-2026-111732","url":"https://patchfirst.co/cve/CVE-2026-111732/","title":"CVE-2026-111732: P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the…","content_text":"RT-Labs · P-Net Not in CISA KEV. EPSS 0.4% (percentile 34.6). CVSS 9.3 CRITICAL. Priority 13.4.","date_published":"2026-10-29T16:17:57.000Z","date_modified":"2026-10-29T16:26:37.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-111732","published":"2026-10-29T16:17:57Z","modified":"2026-10-29T16:26:37Z","title":"P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the…","vendor":"RT-Labs","product":"P-Net","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00404,"percentile":0.34636},"kev":null,"exploited":false,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":13.4}},{"id":"CVE-2026-110186","url":"https://patchfirst.co/cve/CVE-2026-110186/","title":"CVE-2026-110186: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control…","content_text":"IBM · Langflow OSS Not in CISA KEV. EPSS 0.6% (percentile 49.8). CVSS 9.8 CRITICAL. Priority 17.5.","date_published":"2026-10-29T16:17:55.000Z","date_modified":"2026-10-30T18:17:19.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-110186","published":"2026-10-29T16:17:55Z","modified":"2026-10-30T18:17:19Z","title":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control…","vendor":"IBM","product":"Langflow OSS","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00622,"percentile":0.49784},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":17.5,"vendorSlug":"ibm"}},{"id":"CVE-2026-107032","url":"https://patchfirst.co/cve/CVE-2026-107032/","title":"CVE-2026-107032: Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an…","content_text":"Not in CISA KEV. EPSS 0.5% (percentile 42.7). CVSS 9.1 CRITICAL. Priority 15.6.","date_published":"2026-10-29T16:17:48.000Z","date_modified":"2026-10-29T21:17:10.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-107032","published":"2026-10-29T16:17:48Z","modified":"2026-10-29T21:17:10Z","title":"Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an…","vendor":null,"product":null,"tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00499,"percentile":0.4272},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":15.6}},{"id":"CVE-2026-104339","url":"https://patchfirst.co/cve/CVE-2026-104339/","title":"CVE-2026-104339: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…","content_text":"IBM · Langflow OSS Not in CISA KEV. EPSS 0.7% (percentile 54.8). CVSS 9.8 CRITICAL. Priority 18.5.","date_published":"2026-10-29T16:17:44.000Z","date_modified":"2026-10-30T13:29:15.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-104339","published":"2026-10-29T16:17:44Z","modified":"2026-10-30T13:29:15Z","title":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…","vendor":"IBM","product":"Langflow OSS","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00748,"percentile":0.54841},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":18.5,"vendorSlug":"ibm"}},{"id":"CVE-2026-104317","url":"https://patchfirst.co/cve/CVE-2026-104317/","title":"CVE-2026-104317: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute…","content_text":"IBM · Langflow OSS Not in CISA KEV. EPSS 0.6% (percentile 47.4). CVSS 9.8 CRITICAL. Priority 17.0.","date_published":"2026-10-29T16:17:43.000Z","date_modified":"2026-10-30T18:17:15.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-104317","published":"2026-10-29T16:17:43Z","modified":"2026-10-30T18:17:15Z","title":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute…","vendor":"IBM","product":"Langflow OSS","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00573,"percentile":0.47354},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":17,"vendorSlug":"ibm"}},{"id":"CVE-2026-107015","url":"https://patchfirst.co/cve/CVE-2026-107015/","title":"CVE-2026-107015: Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in…","content_text":"Not in CISA KEV. EPSS 0.5% (percentile 42.7). CVSS 9.1 CRITICAL. Priority 15.6.","date_published":"2026-10-29T15:17:15.000Z","date_modified":"2026-10-29T20:17:24.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-107015","published":"2026-10-29T15:17:15Z","modified":"2026-10-29T20:17:24Z","title":"Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in…","vendor":null,"product":null,"tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00499,"percentile":0.4272},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":15.6}},{"id":"CVE-2026-97854","url":"https://patchfirst.co/cve/CVE-2026-97854/","title":"CVE-2026-97854: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability","content_text":"Yamaha Corporation · NWR100 Not in CISA KEV. EPSS 1.4% (percentile 71.8). CVSS 9.8 CRITICAL. Priority 22.3.","date_published":"2026-10-29T12:17:14.000Z","date_modified":"2026-10-29T15:45:15.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-97854","published":"2026-10-29T12:17:14Z","modified":"2026-10-29T15:45:15Z","title":"Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability","vendor":"Yamaha Corporation","product":"NWR100","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.01369,"percentile":0.71847},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":22.3}},{"id":"CVE-2026-115964","url":"https://patchfirst.co/cve/CVE-2026-115964/","title":"CVE-2026-115964: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes…","content_text":"StylemixThemes · Motors Not in CISA KEV. EPSS 0.3% (percentile 25.4). CVSS 9.3 CRITICAL. Priority 12.7.","date_published":"2026-10-29T11:17:31.000Z","date_modified":"2026-10-29T14:56:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-115964","published":"2026-10-29T11:17:31Z","modified":"2026-10-29T14:56:26Z","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes…","vendor":"StylemixThemes","product":"Motors","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00323,"percentile":0.25374},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":12.7}},{"id":"CVE-2026-114358","url":"https://patchfirst.co/cve/CVE-2026-114358/","title":"CVE-2026-114358: This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in…","content_text":"Radius Synergies · Radius Xenia M2M Platform Not in CISA KEV. EPSS 0.5% (percentile 42.9). CVSS 9.3 CRITICAL. Priority 16.2.","date_published":"2026-10-29T09:17:07.000Z","date_modified":"2026-10-29T15:45:15.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-114358","published":"2026-10-29T09:17:07Z","modified":"2026-10-29T15:45:15Z","title":"This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in…","vendor":"Radius Synergies","product":"Radius Xenia M2M Platform","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00502,"percentile":0.42948},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16.2}},{"id":"CVE-2026-115245","url":"https://patchfirst.co/cve/CVE-2026-115245/","title":"CVE-2026-115245: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…","content_text":"Unknown · Chat AI with Dispatcher Not in CISA KEV. EPSS 0.5% (percentile 40.0). CVSS 9.8 CRITICAL. Priority 16.0.","date_published":"2026-10-29T06:17:19.000Z","date_modified":"2026-10-29T15:18:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-115245","published":"2026-10-29T06:17:19Z","modified":"2026-10-29T15:18:27Z","title":"The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…","vendor":"Unknown","product":"Chat AI with Dispatcher","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00462,"percentile":0.40039},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16}},{"id":"CVE-2026-113617","url":"https://patchfirst.co/cve/CVE-2026-113617/","title":"CVE-2026-113617: The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before…","content_text":"Unknown · Automated Import Products to Cart Not in CISA KEV. EPSS 0.3% (percentile 28.0). CVSS 9.9 CRITICAL. Priority 13.6.","date_published":"2026-10-29T06:17:18.000Z","date_modified":"2026-10-29T15:18:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-113617","published":"2026-10-29T06:17:18Z","modified":"2026-10-29T15:18:27Z","title":"The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before…","vendor":"Unknown","product":"Automated Import Products to Cart","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00344,"percentile":0.27979},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":13.6}},{"id":"CVE-2026-113616","url":"https://patchfirst.co/cve/CVE-2026-113616/","title":"CVE-2026-113616: The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved…","content_text":"Unknown · LogixFast Auth Not in CISA KEV. EPSS 0.3% (percentile 27.7). CVSS 9.8 CRITICAL. Priority 13.5.","date_published":"2026-10-29T06:17:18.000Z","date_modified":"2026-10-29T15:18:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-113616","published":"2026-10-29T06:17:18Z","modified":"2026-10-29T15:18:27Z","title":"The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved…","vendor":"Unknown","product":"LogixFast Auth","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00341,"percentile":0.27668},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":13.5}},{"id":"CVE-2026-42922","url":"https://patchfirst.co/cve/CVE-2026-42922/","title":"CVE-2026-42922: A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)","content_text":"frangoteam · Frangoteam Not in CISA KEV. EPSS 0.5% (percentile 45.1). CVSS 9.8 CRITICAL. Priority 17.0.","date_published":"2026-10-29T04:18:36.000Z","date_modified":"2026-10-29T16:21:34.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-42922","published":"2026-10-29T04:18:36Z","modified":"2026-10-29T16:21:34Z","title":"A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)","vendor":"frangoteam","product":"Frangoteam","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00534,"percentile":0.45072},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17}},{"id":"CVE-2026-109516","url":"https://patchfirst.co/cve/CVE-2026-109516/","title":"CVE-2026-109516: The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account…","content_text":"guruteam · Bot for Telegram on WooCommerce Not in CISA KEV. EPSS 0.6% (percentile 47.5). CVSS 9.8 CRITICAL. Priority 17.0.","date_published":"2026-10-29T04:18:22.000Z","date_modified":"2026-10-29T14:56:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-109516","published":"2026-10-29T04:18:22Z","modified":"2026-10-29T14:56:26Z","title":"The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account…","vendor":"guruteam","product":"Bot for Telegram on WooCommerce","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00575,"percentile":0.47455},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17}},{"id":"CVE-2026-66088","url":"https://patchfirst.co/cve/CVE-2026-66088/","title":"CVE-2026-66088: In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating…","content_text":"Apereo Foundation · openEQUELLA Not in CISA KEV. EPSS 0.7% (percentile 52.6). CVSS 9.4 CRITICAL. Priority 18.2.","date_published":"2026-10-29T02:16:52.000Z","date_modified":"2026-10-29T15:56:34.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-66088","published":"2026-10-29T02:16:52Z","modified":"2026-10-29T15:56:34Z","title":"In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating…","vendor":"Apereo Foundation","product":"openEQUELLA","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00685,"percentile":0.52579},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":18.2}},{"id":"CVE-2026-118579","url":"https://patchfirst.co/cve/CVE-2026-118579/","title":"CVE-2026-118579: A weakness has been identified in D-Link DIR-505 1.10B02","content_text":"D-Link · DIR-505 Not in CISA KEV. EPSS 0.8% (percentile 56.1). CVSS 9.8 CRITICAL. Priority 19.2.","date_published":"2026-10-28T23:17:09.000Z","date_modified":"2026-10-29T18:17:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118579","published":"2026-10-28T23:17:09Z","modified":"2026-10-29T18:17:27Z","title":"A weakness has been identified in D-Link DIR-505 1.10B02","vendor":"D-Link","product":"DIR-505","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00787,"percentile":0.56138},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":19.2,"vendorSlug":"d-link"}},{"id":"CVE-2026-61567","url":"https://patchfirst.co/cve/CVE-2026-61567/","title":"CVE-2026-61567: AVideo is a video-sharing Platform","content_text":"WWBN · AVideo-Encoder Not in CISA KEV. EPSS 0.5% (percentile 44.5). CVSS 10.0 CRITICAL. Priority 17.0.","date_published":"2026-10-28T22:17:15.000Z","date_modified":"2026-10-29T15:45:15.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61567","published":"2026-10-28T22:17:15Z","modified":"2026-10-29T15:45:15Z","title":"AVideo is a video-sharing Platform","vendor":"WWBN","product":"AVideo-Encoder","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00525,"percentile":0.44505},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17}},{"id":"CVE-2026-61564","url":"https://patchfirst.co/cve/CVE-2026-61564/","title":"CVE-2026-61564: AVideo is a video-sharing Platform","content_text":"WWBN · AVideo-Encoder Not in CISA KEV. EPSS 0.5% (percentile 45.3). CVSS 10.0 CRITICAL. Priority 17.2.","date_published":"2026-10-28T22:17:15.000Z","date_modified":"2026-10-29T15:45:15.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-61564","published":"2026-10-28T22:17:15Z","modified":"2026-10-29T15:45:15Z","title":"AVideo is a video-sharing Platform","vendor":"WWBN","product":"AVideo-Encoder","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00539,"percentile":0.45349},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":17.2}},{"id":"CVE-2026-118690","url":"https://patchfirst.co/cve/CVE-2026-118690/","title":"CVE-2026-118690: Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…","content_text":"SignalK · signalk-server Not in CISA KEV. EPSS 0.7% (percentile 52.7). CVSS 9.8 CRITICAL. Priority 18.5.","date_published":"2026-10-28T22:17:13.000Z","date_modified":"2026-10-29T18:17:28.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118690","published":"2026-10-28T22:17:13Z","modified":"2026-10-29T18:17:28Z","title":"Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…","vendor":"SignalK","product":"signalk-server","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00688,"percentile":0.52685},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":18.5}},{"id":"CVE-2026-76418","url":"https://patchfirst.co/cve/CVE-2026-76418/","title":"CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…","content_text":"Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software In CISA KEV since 2026-10-29. EPSS 0.9% (percentile 59.9). CVSS 8.6 HIGH. Priority 64.4.","date_published":"2026-10-28T20:18:47.000Z","date_modified":"2026-10-30T10:36:01.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"id":"CVE-2026-76418","published":"2026-10-28T20:18:47Z","modified":"2026-10-30T10:36:01Z","title":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…","vendor":"Cisco","product":"Secure Firewall ASA Software and Cisco Secure FTD Software","tier":"core","cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"epss":{"score":0.0091,"percentile":0.59949},"kev":{"dateAdded":"2026-10-29","ransomware":false},"vulncheckKev":{"dateAdded":"2026-10-28"},"exploited":true,"otxPulses":3,"reportCount":0,"techniqueIds":["T1190","T1499.004"],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":true,"priority":64.4,"vendorSlug":"cisco"}},{"id":"CVE-2026-63190","url":"https://patchfirst.co/cve/CVE-2026-63190/","title":"CVE-2026-63190: FearlessCMS is a flat-file `content` management system centered on simplicity and open source","content_text":"fearlessgeekmedia · FearlessCMS Not in CISA KEV. EPSS 0.5% (percentile 45.7). CVSS 9.4 CRITICAL. Priority 16.8.","date_published":"2026-10-28T20:18:37.000Z","date_modified":"2026-10-29T19:17:25.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-63190","published":"2026-10-28T20:18:37Z","modified":"2026-10-29T19:17:25Z","title":"FearlessCMS is a flat-file `content` management system centered on simplicity and open source","vendor":"fearlessgeekmedia","product":"FearlessCMS","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00544,"percentile":0.45682},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16.8}},{"id":"CVE-2026-118264","url":"https://patchfirst.co/cve/CVE-2026-118264/","title":"CVE-2026-118264: Echo is a Go web framework","content_text":"labstack · echo Not in CISA KEV. EPSS 0.4% (percentile 37.2). CVSS 9.1 CRITICAL. Priority 14.9.","date_published":"2026-10-28T19:17:31.000Z","date_modified":"2026-10-30T20:17:05.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118264","published":"2026-10-28T19:17:31Z","modified":"2026-10-30T20:17:05Z","title":"Echo is a Go web framework","vendor":"labstack","product":"echo","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.0043,"percentile":0.37209},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":["Go"],"euvdExploited":false,"priority":14.9}},{"id":"CVE-2026-103409","url":"https://patchfirst.co/cve/CVE-2026-103409/","title":"CVE-2026-103409: A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an…","content_text":"Juniper Networks · Session Smart Router Not in CISA KEV. EPSS 0.3% (percentile 28.3). CVSS 9.8 CRITICAL. Priority 13.2.","date_published":"2026-10-28T17:17:27.000Z","date_modified":"2026-10-28T17:17:28.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103409","published":"2026-10-28T17:17:27Z","modified":"2026-10-28T17:17:28Z","title":"A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an…","vendor":"Juniper Networks","product":"Session Smart Router","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00347,"percentile":0.28341},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.2,"vendorSlug":"juniper"}},{"id":"CVE-2026-103406","url":"https://patchfirst.co/cve/CVE-2026-103406/","title":"CVE-2026-103406: An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in…","content_text":"Juniper Networks · Session Smart Conductor Not in CISA KEV. EPSS 0.5% (percentile 43.9). CVSS 9.8 CRITICAL. Priority 16.3.","date_published":"2026-10-28T17:17:25.000Z","date_modified":"2026-10-28T17:17:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103406","published":"2026-10-28T17:17:25Z","modified":"2026-10-28T17:17:26Z","title":"An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in…","vendor":"Juniper Networks","product":"Session Smart Conductor","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00516,"percentile":0.43896},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16.3,"vendorSlug":"juniper"}},{"id":"CVE-2026-44179","url":"https://patchfirst.co/cve/CVE-2026-44179/","title":"CVE-2026-44179: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence","content_text":"xwikisas · xwiki-pro-macros Not in CISA KEV. EPSS 0.7% (percentile 52.8). CVSS 9.9 CRITICAL. Priority 18.6.","date_published":"2026-10-28T16:17:07.000Z","date_modified":"2026-10-29T16:21:34.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-44179","published":"2026-10-28T16:17:07Z","modified":"2026-10-29T16:21:34Z","title":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence","vendor":"xwikisas","product":"xwiki-pro-macros","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0069,"percentile":0.52787},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":["Maven"],"euvdExploited":false,"priority":18.6}},{"id":"CVE-2026-115968","url":"https://patchfirst.co/cve/CVE-2026-115968/","title":"CVE-2026-115968: Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object…","content_text":"Ultimate Member · Ultimate Member Not in CISA KEV. EPSS 0.4% (percentile 35.0). CVSS 9.8 CRITICAL. Priority 15.0.","date_published":"2026-10-28T14:16:58.000Z","date_modified":"2026-10-28T16:17:06.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-115968","published":"2026-10-28T14:16:58Z","modified":"2026-10-28T16:17:06Z","title":"Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object…","vendor":"Ultimate Member","product":"Ultimate Member","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00408,"percentile":0.3505},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15}},{"id":"CVE-2026-105420","url":"https://patchfirst.co/cve/CVE-2026-105420/","title":"CVE-2026-105420: Wing FTP Server does not verify user's base folder","content_text":"Wing Soft Technology · Wing FTP Server Not in CISA KEV. EPSS 0.5% (percentile 44.0). CVSS 9.4 CRITICAL. Priority 16.1.","date_published":"2026-10-28T14:16:56.000Z","date_modified":"2026-10-28T15:24:56.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-105420","published":"2026-10-28T14:16:56Z","modified":"2026-10-28T15:24:56Z","title":"Wing FTP Server does not verify user's base folder","vendor":"Wing Soft Technology","product":"Wing FTP Server","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00518,"percentile":0.4405},"kev":null,"exploited":false,"otxPulses":1,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16.1}},{"id":"CVE-2026-67074","url":"https://patchfirst.co/cve/CVE-2026-67074/","title":"CVE-2026-67074: HCL BigFix AEX is affected by a Remote Code Execution Vulnerability","content_text":"HCL Software · BigFix AEX Not in CISA KEV. EPSS 0.5% (percentile 39.7). CVSS 9.1 CRITICAL. Priority 15.7.","date_published":"2026-10-28T13:17:08.000Z","date_modified":"2026-10-28T14:05:59.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-67074","published":"2026-10-28T13:17:08Z","modified":"2026-10-28T14:05:59Z","title":"HCL BigFix AEX is affected by a Remote Code Execution Vulnerability","vendor":"HCL Software","product":"BigFix AEX","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00457,"percentile":0.39673},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.7}},{"id":"CVE-2026-115904","url":"https://patchfirst.co/cve/CVE-2026-115904/","title":"CVE-2026-115904: Topluyo is a social networking platform","content_text":"topluyo · App Not in CISA KEV. EPSS 0.7% (percentile 54.7). CVSS 9.6 CRITICAL. Priority 19.0.","date_published":"2026-10-28T13:17:05.000Z","date_modified":"2026-10-28T15:24:56.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-115904","published":"2026-10-28T13:17:05Z","modified":"2026-10-28T15:24:56Z","title":"Topluyo is a social networking platform","vendor":"topluyo","product":"App","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00743,"percentile":0.54675},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":19}},{"id":"CVE-2026-115607","url":"https://patchfirst.co/cve/CVE-2026-115607/","title":"CVE-2026-115607: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite…","content_text":"Crowd Favorite · DXP ToolKit Not in CISA KEV. EPSS 0.2% (percentile 14.7). CVSS 9.3 CRITICAL. Priority 10.8.","date_published":"2026-10-28T13:17:04.000Z","date_modified":"2026-10-29T14:17:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-115607","published":"2026-10-28T13:17:04Z","modified":"2026-10-29T14:17:49Z","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite…","vendor":"Crowd Favorite","product":"DXP ToolKit","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00236,"percentile":0.147},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":10.8}},{"id":"CVE-2026-111411","url":"https://patchfirst.co/cve/CVE-2026-111411/","title":"CVE-2026-111411: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit…","content_text":"Aman · FunnelKit Automations Not in CISA KEV. EPSS 0.3% (percentile 27.7). CVSS 9.3 CRITICAL. Priority 13.1.","date_published":"2026-10-28T13:17:04.000Z","date_modified":"2026-10-28T16:17:01.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-111411","published":"2026-10-28T13:17:04Z","modified":"2026-10-28T16:17:01Z","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit…","vendor":"Aman","product":"FunnelKit Automations","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00342,"percentile":0.27706},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.1}},{"id":"CVE-2026-118477","url":"https://patchfirst.co/cve/CVE-2026-118477/","title":"CVE-2026-118477: The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection","content_text":"EISGE · Kalifast Not in CISA KEV. EPSS 1.1% (percentile 65.9). CVSS 9.8 CRITICAL. Priority 21.4.","date_published":"2026-10-28T12:17:40.000Z","date_modified":"2026-10-28T15:24:56.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118477","published":"2026-10-28T12:17:40Z","modified":"2026-10-28T15:24:56Z","title":"The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection","vendor":"EISGE","product":"Kalifast","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.01111,"percentile":0.65913},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":21.4}},{"id":"CVE-2026-114278","url":"https://patchfirst.co/cve/CVE-2026-114278/","title":"CVE-2026-114278: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…","content_text":"Eclipse Foundation · Eclipse Che Not in CISA KEV. EPSS 0.9% (percentile 59.6). CVSS 9.8 CRITICAL. Priority 20.1.","date_published":"2026-10-28T12:17:39.000Z","date_modified":"2026-10-28T15:24:56.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-114278","published":"2026-10-28T12:17:39Z","modified":"2026-10-28T15:24:56Z","title":"The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…","vendor":"Eclipse Foundation","product":"Eclipse Che","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00899,"percentile":0.59593},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":20.1}},{"id":"CVE-2026-112197","url":"https://patchfirst.co/cve/CVE-2026-112197/","title":"CVE-2026-112197: Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service","content_text":"Tactis · NoviGest Desktop App Not in CISA KEV. EPSS 0.4% (percentile 31.9). CVSS 9.4 CRITICAL. Priority 14.0.","date_published":"2026-10-28T11:17:15.000Z","date_modified":"2026-10-28T14:43:13.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-112197","published":"2026-10-28T11:17:15Z","modified":"2026-10-28T14:43:13Z","title":"Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service","vendor":"Tactis","product":"NoviGest Desktop App","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00379,"percentile":0.31901},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14}},{"id":"CVE-2026-103799","url":"https://patchfirst.co/cve/CVE-2026-103799/","title":"CVE-2026-103799: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…","content_text":"Dell · PowerProtect Data Domain Management Center Not in CISA KEV. EPSS 0.3% (percentile 27.6). CVSS 9.6 CRITICAL. Priority 13.3.","date_published":"2026-10-28T11:17:14.000Z","date_modified":"2026-10-28T14:13:52.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103799","published":"2026-10-28T11:17:14Z","modified":"2026-10-28T14:13:52Z","title":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…","vendor":"Dell","product":"PowerProtect Data Domain Management Center","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0034,"percentile":0.27563},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.3,"vendorSlug":"dell"}},{"id":"CVE-2026-103792","url":"https://patchfirst.co/cve/CVE-2026-103792/","title":"CVE-2026-103792: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…","content_text":"Dell · PowerProtect Data Domain Management Center Not in CISA KEV. EPSS 0.4% (percentile 30.8). CVSS 9.6 CRITICAL. Priority 14.0.","date_published":"2026-10-28T11:17:14.000Z","date_modified":"2026-10-29T11:17:23.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103792","published":"2026-10-28T11:17:14Z","modified":"2026-10-29T11:17:23Z","title":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…","vendor":"Dell","product":"PowerProtect Data Domain Management Center","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00369,"percentile":0.30759},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":14,"vendorSlug":"dell"}},{"id":"CVE-2026-103780","url":"https://patchfirst.co/cve/CVE-2026-103780/","title":"CVE-2026-103780: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…","content_text":"Dell · PowerProtect Data Domain Not in CISA KEV. EPSS 0.8% (percentile 57.5). CVSS 9.8 CRITICAL. Priority 19.4.","date_published":"2026-10-28T11:17:14.000Z","date_modified":"2026-10-29T11:17:23.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103780","published":"2026-10-28T11:17:14Z","modified":"2026-10-29T11:17:23Z","title":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…","vendor":"Dell","product":"PowerProtect Data Domain","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0083,"percentile":0.57522},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":19.4,"vendorSlug":"dell"}},{"id":"CVE-2026-86384","url":"https://patchfirst.co/cve/CVE-2026-86384/","title":"CVE-2026-86384: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…","content_text":"Dell · PowerProtect Data Domain Not in CISA KEV. EPSS 0.5% (percentile 40.9). CVSS 9.8 CRITICAL. Priority 16.4.","date_published":"2026-10-28T10:17:09.000Z","date_modified":"2026-10-29T11:17:35.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-86384","published":"2026-10-28T10:17:09Z","modified":"2026-10-29T11:17:35Z","title":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…","vendor":"Dell","product":"PowerProtect Data Domain","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00472,"percentile":0.40858},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16.4,"vendorSlug":"dell"}},{"id":"CVE-2026-86400","url":"https://patchfirst.co/cve/CVE-2026-86400/","title":"CVE-2026-86400: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…","content_text":"Dell · PowerProtect Data Domain Not in CISA KEV. EPSS 0.9% (percentile 59.5). CVSS 9.8 CRITICAL. Priority 20.1.","date_published":"2026-10-28T09:17:08.000Z","date_modified":"2026-10-30T18:18:15.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-86400","published":"2026-10-28T09:17:08Z","modified":"2026-10-30T18:18:15Z","title":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…","vendor":"Dell","product":"PowerProtect Data Domain","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00896,"percentile":0.59525},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":20.1,"vendorSlug":"dell"}},{"id":"CVE-2026-86397","url":"https://patchfirst.co/cve/CVE-2026-86397/","title":"CVE-2026-86397: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…","content_text":"Dell · PowerProtect Data Domain Not in CISA KEV. EPSS 0.3% (percentile 27.1). CVSS 9.8 CRITICAL. Priority 13.6.","date_published":"2026-10-28T09:17:07.000Z","date_modified":"2026-10-30T18:18:14.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-86397","published":"2026-10-28T09:17:07Z","modified":"2026-10-30T18:18:14Z","title":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…","vendor":"Dell","product":"PowerProtect Data Domain","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00336,"percentile":0.27057},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.6,"vendorSlug":"dell"}},{"id":"CVE-2026-109218","url":"https://patchfirst.co/cve/CVE-2026-109218/","title":"CVE-2026-109218: The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including…","content_text":"kleor · Contact Manager Not in CISA KEV. EPSS 0.6% (percentile 50.8). CVSS 9.8 CRITICAL. Priority 18.1.","date_published":"2026-10-28T07:16:44.000Z","date_modified":"2026-10-29T02:16:46.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-109218","published":"2026-10-28T07:16:44Z","modified":"2026-10-29T02:16:46Z","title":"The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including…","vendor":"kleor","product":"Contact Manager","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00643,"percentile":0.5081},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":18.1}},{"id":"CVE-2026-103688","url":"https://patchfirst.co/cve/CVE-2026-103688/","title":"CVE-2026-103688: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its…","content_text":"Unknown · Checkout Files Upload for WooCommerce Not in CISA KEV. EPSS 0.6% (percentile 49.2). CVSS 9.8 CRITICAL. Priority 67.8.","date_published":"2026-10-28T06:16:32.000Z","date_modified":"2026-10-28T18:17:02.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103688","published":"2026-10-28T06:16:32Z","modified":"2026-10-28T18:17:02Z","title":"The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its…","vendor":"Unknown","product":"Checkout Files Upload for WooCommerce","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00611,"percentile":0.49216},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-28"},"exploited":true,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":67.8}},{"id":"CVE-2026-104383","url":"https://patchfirst.co/cve/CVE-2026-104383/","title":"CVE-2026-104383: Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on…","content_text":"EagleCloud · Aquila Not in CISA KEV. EPSS 0.4% (percentile 30.5). CVSS 9.4 CRITICAL. Priority 13.8.","date_published":"2026-10-28T05:16:59.000Z","date_modified":"2026-10-28T14:50:12.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-104383","published":"2026-10-28T05:16:59Z","modified":"2026-10-28T14:50:12Z","title":"Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on…","vendor":"EagleCloud","product":"Aquila","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00367,"percentile":0.30539},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.8}},{"id":"CVE-2026-84999","url":"https://patchfirst.co/cve/CVE-2026-84999/","title":"CVE-2026-84999: The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to…","content_text":"Pie Register · Pie Register Premium Not in CISA KEV. EPSS 0.5% (percentile 41.6). CVSS 9.8 CRITICAL. Priority 61.6.","date_published":"2026-10-28T03:17:16.000Z","date_modified":"2026-10-29T02:16:53.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-84999","published":"2026-10-28T03:17:16Z","modified":"2026-10-29T02:16:53Z","title":"The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to…","vendor":"Pie Register","product":"Pie Register Premium","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00483,"percentile":0.41636},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-27"},"exploited":true,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":61.6}},{"id":"CVE-2026-106013","url":"https://patchfirst.co/cve/CVE-2026-106013/","title":"CVE-2026-106013: The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler…","content_text":"artbees · Jupiter X Core Not in CISA KEV. EPSS 0.6% (percentile 46.2). CVSS 9.8 CRITICAL. Priority 17.2.","date_published":"2026-10-28T02:17:01.000Z","date_modified":"2026-10-29T02:16:46.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-106013","published":"2026-10-28T02:17:01Z","modified":"2026-10-29T02:16:46Z","title":"The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler…","vendor":"artbees","product":"Jupiter X Core","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00553,"percentile":0.46174},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":17.2}},{"id":"CVE-2026-110879","url":"https://patchfirst.co/cve/CVE-2026-110879/","title":"CVE-2026-110879: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its…","content_text":"FasterXML · jackson-databind Not in CISA KEV. EPSS 1.2% (percentile 68.1). CVSS 9.8 CRITICAL. Priority 21.6.","date_published":"2026-10-28T01:16:55.000Z","date_modified":"2026-10-28T15:21:31.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-110879","published":"2026-10-28T01:16:55Z","modified":"2026-10-28T15:21:31Z","title":"jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its…","vendor":"FasterXML","product":"jackson-databind","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.01196,"percentile":0.68059},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":21.6}},{"id":"CVE-2026-58256","url":"https://patchfirst.co/cve/CVE-2026-58256/","title":"CVE-2026-58256: GRR is a resource management and reservation application","content_text":"JeromeDevome · GRR Not in CISA KEV. EPSS 0.6% (percentile 47.4). CVSS 9.1 CRITICAL. Priority 17.2.","date_published":"2026-10-27T23:17:06.000Z","date_modified":"2026-10-28T14:21:52.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-58256","published":"2026-10-27T23:17:06Z","modified":"2026-10-28T14:21:52Z","title":"GRR is a resource management and reservation application","vendor":"JeromeDevome","product":"GRR","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00575,"percentile":0.47423},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17.2}},{"id":"CVE-2026-118355","url":"https://patchfirst.co/cve/CVE-2026-118355/","title":"CVE-2026-118355: Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.3% (percentile 22.2). CVSS 9.6 CRITICAL. Priority 12.5.","date_published":"2026-10-27T23:17:04.000Z","date_modified":"2026-10-29T17:39:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118355","published":"2026-10-27T23:17:04Z","modified":"2026-10-29T17:39:49Z","title":"Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00295,"percentile":0.22174},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.5,"vendorSlug":"google"}},{"id":"CVE-2026-118342","url":"https://patchfirst.co/cve/CVE-2026-118342/","title":"CVE-2026-118342: Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.3% (percentile 22.2). CVSS 9.6 CRITICAL. Priority 12.5.","date_published":"2026-10-27T23:17:03.000Z","date_modified":"2026-10-29T17:40:11.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118342","published":"2026-10-27T23:17:03Z","modified":"2026-10-29T17:40:11Z","title":"Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00295,"percentile":0.22173},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.5,"vendorSlug":"google"}},{"id":"CVE-2026-118340","url":"https://patchfirst.co/cve/CVE-2026-118340/","title":"CVE-2026-118340: Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.4% (percentile 29.1). CVSS 9.6 CRITICAL. Priority 13.9.","date_published":"2026-10-27T23:17:02.000Z","date_modified":"2026-10-29T17:40:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118340","published":"2026-10-27T23:17:02Z","modified":"2026-10-29T17:40:26Z","title":"Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00354,"percentile":0.29122},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.9,"vendorSlug":"google"}},{"id":"CVE-2026-118337","url":"https://patchfirst.co/cve/CVE-2026-118337/","title":"CVE-2026-118337: Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.2% (percentile 9.2). CVSS 9.3 CRITICAL. Priority 9.7.","date_published":"2026-10-27T23:17:02.000Z","date_modified":"2026-10-30T14:16:41.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118337","published":"2026-10-27T23:17:02Z","modified":"2026-10-30T14:16:41Z","title":"Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00195,"percentile":0.09233},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":9.7,"vendorSlug":"google"}},{"id":"CVE-2026-118333","url":"https://patchfirst.co/cve/CVE-2026-118333/","title":"CVE-2026-118333: Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.2% (percentile 9.2). CVSS 9.3 CRITICAL. Priority 9.7.","date_published":"2026-10-27T23:17:01.000Z","date_modified":"2026-10-30T14:16:41.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118333","published":"2026-10-27T23:17:01Z","modified":"2026-10-30T14:16:41Z","title":"Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00195,"percentile":0.09232},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":9.7,"vendorSlug":"google"}},{"id":"CVE-2026-118332","url":"https://patchfirst.co/cve/CVE-2026-118332/","title":"CVE-2026-118332: Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.3% (percentile 22.2). CVSS 9.6 CRITICAL. Priority 12.5.","date_published":"2026-10-27T23:17:01.000Z","date_modified":"2026-10-29T17:40:41.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118332","published":"2026-10-27T23:17:01Z","modified":"2026-10-29T17:40:41Z","title":"Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00295,"percentile":0.22173},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.5,"vendorSlug":"google"}},{"id":"CVE-2026-118321","url":"https://patchfirst.co/cve/CVE-2026-118321/","title":"CVE-2026-118321: Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.4% (percentile 29.1). CVSS 9.6 CRITICAL. Priority 13.9.","date_published":"2026-10-27T23:17:00.000Z","date_modified":"2026-10-29T17:41:27.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118321","published":"2026-10-27T23:17:00Z","modified":"2026-10-29T17:41:27Z","title":"Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00354,"percentile":0.29122},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.9,"vendorSlug":"google"}},{"id":"CVE-2026-118316","url":"https://patchfirst.co/cve/CVE-2026-118316/","title":"CVE-2026-118316: Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.3% (percentile 22.2). CVSS 9.6 CRITICAL. Priority 12.5.","date_published":"2026-10-27T23:17:00.000Z","date_modified":"2026-10-29T17:42:10.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118316","published":"2026-10-27T23:17:00Z","modified":"2026-10-29T17:42:10Z","title":"Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00295,"percentile":0.22174},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.5,"vendorSlug":"google"}},{"id":"CVE-2026-118312","url":"https://patchfirst.co/cve/CVE-2026-118312/","title":"CVE-2026-118312: Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.3% (percentile 23.6). CVSS 9.6 CRITICAL. Priority 12.8.","date_published":"2026-10-27T23:16:59.000Z","date_modified":"2026-10-29T15:59:06.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118312","published":"2026-10-27T23:16:59Z","modified":"2026-10-29T15:59:06Z","title":"Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00307,"percentile":0.23557},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.8,"vendorSlug":"google"}},{"id":"CVE-2026-118310","url":"https://patchfirst.co/cve/CVE-2026-118310/","title":"CVE-2026-118310: Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.3% (percentile 23.6). CVSS 9.6 CRITICAL. Priority 12.8.","date_published":"2026-10-27T23:16:59.000Z","date_modified":"2026-10-29T15:59:38.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118310","published":"2026-10-27T23:16:59Z","modified":"2026-10-29T15:59:38Z","title":"Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00307,"percentile":0.23557},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.8,"vendorSlug":"google"}},{"id":"CVE-2026-118309","url":"https://patchfirst.co/cve/CVE-2026-118309/","title":"CVE-2026-118309: Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.3% (percentile 23.6). CVSS 9.6 CRITICAL. Priority 12.8.","date_published":"2026-10-27T23:16:59.000Z","date_modified":"2026-10-29T16:00:02.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118309","published":"2026-10-27T23:16:59Z","modified":"2026-10-29T16:00:02Z","title":"Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00307,"percentile":0.23557},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.8,"vendorSlug":"google"}},{"id":"CVE-2026-118308","url":"https://patchfirst.co/cve/CVE-2026-118308/","title":"CVE-2026-118308: Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.3% (percentile 23.6). CVSS 9.6 CRITICAL. Priority 12.8.","date_published":"2026-10-27T23:16:59.000Z","date_modified":"2026-10-29T16:00:10.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118308","published":"2026-10-27T23:16:59Z","modified":"2026-10-29T16:00:10Z","title":"Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00307,"percentile":0.23556},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.8,"vendorSlug":"google"}},{"id":"CVE-2026-118306","url":"https://patchfirst.co/cve/CVE-2026-118306/","title":"CVE-2026-118306: Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.4% (percentile 30.7). CVSS 9.6 CRITICAL. Priority 14.2.","date_published":"2026-10-27T23:16:59.000Z","date_modified":"2026-10-29T16:00:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118306","published":"2026-10-27T23:16:59Z","modified":"2026-10-29T16:00:30Z","title":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00369,"percentile":0.30743},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":14.2,"vendorSlug":"google"}},{"id":"CVE-2026-118305","url":"https://patchfirst.co/cve/CVE-2026-118305/","title":"CVE-2026-118305: Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…","content_text":"Google · Chrome Not in CISA KEV. EPSS 0.4% (percentile 30.7). CVSS 9.6 CRITICAL. Priority 14.2.","date_published":"2026-10-27T23:16:58.000Z","date_modified":"2026-10-29T16:00:41.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-118305","published":"2026-10-27T23:16:58Z","modified":"2026-10-29T16:00:41Z","title":"Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…","vendor":"Google","product":"Chrome","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00369,"percentile":0.30742},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":14.2,"vendorSlug":"google"}},{"id":"CVE-2026-116692","url":"https://patchfirst.co/cve/CVE-2026-116692/","title":"CVE-2026-116692: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models","content_text":"mlflow · mlflow Not in CISA KEV. EPSS 0.7% (percentile 53.3). CVSS 9.8 CRITICAL. Priority 23.9.","date_published":"2026-10-27T21:18:05.000Z","date_modified":"2026-10-28T15:21:31.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116692","published":"2026-10-27T21:18:05Z","modified":"2026-10-28T15:21:31Z","title":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models","vendor":"mlflow","product":"mlflow","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00704,"percentile":0.53293},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":false,"ecosystems":["PyPI"],"euvdExploited":false,"priority":23.9,"vendorSlug":"mlflow"}},{"id":"CVE-2026-116690","url":"https://patchfirst.co/cve/CVE-2026-116690/","title":"CVE-2026-116690: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models","content_text":"mlflow · mlflow Not in CISA KEV. EPSS 0.6% (percentile 46.6). CVSS 7.5 HIGH. Priority 60.9.","date_published":"2026-10-27T20:17:14.000Z","date_modified":"2026-10-28T17:18:04.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116690","published":"2026-10-27T20:17:14Z","modified":"2026-10-28T17:18:04Z","title":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models","vendor":"mlflow","product":"mlflow","tier":"core","cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"epss":{"score":0.00559,"percentile":0.46555},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-28"},"exploited":true,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":["PyPI"],"euvdExploited":false,"priority":60.9,"vendorSlug":"mlflow"}},{"id":"CVE-2026-112352","url":"https://patchfirst.co/cve/CVE-2026-112352/","title":"CVE-2026-112352: Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote…","content_text":"Sunhillo Corporation · SureLine Not in CISA KEV. EPSS 1.3% (percentile 70.8). CVSS 9.1 CRITICAL. Priority 21.6.","date_published":"2026-10-27T20:17:12.000Z","date_modified":"2026-10-28T17:17:40.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-112352","published":"2026-10-27T20:17:12Z","modified":"2026-10-28T17:17:40Z","title":"Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote…","vendor":"Sunhillo Corporation","product":"SureLine","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.01319,"percentile":0.70799},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":21.6,"vendorSlug":"sunhillo"}},{"id":"CVE-2026-48360","url":"https://patchfirst.co/cve/CVE-2026-48360/","title":"CVE-2026-48360: Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could…","content_text":"Adobe · Adobe Connect Desktop App Not in CISA KEV. EPSS 0.4% (percentile 39.1). CVSS 9.6 CRITICAL. Priority 16.1.","date_published":"2026-10-27T17:17:00.000Z","date_modified":"2026-10-29T04:18:38.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-48360","published":"2026-10-27T17:17:00Z","modified":"2026-10-29T04:18:38Z","title":"Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could…","vendor":"Adobe","product":"Adobe Connect Desktop App","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0045,"percentile":0.39121},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16.1,"vendorSlug":"adobe"}},{"id":"CVE-2026-114595","url":"https://patchfirst.co/cve/CVE-2026-114595/","title":"CVE-2026-114595: In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be…","content_text":"The EPICS Community · EPICS Base Not in CISA KEV. EPSS 0.5% (percentile 42.9). CVSS 9.8 CRITICAL. Priority 21.8.","date_published":"2026-10-27T17:16:58.000Z","date_modified":"2026-10-28T14:46:23.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-114595","published":"2026-10-27T17:16:58Z","modified":"2026-10-28T14:46:23Z","title":"In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be…","vendor":"The EPICS Community","product":"EPICS Base","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00502,"percentile":0.42938},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":21.8}},{"id":"CVE-2026-112353","url":"https://patchfirst.co/cve/CVE-2026-112353/","title":"CVE-2026-112353: GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the…","content_text":"GFI USA, LLC · GFI KerioConnect Not in CISA KEV. EPSS 0.2% (percentile 15.5). CVSS 8.2 HIGH. Priority 54.9.","date_published":"2026-10-27T17:16:58.000Z","date_modified":"2026-10-28T17:17:41.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-112353","published":"2026-10-27T17:16:58Z","modified":"2026-10-28T17:17:41Z","title":"GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the…","vendor":"GFI USA, LLC","product":"GFI KerioConnect","tier":"core","cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"epss":{"score":0.00243,"percentile":0.1553},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-27"},"exploited":true,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":54.9}},{"id":"CVE-2026-108142","url":"https://patchfirst.co/cve/CVE-2026-108142/","title":"CVE-2026-108142: A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service","content_text":"Veeam · Backup and Replication Not in CISA KEV. EPSS 0.4% (percentile 34.3). CVSS 9.1 CRITICAL. Priority 14.3.","date_published":"2026-10-27T17:16:57.000Z","date_modified":"2026-10-28T14:47:07.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-108142","published":"2026-10-27T17:16:57Z","modified":"2026-10-28T14:47:07Z","title":"A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service","vendor":"Veeam","product":"Backup and Replication","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00401,"percentile":0.34304},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":14.3,"vendorSlug":"veeam"}},{"id":"CVE-2026-105781","url":"https://patchfirst.co/cve/CVE-2026-105781/","title":"CVE-2026-105781: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","content_text":"Adobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.5% (percentile 44.0). CVSS 10.0 CRITICAL. Priority 16.9.","date_published":"2026-10-27T17:16:56.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-105781","published":"2026-10-27T17:16:56Z","modified":"2026-10-28T14:10:17Z","title":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","vendor":"Adobe","product":"Adobe Campaign Classic","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00518,"percentile":0.44037},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16.9,"vendorSlug":"adobe"}},{"id":"CVE-2026-105780","url":"https://patchfirst.co/cve/CVE-2026-105780/","title":"CVE-2026-105780: Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…","content_text":"Adobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.5% (percentile 42.1). CVSS 9.9 CRITICAL. Priority 16.4.","date_published":"2026-10-27T17:16:56.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-105780","published":"2026-10-27T17:16:56Z","modified":"2026-10-28T14:10:17Z","title":"Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…","vendor":"Adobe","product":"Adobe Campaign Classic","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0049,"percentile":0.42106},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16.4,"vendorSlug":"adobe"}},{"id":"CVE-2026-105779","url":"https://patchfirst.co/cve/CVE-2026-105779/","title":"CVE-2026-105779: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","content_text":"Adobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.3% (percentile 22.2). CVSS 9.1 CRITICAL. Priority 11.9.","date_published":"2026-10-27T17:16:56.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-105779","published":"2026-10-27T17:16:56Z","modified":"2026-10-28T14:10:17Z","title":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","vendor":"Adobe","product":"Adobe Campaign Classic","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00295,"percentile":0.22168},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":11.9,"vendorSlug":"adobe"}},{"id":"CVE-2026-105489","url":"https://patchfirst.co/cve/CVE-2026-105489/","title":"CVE-2026-105489: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","content_text":"Adobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.5% (percentile 41.1). CVSS 9.9 CRITICAL. Priority 16.2.","date_published":"2026-10-27T17:16:56.000Z","date_modified":"2026-10-28T14:16:56.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-105489","published":"2026-10-27T17:16:56Z","modified":"2026-10-28T14:16:56Z","title":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","vendor":"Adobe","product":"Adobe Campaign Classic","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00476,"percentile":0.41088},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16.2,"vendorSlug":"adobe"}},{"id":"CVE-2026-104354","url":"https://patchfirst.co/cve/CVE-2026-104354/","title":"CVE-2026-104354: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","content_text":"Adobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.5% (percentile 42.5). CVSS 9.1 CRITICAL. Priority 16.0.","date_published":"2026-10-27T17:16:55.000Z","date_modified":"2026-10-28T17:17:30.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-104354","published":"2026-10-27T17:16:55Z","modified":"2026-10-28T17:17:30Z","title":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","vendor":"Adobe","product":"Adobe Campaign Classic","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00496,"percentile":0.42525},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16,"vendorSlug":"adobe"}},{"id":"CVE-2026-104353","url":"https://patchfirst.co/cve/CVE-2026-104353/","title":"CVE-2026-104353: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…","content_text":"Adobe · Adobe Campaign Classic Not in CISA KEV. EPSS 1.3% (percentile 70.4). CVSS 9.9 CRITICAL. Priority 22.1.","date_published":"2026-10-27T17:16:55.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-104353","published":"2026-10-27T17:16:55Z","modified":"2026-10-28T14:10:17Z","title":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…","vendor":"Adobe","product":"Adobe Campaign Classic","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.013,"percentile":0.70416},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":22.1,"vendorSlug":"adobe"}},{"id":"CVE-2026-104351","url":"https://patchfirst.co/cve/CVE-2026-104351/","title":"CVE-2026-104351: Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability…","content_text":"Adobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.6% (percentile 47.3). CVSS 9.9 CRITICAL. Priority 17.5.","date_published":"2026-10-27T17:16:55.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-104351","published":"2026-10-27T17:16:55Z","modified":"2026-10-28T14:10:17Z","title":"Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability…","vendor":"Adobe","product":"Adobe Campaign Classic","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00573,"percentile":0.47334},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17.5,"vendorSlug":"adobe"}},{"id":"CVE-2026-104350","url":"https://patchfirst.co/cve/CVE-2026-104350/","title":"CVE-2026-104350: Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability","content_text":"Adobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.6% (percentile 48.9). CVSS 9.3 CRITICAL. Priority 17.4.","date_published":"2026-10-27T17:16:55.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-104350","published":"2026-10-27T17:16:55Z","modified":"2026-10-28T14:10:17Z","title":"Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability","vendor":"Adobe","product":"Adobe Campaign Classic","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00605,"percentile":0.48933},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17.4,"vendorSlug":"adobe"}},{"id":"CVE-2026-93866","url":"https://patchfirst.co/cve/CVE-2026-93866/","title":"CVE-2026-93866: An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal…","content_text":"WatchGuard · Fireware OS Not in CISA KEV. EPSS 0.4% (percentile 39.0). CVSS 9.2 CRITICAL. Priority 15.6.","date_published":"2026-10-27T16:17:33.000Z","date_modified":"2026-10-28T14:39:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-93866","published":"2026-10-27T16:17:33Z","modified":"2026-10-28T14:39:26Z","title":"An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal…","vendor":"WatchGuard","product":"Fireware OS","tier":"core","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00448,"percentile":0.38995},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.6,"vendorSlug":"watchguard"}},{"id":"CVE-2026-93865","url":"https://patchfirst.co/cve/CVE-2026-93865/","title":"CVE-2026-93865: A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote…","content_text":"WatchGuard · Fireware OS Not in CISA KEV. EPSS 0.5% (percentile 40.1). CVSS 9.2 CRITICAL. Priority 15.8.","date_published":"2026-10-27T16:17:32.000Z","date_modified":"2026-10-29T11:17:38.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-93865","published":"2026-10-27T16:17:32Z","modified":"2026-10-29T11:17:38Z","title":"A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote…","vendor":"WatchGuard","product":"Fireware OS","tier":"core","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00463,"percentile":0.40142},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.8,"vendorSlug":"watchguard"}},{"id":"CVE-2026-93857","url":"https://patchfirst.co/cve/CVE-2026-93857/","title":"CVE-2026-93857: A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to…","content_text":"WatchGuard · Fireware OS Not in CISA KEV. EPSS 0.5% (percentile 40.8). CVSS 9.2 CRITICAL. Priority 16.0.","date_published":"2026-10-27T16:17:32.000Z","date_modified":"2026-10-29T11:17:38.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-93857","published":"2026-10-27T16:17:32Z","modified":"2026-10-29T11:17:38Z","title":"A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to…","vendor":"WatchGuard","product":"Fireware OS","tier":"core","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00471,"percentile":0.40776},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":16,"vendorSlug":"watchguard"}},{"id":"CVE-2026-90465","url":"https://patchfirst.co/cve/CVE-2026-90465/","title":"CVE-2026-90465: A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster…","content_text":"WatchGuard · Fireware OS Not in CISA KEV. EPSS 0.2% (percentile 14.8). CVSS 9.4 CRITICAL. Priority 10.9.","date_published":"2026-10-27T16:17:31.000Z","date_modified":"2026-10-29T11:17:37.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-90465","published":"2026-10-27T16:17:31Z","modified":"2026-10-29T11:17:37Z","title":"A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster…","vendor":"WatchGuard","product":"Fireware OS","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00237,"percentile":0.14753},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":10.9,"vendorSlug":"watchguard"}},{"id":"CVE-2026-116863","url":"https://patchfirst.co/cve/CVE-2026-116863/","title":"CVE-2026-116863: Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site…","content_text":"Tribulant Software · Newsletters Not in CISA KEV. EPSS 0.2% (percentile 7.3). CVSS 9.6 CRITICAL. Priority 9.5.","date_published":"2026-10-27T16:17:30.000Z","date_modified":"2026-10-29T14:17:50.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116863","published":"2026-10-27T16:17:30Z","modified":"2026-10-29T14:17:50Z","title":"Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site…","vendor":"Tribulant Software","product":"Newsletters","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00177,"percentile":0.07252},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":9.5}},{"id":"CVE-2026-112710","url":"https://patchfirst.co/cve/CVE-2026-112710/","title":"CVE-2026-112710: A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who…","content_text":"WatchGuard · Fireware OS Not in CISA KEV. EPSS 0.4% (percentile 36.2). CVSS 9.2 CRITICAL. Priority 14.8.","date_published":"2026-10-27T16:17:30.000Z","date_modified":"2026-10-28T14:39:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-112710","published":"2026-10-27T16:17:30Z","modified":"2026-10-28T14:39:26Z","title":"A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who…","vendor":"WatchGuard","product":"Fireware OS","tier":"core","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00419,"percentile":0.36246},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":14.8,"vendorSlug":"watchguard"}},{"id":"CVE-2026-112709","url":"https://patchfirst.co/cve/CVE-2026-112709/","title":"CVE-2026-112709: A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls…","content_text":"WatchGuard · Fireware OS Not in CISA KEV. EPSS 0.4% (percentile 36.2). CVSS 9.2 CRITICAL. Priority 14.8.","date_published":"2026-10-27T16:17:29.000Z","date_modified":"2026-10-28T14:39:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-112709","published":"2026-10-27T16:17:29Z","modified":"2026-10-28T14:39:26Z","title":"A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls…","vendor":"WatchGuard","product":"Fireware OS","tier":"core","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00419,"percentile":0.36246},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":14.8,"vendorSlug":"watchguard"}},{"id":"CVE-2026-103594","url":"https://patchfirst.co/cve/CVE-2026-103594/","title":"CVE-2026-103594: A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote…","content_text":"WatchGuard · Fireware OS Not in CISA KEV. EPSS 0.4% (percentile 37.5). CVSS 9.5 CRITICAL. Priority 15.2.","date_published":"2026-10-27T16:17:28.000Z","date_modified":"2026-10-28T14:39:26.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-103594","published":"2026-10-27T16:17:28Z","modified":"2026-10-28T14:39:26Z","title":"A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote…","vendor":"WatchGuard","product":"Fireware OS","tier":"core","cvss":{"score":9.5,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00432,"percentile":0.37527},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.2,"vendorSlug":"watchguard"}},{"id":"CVE-2026-78845","url":"https://patchfirst.co/cve/CVE-2026-78845/","title":"CVE-2026-78845: Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light…","content_text":"Not in CISA KEV. EPSS 0.3% (percentile 25.8). CVSS 9.8 CRITICAL. Priority 13.4.","date_published":"2026-10-27T15:17:00.000Z","date_modified":"2026-10-31T03:17:31.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-78845","published":"2026-10-27T15:17:00Z","modified":"2026-10-31T03:17:31Z","title":"Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light…","vendor":null,"product":null,"tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00327,"percentile":0.25763},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":13.4}},{"id":"CVE-2026-117601","url":"https://patchfirst.co/cve/CVE-2026-117601/","title":"CVE-2026-117601: Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing…","content_text":"spesmilo · electrum Not in CISA KEV. EPSS 0.2% (percentile 7.2). CVSS 7.5 HIGH. Priority 53.0.","date_published":"2026-10-27T14:16:39.000Z","date_modified":"2026-10-28T17:18:17.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-117601","published":"2026-10-27T14:16:39Z","modified":"2026-10-28T17:18:17Z","title":"Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing…","vendor":"spesmilo","product":"electrum","tier":"core","cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"epss":{"score":0.00176,"percentile":0.07169},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-27"},"exploited":true,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":["PyPI"],"euvdExploited":false,"priority":53}},{"id":"CVE-2026-117564","url":"https://patchfirst.co/cve/CVE-2026-117564/","title":"CVE-2026-117564: nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…","content_text":"buqiyuan · nest-admin Not in CISA KEV. EPSS 0.6% (percentile 48.6). CVSS 9.8 CRITICAL. Priority 18.0.","date_published":"2026-10-27T14:16:38.000Z","date_modified":"2026-10-28T17:18:15.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-117564","published":"2026-10-27T14:16:38Z","modified":"2026-10-28T17:18:15Z","title":"nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…","vendor":"buqiyuan","product":"nest-admin","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00599,"percentile":0.4865},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":18}},{"id":"CVE-2026-65145","url":"https://patchfirst.co/cve/CVE-2026-65145/","title":"CVE-2026-65145: NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue","content_text":"NVIDIA · NeMo Agent Toolkit Not in CISA KEV. EPSS 0.5% (percentile 44.6). CVSS 10.0 CRITICAL. Priority 17.3.","date_published":"2026-10-27T13:16:59.000Z","date_modified":"2026-10-27T15:03:41.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-65145","published":"2026-10-27T13:16:59Z","modified":"2026-10-27T15:03:41Z","title":"NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue","vendor":"NVIDIA","product":"NeMo Agent Toolkit","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00526,"percentile":0.44581},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17.3}},{"id":"CVE-2026-112362","url":"https://patchfirst.co/cve/CVE-2026-112362/","title":"CVE-2026-112362: @fastify/express is a Fastify plugin that runs Express middleware inside Fastify","content_text":"@fastify/express · @fastify/express Not in CISA KEV. EPSS 0.4% (percentile 30.3). CVSS 9.1 CRITICAL. Priority 13.5.","date_published":"2026-10-27T12:17:04.000Z","date_modified":"2026-10-27T15:03:41.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-112362","published":"2026-10-27T12:17:04Z","modified":"2026-10-27T15:03:41Z","title":"@fastify/express is a Fastify plugin that runs Express middleware inside Fastify","vendor":"@fastify/express","product":"@fastify/express","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00365,"percentile":0.30319},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.5}},{"id":"CVE-2026-117532","url":"https://patchfirst.co/cve/CVE-2026-117532/","title":"CVE-2026-117532: REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin…","content_text":"redaxo · core Not in CISA KEV. EPSS 0.7% (percentile 52.4). CVSS 9.8 CRITICAL. Priority 23.7.","date_published":"2026-10-27T11:17:33.000Z","date_modified":"2026-10-27T15:02:47.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-117532","published":"2026-10-27T11:17:33Z","modified":"2026-10-27T15:02:47Z","title":"REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin…","vendor":"redaxo","product":"core","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00679,"percentile":0.52351},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":23.7}},{"id":"CVE-2026-86577","url":"https://patchfirst.co/cve/CVE-2026-86577/","title":"CVE-2026-86577: Out-of-bounds Write Vulnerability in JP1 Products","content_text":"Hitachi · JP1/Integrated Management 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 39.6). CVSS 9.4 CRITICAL. Priority 15.9.","date_published":"2026-10-27T10:16:56.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-86577","published":"2026-10-27T10:16:56Z","modified":"2026-10-27T15:00:49Z","title":"Out-of-bounds Write Vulnerability in JP1 Products","vendor":"Hitachi","product":"JP1/Integrated Management 3 - Manager","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00456,"percentile":0.39603},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.9}},{"id":"CVE-2026-86576","url":"https://patchfirst.co/cve/CVE-2026-86576/","title":"CVE-2026-86576: Heap-based Buffer Overflow Vulnerability in JP1 Products","content_text":"Hitachi · JP1/Integrated Management 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 39.4). CVSS 9.4 CRITICAL. Priority 15.8.","date_published":"2026-10-27T10:16:56.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-86576","published":"2026-10-27T10:16:56Z","modified":"2026-10-27T15:00:49Z","title":"Heap-based Buffer Overflow Vulnerability in JP1 Products","vendor":"Hitachi","product":"JP1/Integrated Management 3 - Manager","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00454,"percentile":0.39399},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.8}},{"id":"CVE-2026-86575","url":"https://patchfirst.co/cve/CVE-2026-86575/","title":"CVE-2026-86575: Stack-based Buffer Overflow Vulnerability in JP1 Products","content_text":"Hitachi · JP1/Integrated Management 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 39.4). CVSS 9.4 CRITICAL. Priority 15.8.","date_published":"2026-10-27T10:16:56.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-86575","published":"2026-10-27T10:16:56Z","modified":"2026-10-27T15:00:49Z","title":"Stack-based Buffer Overflow Vulnerability in JP1 Products","vendor":"Hitachi","product":"JP1/Integrated Management 3 - Manager","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00454,"percentile":0.39399},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.8}},{"id":"CVE-2026-86574","url":"https://patchfirst.co/cve/CVE-2026-86574/","title":"CVE-2026-86574: Heap-based Buffer Overflow Vulnerability in JP1/Base","content_text":"Hitachi · JP1/Base Not in CISA KEV. EPSS 0.5% (percentile 44.1). CVSS 9.8 CRITICAL. Priority 17.0.","date_published":"2026-10-27T10:16:56.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-86574","published":"2026-10-27T10:16:56Z","modified":"2026-10-27T15:00:49Z","title":"Heap-based Buffer Overflow Vulnerability in JP1/Base","vendor":"Hitachi","product":"JP1/Base","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00519,"percentile":0.44108},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17}},{"id":"CVE-2026-82122","url":"https://patchfirst.co/cve/CVE-2026-82122/","title":"CVE-2026-82122: Stack-based Buffer Overflow Vulnerability in HiRDB","content_text":"Hitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.5% (percentile 39.4). CVSS 9.4 CRITICAL. Priority 15.8.","date_published":"2026-10-27T10:16:56.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-82122","published":"2026-10-27T10:16:56Z","modified":"2026-10-27T15:00:49Z","title":"Stack-based Buffer Overflow Vulnerability in HiRDB","vendor":"Hitachi","product":"HiRDB Server Version 10","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00454,"percentile":0.39401},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.8}},{"id":"CVE-2026-82120","url":"https://patchfirst.co/cve/CVE-2026-82120/","title":"CVE-2026-82120: Heap-based Buffer Overflow Vulnerability in HiRDB","content_text":"Hitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.4% (percentile 30.2). CVSS 9.8 CRITICAL. Priority 14.3.","date_published":"2026-10-27T10:16:56.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-82120","published":"2026-10-27T10:16:56Z","modified":"2026-10-27T15:00:49Z","title":"Heap-based Buffer Overflow Vulnerability in HiRDB","vendor":"Hitachi","product":"HiRDB Server Version 10","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00363,"percentile":0.30153},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":14.3}},{"id":"CVE-2026-82119","url":"https://patchfirst.co/cve/CVE-2026-82119/","title":"CVE-2026-82119: OS Command Injection Vulnerability in HiRDB","content_text":"Hitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 1.0% (percentile 64.1). CVSS 9.8 CRITICAL. Priority 21.1.","date_published":"2026-10-27T10:16:56.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-82119","published":"2026-10-27T10:16:56Z","modified":"2026-10-27T15:00:49Z","title":"OS Command Injection Vulnerability in HiRDB","vendor":"Hitachi","product":"HiRDB Server Version 10","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.01046,"percentile":0.6414},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":21.1}},{"id":"CVE-2026-82118","url":"https://patchfirst.co/cve/CVE-2026-82118/","title":"CVE-2026-82118: Stack-based Buffer Overflow Vulnerability in HiRDB","content_text":"Hitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.5% (percentile 44.1). CVSS 9.8 CRITICAL. Priority 17.0.","date_published":"2026-10-27T10:16:55.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-82118","published":"2026-10-27T10:16:55Z","modified":"2026-10-27T15:00:49Z","title":"Stack-based Buffer Overflow Vulnerability in HiRDB","vendor":"Hitachi","product":"HiRDB Server Version 10","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00519,"percentile":0.44109},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17}},{"id":"CVE-2026-82117","url":"https://patchfirst.co/cve/CVE-2026-82117/","title":"CVE-2026-82117: Authentication Bypass by Spoofing Vulnerability in HiRDB","content_text":"Hitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.6% (percentile 50.8). CVSS 9.8 CRITICAL. Priority 18.4.","date_published":"2026-10-27T10:16:55.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-82117","published":"2026-10-27T10:16:55Z","modified":"2026-10-27T15:00:49Z","title":"Authentication Bypass by Spoofing Vulnerability in HiRDB","vendor":"Hitachi","product":"HiRDB Server Version 10","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00643,"percentile":0.50789},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":18.4}},{"id":"CVE-2026-82116","url":"https://patchfirst.co/cve/CVE-2026-82116/","title":"CVE-2026-82116: Missing Authentication for Critical Function Vulnerability in HiRDB","content_text":"Hitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.6% (percentile 49.0). CVSS 9.8 CRITICAL. Priority 18.0.","date_published":"2026-10-27T10:16:55.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-82116","published":"2026-10-27T10:16:55Z","modified":"2026-10-27T15:00:49Z","title":"Missing Authentication for Critical Function Vulnerability in HiRDB","vendor":"Hitachi","product":"HiRDB Server Version 10","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00606,"percentile":0.48961},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":18}},{"id":"CVE-2026-76939","url":"https://patchfirst.co/cve/CVE-2026-76939/","title":"CVE-2026-76939: Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","content_text":"Hitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 44.1). CVSS 9.8 CRITICAL. Priority 17.0.","date_published":"2026-10-27T10:16:55.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-76939","published":"2026-10-27T10:16:55Z","modified":"2026-10-27T15:00:49Z","title":"Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","vendor":"Hitachi","product":"JP1/Automatic Job Management System 3 - Manager","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00519,"percentile":0.44111},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17}},{"id":"CVE-2026-76938","url":"https://patchfirst.co/cve/CVE-2026-76938/","title":"CVE-2026-76938: Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3","content_text":"Hitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.6% (percentile 50.8). CVSS 9.8 CRITICAL. Priority 18.4.","date_published":"2026-10-27T10:16:55.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-76938","published":"2026-10-27T10:16:55Z","modified":"2026-10-27T15:00:49Z","title":"Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3","vendor":"Hitachi","product":"JP1/Automatic Job Management System 3 - Manager","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00643,"percentile":0.50789},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":18.4}},{"id":"CVE-2026-76937","url":"https://patchfirst.co/cve/CVE-2026-76937/","title":"CVE-2026-76937: Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","content_text":"Hitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 39.4). CVSS 9.4 CRITICAL. Priority 15.8.","date_published":"2026-10-27T10:16:55.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-76937","published":"2026-10-27T10:16:55Z","modified":"2026-10-27T15:00:49Z","title":"Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","vendor":"Hitachi","product":"JP1/Automatic Job Management System 3 - Manager","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00454,"percentile":0.394},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.8}},{"id":"CVE-2026-76936","url":"https://patchfirst.co/cve/CVE-2026-76936/","title":"CVE-2026-76936: Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","content_text":"Hitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 39.4). CVSS 9.4 CRITICAL. Priority 15.8.","date_published":"2026-10-27T10:16:55.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-76936","published":"2026-10-27T10:16:55Z","modified":"2026-10-27T15:00:49Z","title":"Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","vendor":"Hitachi","product":"JP1/Automatic Job Management System 3 - Manager","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00454,"percentile":0.394},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.8}},{"id":"CVE-2026-76935","url":"https://patchfirst.co/cve/CVE-2026-76935/","title":"CVE-2026-76935: Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","content_text":"Hitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.3% (percentile 26.0). CVSS 9.4 CRITICAL. Priority 13.1.","date_published":"2026-10-27T10:16:55.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-76935","published":"2026-10-27T10:16:55Z","modified":"2026-10-27T15:00:49Z","title":"Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","vendor":"Hitachi","product":"JP1/Automatic Job Management System 3 - Manager","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00328,"percentile":0.25976},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":13.1}},{"id":"CVE-2026-76934","url":"https://patchfirst.co/cve/CVE-2026-76934/","title":"CVE-2026-76934: Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","content_text":"Hitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 44.1). CVSS 9.8 CRITICAL. Priority 17.0.","date_published":"2026-10-27T10:16:54.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-76934","published":"2026-10-27T10:16:54Z","modified":"2026-10-27T15:00:49Z","title":"Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","vendor":"Hitachi","product":"JP1/Automatic Job Management System 3 - Manager","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00519,"percentile":0.44109},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":17}},{"id":"CVE-2026-76933","url":"https://patchfirst.co/cve/CVE-2026-76933/","title":"CVE-2026-76933: Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","content_text":"Hitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 39.4). CVSS 9.4 CRITICAL. Priority 15.8.","date_published":"2026-10-27T10:16:54.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-76933","published":"2026-10-27T10:16:54Z","modified":"2026-10-27T15:00:49Z","title":"Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","vendor":"Hitachi","product":"JP1/Automatic Job Management System 3 - Manager","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00454,"percentile":0.394},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.8}},{"id":"CVE-2026-76932","url":"https://patchfirst.co/cve/CVE-2026-76932/","title":"CVE-2026-76932: Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","content_text":"Hitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5% (percentile 39.4). CVSS 9.4 CRITICAL. Priority 15.8.","date_published":"2026-10-27T10:16:54.000Z","date_modified":"2026-10-27T15:00:49.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-76932","published":"2026-10-27T10:16:54Z","modified":"2026-10-27T15:00:49Z","title":"Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3","vendor":"Hitachi","product":"JP1/Automatic Job Management System 3 - Manager","tier":"core","cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00454,"percentile":0.394},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.8}},{"id":"CVE-2026-102789","url":"https://patchfirst.co/cve/CVE-2026-102789/","title":"CVE-2026-102789: Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2…","content_text":"balbooa.com · Gridbox extension for Joomla Not in CISA KEV. EPSS 0.3% (percentile 24.4). CVSS 9.3 CRITICAL. Priority 12.5.","date_published":"2026-10-27T10:16:53.000Z","date_modified":"2026-10-27T15:08:50.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-102789","published":"2026-10-27T10:16:53Z","modified":"2026-10-27T15:08:50Z","title":"Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2…","vendor":"balbooa.com","product":"Gridbox extension for Joomla","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00315,"percentile":0.24438},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":12.5}},{"id":"CVE-2026-102788","url":"https://patchfirst.co/cve/CVE-2026-102788/","title":"CVE-2026-102788: Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages…","content_text":"balbooa.com · Gridbox extension for Joomla Not in CISA KEV. EPSS 0.4% (percentile 32.6). CVSS 9.3 CRITICAL. Priority 14.1.","date_published":"2026-10-27T10:16:53.000Z","date_modified":"2026-10-27T15:08:50.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-102788","published":"2026-10-27T10:16:53Z","modified":"2026-10-27T15:08:50Z","title":"Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages…","vendor":"balbooa.com","product":"Gridbox extension for Joomla","tier":"core","cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.00386,"percentile":0.32631},"kev":null,"exploited":false,"otxPulses":2,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":14.1}},{"id":"CVE-2026-92885","url":"https://patchfirst.co/cve/CVE-2026-92885/","title":"CVE-2026-92885: The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all…","content_text":"Qode Themes · Qode Membership Not in CISA KEV. EPSS 0.4% (percentile 30.6). CVSS 9.8 CRITICAL. Priority 14.6.","date_published":"2026-10-27T09:16:34.000Z","date_modified":"2026-10-27T14:52:13.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-92885","published":"2026-10-27T09:16:34Z","modified":"2026-10-27T14:52:13Z","title":"The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all…","vendor":"Qode Themes","product":"Qode Membership","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00368,"percentile":0.30635},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":14.6}},{"id":"CVE-2026-18450","url":"https://patchfirst.co/cve/CVE-2026-18450/","title":"CVE-2026-18450: The BMC does not correctly enforce integrity and encryption requirements for IPMI commands","content_text":"SMCI · X12SPI Not in CISA KEV. EPSS 0.4% (percentile 34.3). CVSS 9.8 CRITICAL. Priority 15.3.","date_published":"2026-10-27T08:16:53.000Z","date_modified":"2026-10-27T15:54:05.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-18450","published":"2026-10-27T08:16:53Z","modified":"2026-10-27T15:54:05Z","title":"The BMC does not correctly enforce integrity and encryption requirements for IPMI commands","vendor":"SMCI","product":"X12SPI","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.004,"percentile":0.34279},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":15.3}},{"id":"CVE-2026-116508","url":"https://patchfirst.co/cve/CVE-2026-116508/","title":"CVE-2026-116508: A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104","content_text":"TOTOLINK · A950RG Not in CISA KEV. EPSS 0.6% (percentile 49.1). CVSS 10.0 CRITICAL. Priority 18.4.","date_published":"2026-10-26T22:16:54.000Z","date_modified":"2026-10-31T02:17:32.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116508","published":"2026-10-26T22:16:54Z","modified":"2026-10-31T02:17:32Z","title":"A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104","vendor":"TOTOLINK","product":"A950RG","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00609,"percentile":0.49109},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":18.4,"vendorSlug":"totolink"}},{"id":"CVE-2026-116506","url":"https://patchfirst.co/cve/CVE-2026-116506/","title":"CVE-2026-116506: A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104","content_text":"TOTOLINK · A950RG Not in CISA KEV. EPSS 1.9% (percentile 79.4). CVSS 9.9 CRITICAL. Priority 24.4.","date_published":"2026-10-26T21:18:13.000Z","date_modified":"2026-10-27T14:52:13.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116506","published":"2026-10-26T21:18:13Z","modified":"2026-10-27T14:52:13Z","title":"A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104","vendor":"TOTOLINK","product":"A950RG","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0188,"percentile":0.79424},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":24.4,"vendorSlug":"totolink"}},{"id":"CVE-2026-116505","url":"https://patchfirst.co/cve/CVE-2026-116505/","title":"CVE-2026-116505: A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104","content_text":"TOTOLINK · A950RG Not in CISA KEV. EPSS 2.7% (percentile 86.1). CVSS 9.1 CRITICAL. Priority 25.2.","date_published":"2026-10-26T21:18:12.000Z","date_modified":"2026-10-31T02:17:32.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116505","published":"2026-10-26T21:18:12Z","modified":"2026-10-31T02:17:32Z","title":"A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104","vendor":"TOTOLINK","product":"A950RG","tier":"core","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.02741,"percentile":0.86149},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":25.2,"vendorSlug":"totolink"}},{"id":"CVE-2026-116504","url":"https://patchfirst.co/cve/CVE-2026-116504/","title":"CVE-2026-116504: A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104","content_text":"TOTOLINK · A950RG Not in CISA KEV. EPSS 1.5% (percentile 75.0). CVSS 9.9 CRITICAL. Priority 23.5.","date_published":"2026-10-26T21:18:12.000Z","date_modified":"2026-10-27T15:16:34.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116504","published":"2026-10-26T21:18:12Z","modified":"2026-10-27T15:16:34Z","title":"A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104","vendor":"TOTOLINK","product":"A950RG","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.01547,"percentile":0.7498},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":23.5,"vendorSlug":"totolink"}},{"id":"CVE-2026-110720","url":"https://patchfirst.co/cve/CVE-2026-110720/","title":"CVE-2026-110720: Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding…","content_text":"HashiCorp · Tooling Not in CISA KEV. EPSS 0.4% (percentile 30.3). CVSS 9.9 CRITICAL. Priority 19.4.","date_published":"2026-10-26T19:16:29.000Z","date_modified":"2026-10-27T16:03:45.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-110720","published":"2026-10-26T19:16:29Z","modified":"2026-10-27T16:03:45Z","title":"Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding…","vendor":"HashiCorp","product":"Tooling","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00365,"percentile":0.30303},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":19.4}},{"id":"CVE-2026-115915","url":"https://patchfirst.co/cve/CVE-2026-115915/","title":"CVE-2026-115915: vLLM is an inference and serving engine for large language models","content_text":"vllm-project · vllm Not in CISA KEV. EPSS 0.7% (percentile 51.5). CVSS 9.8 CRITICAL. Priority 18.8.","date_published":"2026-10-26T18:17:38.000Z","date_modified":"2026-10-28T15:37:23.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-115915","published":"2026-10-26T18:17:38Z","modified":"2026-10-28T15:37:23Z","title":"vLLM is an inference and serving engine for large language models","vendor":"vllm-project","product":"vllm","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.0066,"percentile":0.51532},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":["PyPI"],"euvdExploited":false,"priority":18.8}},{"id":"CVE-2026-10757","url":"https://patchfirst.co/cve/CVE-2026-10757/","title":"CVE-2026-10757: There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may…","content_text":"Esri · ArcGIS Server Not in CISA KEV. EPSS 0.4% (percentile 38.7). CVSS 9.8 CRITICAL. Priority 16.0.","date_published":"2026-10-26T18:17:34.000Z","date_modified":"2026-10-29T13:17:03.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-10757","published":"2026-10-26T18:17:34Z","modified":"2026-10-29T13:17:03Z","title":"There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may…","vendor":"Esri","product":"ArcGIS Server","tier":"core","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00445,"percentile":0.38695},"kev":null,"exploited":false,"otxPulses":3,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16}},{"id":"CVE-2026-102649","url":"https://patchfirst.co/cve/CVE-2026-102649/","title":"CVE-2026-102649: Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator","content_text":"padok-team · burrito Not in CISA KEV. EPSS 0.5% (percentile 39.7). CVSS 9.9 CRITICAL. Priority 16.5.","date_published":"2026-10-26T18:17:21.000Z","date_modified":"2026-10-31T02:17:29.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-102649","published":"2026-10-26T18:17:21Z","modified":"2026-10-31T02:17:29Z","title":"Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator","vendor":"padok-team","product":"burrito","tier":"core","cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00458,"percentile":0.39703},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":false,"hasSummary":false,"ecosystems":[],"euvdExploited":false,"priority":16.5}},{"id":"CVE-2026-116370","url":"https://patchfirst.co/cve/CVE-2026-116370/","title":"CVE-2026-116370: A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68","content_text":"2K Games · Sid Meier's Civilization VI Not in CISA KEV. EPSS 0.4% (percentile 33.4). CVSS 9.6 CRITICAL. Priority 20.0.","date_published":"2026-10-26T17:17:25.000Z","date_modified":"2026-10-29T15:04:32.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-116370","published":"2026-10-26T17:17:25Z","modified":"2026-10-29T15:04:32Z","title":"A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68","vendor":"2K Games","product":"Sid Meier's Civilization VI","tier":"core","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"epss":{"score":0.00392,"percentile":0.33368},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":true,"ecosystems":[],"euvdExploited":false,"priority":20}},{"id":"CVE-2026-115905","url":"https://patchfirst.co/cve/CVE-2026-115905/","title":"CVE-2026-115905: zip is a zip library for Rust that supports reading and writing simple ZIP files","content_text":"zip-rs · zip2 Not in CISA KEV. EPSS 0.3% (percentile 25.0). CVSS 10.0 CRITICAL. Priority 18.6.","date_published":"2026-10-26T17:17:17.000Z","date_modified":"2026-10-26T18:39:42.000Z","tags":[],"_patchfirst":{"id":"CVE-2026-115905","published":"2026-10-26T17:17:17Z","modified":"2026-10-26T18:39:42Z","title":"zip is a zip library for Rust that supports reading and writing simple ZIP files","vendor":"zip-rs","product":"zip2","tier":"core","cvss":{"score":10,"severity":"CRITICAL","version":"4.0"},"epss":{"score":0.0032,"percentile":0.25012},"kev":null,"exploited":false,"otxPulses":4,"reportCount":0,"techniqueIds":[],"cveRuleCount":0,"hasPublicExploit":true,"hasSummary":false,"ecosystems":["crates.io"],"euvdExploited":false,"priority":18.6}}]}