Patchfirst: newest CVEs

Patchfirst: newest CVEshttps://patchfirst.co/Newest CVEs with exploitation evidence, EPSS and ATT&CK techniques.Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-117656: Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth…https://patchfirst.co/cve/CVE-2026-117656/CVE-2026-117656Sat, 31 Oct 2026 00:16:51 GMTpow-auth · assent Not in CISA KEV. CVSS 9.3. Priority 6.5.CVE-2026-63377: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural languagehttps://patchfirst.co/cve/CVE-2026-63377/CVE-2026-63377Fri, 30 Oct 2026 23:17:14 GMTfctr-id · okta-ai-agent Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-62863: MoLing is a computer-use and browser-use based MCP serverhttps://patchfirst.co/cve/CVE-2026-62863/CVE-2026-62863Fri, 30 Oct 2026 21:17:14 GMTgojue · moling Not in CISA KEV. CVSS 9.6. Priority 6.7.CVE-2026-62853: ThingLinks is an enterprise IoT platformhttps://patchfirst.co/cve/CVE-2026-62853/CVE-2026-62853Fri, 30 Oct 2026 21:17:14 GMTmqttsnet · thinglinks Not in CISA KEV. CVSS 9.9. Priority 6.9.CVE-2026-78403: Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows…https://patchfirst.co/cve/CVE-2026-78403/CVE-2026-78403Fri, 30 Oct 2026 20:17:17 GMTThalesgroup · Sentinel Keys Server Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-61850: Kargo manages and automates the promotion of software artifactshttps://patchfirst.co/cve/CVE-2026-61850/CVE-2026-61850Fri, 30 Oct 2026 20:17:11 GMTakuity · kargo Not in CISA KEV. CVSS 9.3. Priority 6.5.CVE-2026-61620: HoneySQL turns Clojure data structures into SQLhttps://patchfirst.co/cve/CVE-2026-61620/CVE-2026-61620Fri, 30 Oct 2026 20:17:10 GMTseancorfield · honeysql Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-116241: pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the…https://patchfirst.co/cve/CVE-2026-116241/CVE-2026-116241Fri, 30 Oct 2026 20:17:03 GMTpgadmin.org · pgAdmin 4 Not in CISA KEV. CVSS 9.9. Priority 6.9.CVE-2026-90888: Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versionshttps://patchfirst.co/cve/CVE-2026-90888/CVE-2026-90888Fri, 30 Oct 2026 19:20:18 GMTleadsnap · LeadSnap Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-39738: Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versionshttps://patchfirst.co/cve/CVE-2026-39738/CVE-2026-39738Fri, 30 Oct 2026 19:18:24 GMTFunnelKit · FunnelKit Automations Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-39732: Unauthenticated SQL Injection in Transliterator <= 2.5.13 versionshttps://patchfirst.co/cve/CVE-2026-39732/CVE-2026-39732Fri, 30 Oct 2026 19:18:24 GMTIvijan-Stefan Stipic · Transliterator Not in CISA KEV. CVSS 9.3. Priority 6.5.CVE-2026-119526: Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injectionhttps://patchfirst.co/cve/CVE-2026-119526/CVE-2026-119526Fri, 30 Oct 2026 19:18:20 GMTThemeREX · Royal Event Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-116386: Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versionshttps://patchfirst.co/cve/CVE-2026-116386/CVE-2026-116386Fri, 30 Oct 2026 19:18:13 GMTCozy Vision Technologies Pvt. Ltd. · SMS Alert Order Notifications Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-61826: Bazarr is a companion application to Sonarr and Radarrhttps://patchfirst.co/cve/CVE-2026-61826/CVE-2026-61826Fri, 30 Oct 2026 17:17:27 GMTmorpheus65535 · bazarr Not in CISA KEV. CVSS 10.0. Priority 7.0.CVE-2026-112816: Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15…https://patchfirst.co/cve/CVE-2026-112816/CVE-2026-112816Fri, 30 Oct 2026 17:17:14 GMTCanonical · LXD Not in CISA KEV. CVSS 10.0. Priority 7.0.CVE-2026-119706: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…https://patchfirst.co/cve/CVE-2026-119706/CVE-2026-119706Fri, 30 Oct 2026 16:17:51 GMTInternLM · lmdeploy Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-93327: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…https://patchfirst.co/cve/CVE-2026-93327/CVE-2026-93327Fri, 30 Oct 2026 15:16:56 GMTGoogle Cloud · Application Integration Not in CISA KEV. CVSS 9.4. Priority 6.6.CVE-2026-61738: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needshttps://patchfirst.co/cve/CVE-2026-61738/CVE-2026-61738Fri, 30 Oct 2026 15:16:53 GMTsocfortress · CoPilot Not in CISA KEV. CVSS 10.0. Priority 7.0.CVE-2026-61737: ng-antd-admin is an Angular and NestJS administration system templatehttps://patchfirst.co/cve/CVE-2026-61737/CVE-2026-61737Fri, 30 Oct 2026 15:16:53 GMThuajian123 · ng-antd-admin Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-61730: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needshttps://patchfirst.co/cve/CVE-2026-61730/CVE-2026-61730Fri, 30 Oct 2026 15:16:53 GMTsocfortress · CoPilot Not in CISA KEV. CVSS 9.3. Priority 6.5.CVE-2026-61729: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needshttps://patchfirst.co/cve/CVE-2026-61729/CVE-2026-61729Fri, 30 Oct 2026 15:16:53 GMTsocfortress · CoPilot Not in CISA KEV. CVSS 9.4. Priority 6.6.CVE-2026-61728: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needshttps://patchfirst.co/cve/CVE-2026-61728/CVE-2026-61728Fri, 30 Oct 2026 15:16:52 GMTsocfortress · CoPilot Not in CISA KEV. CVSS 9.9. Priority 6.9.CVE-2026-119660: MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…https://patchfirst.co/cve/CVE-2026-119660/CVE-2026-119660Fri, 30 Oct 2026 15:16:50 GMTyincongcyincong · MuseBot Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-110799: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce storeshttps://patchfirst.co/cve/CVE-2026-110799/CVE-2026-110799Fri, 30 Oct 2026 15:16:44 GMTgivanz · Vvveb Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2015-20130: Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…https://patchfirst.co/cve/CVE-2015-20130/CVE-2015-20130Fri, 30 Oct 2026 15:16:44 GMTNetsweeper · Netsweeper Not in CISA KEV. CVSS 6.1. Priority 54.3.CVE-2010-20125: DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…https://patchfirst.co/cve/CVE-2010-20125/CVE-2010-20125Fri, 30 Oct 2026 15:16:43 GMTDedeCMS · DedeCMS Not in CISA KEV. CVSS 7.5. Priority 50.2.CVE-2026-119597: OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers…https://patchfirst.co/cve/CVE-2026-119597/CVE-2026-119597Fri, 30 Oct 2026 14:16:47 GMTAIDotNet · OpenDeepWiki Not in CISA KEV. CVSS 9.8. Priority 6.9.CVE-2026-116366: An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user…https://patchfirst.co/cve/CVE-2026-116366/CVE-2026-116366Fri, 30 Oct 2026 11:17:32 GMTClickHouse · ClickHouse Not in CISA KEV. CVSS 9.5. Priority 7.3.CVE-2025-31704: A vulnerability has been found in the Dahua Intelligent Connection Centerhttps://patchfirst.co/cve/CVE-2025-31704/CVE-2025-31704Fri, 30 Oct 2026 11:17:31 GMTDahua · Intelligent Connection Center Not in CISA KEV. CVSS 9.8. Priority 52.5.CVE-2026-82104: In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9…https://patchfirst.co/cve/CVE-2026-82104/CVE-2026-82104Fri, 30 Oct 2026 08:17:00 GMTTeltonika Networks · RUT Not in CISA KEV. EPSS 0.4%. CVSS 9.4. Priority 14.4.CVE-2026-103039: The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including…https://patchfirst.co/cve/CVE-2026-103039/CVE-2026-103039Fri, 30 Oct 2026 07:16:30 GMTGravity Forms · Gravity Forms Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 61.2.CVE-2026-118539: Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsinghttps://patchfirst.co/cve/CVE-2026-118539/CVE-2026-118539Fri, 30 Oct 2026 04:18:18 GMTDrupal · Commerce Core Not in CISA KEV. EPSS 0.2%. CVSS 6.5. Priority 52.8.CVE-2026-107249: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…https://patchfirst.co/cve/CVE-2026-107249/CVE-2026-107249Fri, 30 Oct 2026 04:17:43 GMTDrupal · Block AJAX Not in CISA KEV. EPSS 0.2%. CVSS 9.8. Priority 9.3.CVE-2026-119263: Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-119263/CVE-2026-119263Fri, 30 Oct 2026 01:16:45 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.2%. CVSS 9.6. Priority 9.3.CVE-2026-119261: Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-119261/CVE-2026-119261Fri, 30 Oct 2026 01:16:44 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.2%. CVSS 9.6. Priority 9.7.CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-118527/CVE-2026-118527Fri, 30 Oct 2026 00:00:00 GMTIvanti · Connect Secure In CISA KEV since 2026-10-30. Priority 45.0.KEVCVE-2023-22793: A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the…https://patchfirst.co/cve/CVE-2023-22793/CVE-2023-22793Thu, 29 Oct 2026 23:16:54 GMTVeeam · Management Pack for Microsoft System Center Not in CISA KEV. EPSS 0.5%. CVSS 9.3. Priority 16.1.CVE-2026-61645: Docat is a tool for hosting versioned static documentationhttps://patchfirst.co/cve/CVE-2026-61645/CVE-2026-61645Thu, 29 Oct 2026 22:17:04 GMTdocat-org · docat Not in CISA KEV. EPSS 0.4%. CVSS 9.1. Priority 14.1.CVE-2026-103093: ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platformhttps://patchfirst.co/cve/CVE-2026-103093/CVE-2026-103093Thu, 29 Oct 2026 19:17:15 GMTServiceNow · ServiceNow AI Platform Not in CISA KEV. EPSS 0.4%. CVSS 9.4. Priority 14.7.CVE-2026-118769: Botan is a C++ cryptography libraryhttps://patchfirst.co/cve/CVE-2026-118769/CVE-2026-118769Thu, 29 Oct 2026 18:17:29 GMTrandombit · botan Not in CISA KEV. EPSS 0.4%. CVSS 9.2. Priority 13.2.CVE-2026-118762: Monkeytype is a minimalistic and customizable typing testhttps://patchfirst.co/cve/CVE-2026-118762/CVE-2026-118762Thu, 29 Oct 2026 17:18:07 GMTmonkeytypegame · monkeytype Not in CISA KEV. EPSS 0.3%. CVSS 9.3. Priority 12.2.CVE-2026-107058: An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another…https://patchfirst.co/cve/CVE-2026-107058/CVE-2026-107058Thu, 29 Oct 2026 17:17:58 GMTNot in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 15.9.CVE-2026-93680: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…https://patchfirst.co/cve/CVE-2026-93680/CVE-2026-93680Thu, 29 Oct 2026 16:20:06 GMTIBM · Langflow OSS Not in CISA KEV. EPSS 2.3%. CVSS 9.8. Priority 29.1.CVE-2026-90868: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…https://patchfirst.co/cve/CVE-2026-90868/CVE-2026-90868Thu, 29 Oct 2026 16:20:04 GMTProgress Software · WS_FTP Server Not in CISA KEV. EPSS 1.5%. CVSS 9.9. Priority 22.4.CVE-2026-90866: A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…https://patchfirst.co/cve/CVE-2026-90866/CVE-2026-90866Thu, 29 Oct 2026 16:20:04 GMTProgress Software · WS_FTP Server Not in CISA KEV. EPSS 0.7%. CVSS 9.1. Priority 17.9.CVE-2026-90864: A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…https://patchfirst.co/cve/CVE-2026-90864/CVE-2026-90864Thu, 29 Oct 2026 16:20:04 GMTProgress Software · WS_FTP Server Not in CISA KEV. EPSS 0.5%. CVSS 9.1. Priority 15.3.CVE-2026-90863: Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7…https://patchfirst.co/cve/CVE-2026-90863/CVE-2026-90863Thu, 29 Oct 2026 16:20:04 GMTProgress Software · WS_FTP Server Not in CISA KEV. EPSS 0.7%. CVSS 9.1. Priority 17.3.CVE-2026-84295: Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could…https://patchfirst.co/cve/CVE-2026-84295/CVE-2026-84295Thu, 29 Oct 2026 16:19:29 GMTProgress Software · WS_FTP Server Not in CISA KEV. EPSS 0.6%. CVSS 10.0. Priority 16.9.CVE-2026-62131: Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versionshttps://patchfirst.co/cve/CVE-2026-62131/CVE-2026-62131Thu, 29 Oct 2026 16:18:14 GMTZoho Flow · Zoho Flow Not in CISA KEV. EPSS 0.3%. CVSS 9.8. Priority 12.4.CVE-2026-62018: Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versionshttps://patchfirst.co/cve/CVE-2026-62018/CVE-2026-62018Thu, 29 Oct 2026 16:18:14 GMTThemeREX · Gunslinger Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 15.4.CVE-2026-62017: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versionshttps://patchfirst.co/cve/CVE-2026-62017/CVE-2026-62017Thu, 29 Oct 2026 16:18:14 GMTThemeREX · Good Homes Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.8.CVE-2026-62016: Unauthenticated PHP Object Injection in Gamic <= 1.19 versionshttps://patchfirst.co/cve/CVE-2026-62016/CVE-2026-62016Thu, 29 Oct 2026 16:18:14 GMTThemeREX · Gamic Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.3.CVE-2026-62015: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versionshttps://patchfirst.co/cve/CVE-2026-62015/CVE-2026-62015Thu, 29 Oct 2026 16:18:14 GMTThemeREX · Gamezone Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.3.CVE-2026-62014: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versionshttps://patchfirst.co/cve/CVE-2026-62014/CVE-2026-62014Thu, 29 Oct 2026 16:18:14 GMTThemeREX · EmojiNation Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.9.CVE-2026-62013: Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versionshttps://patchfirst.co/cve/CVE-2026-62013/CVE-2026-62013Thu, 29 Oct 2026 16:18:14 GMTThemeREX · Edge Decor Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 15.4.CVE-2026-62012: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versionshttps://patchfirst.co/cve/CVE-2026-62012/CVE-2026-62012Thu, 29 Oct 2026 16:18:13 GMTThemeREX · Coinpress Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.8.CVE-2026-62011: Unauthenticated PHP Object Injection in Bonbon <= 1.11 versionshttps://patchfirst.co/cve/CVE-2026-62011/CVE-2026-62011Thu, 29 Oct 2026 16:18:13 GMTThemeREX · Bonbon Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.3.CVE-2026-62010: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versionshttps://patchfirst.co/cve/CVE-2026-62010/CVE-2026-62010Thu, 29 Oct 2026 16:18:13 GMTThemeREX · Avventure Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.3.CVE-2026-62009: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versionshttps://patchfirst.co/cve/CVE-2026-62009/CVE-2026-62009Thu, 29 Oct 2026 16:18:13 GMTThemeREX · Filmax Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.9.CVE-2026-62008: Unauthenticated PHP Object Injection in Orpheus <= 1.8 versionshttps://patchfirst.co/cve/CVE-2026-62008/CVE-2026-62008Thu, 29 Oct 2026 16:18:13 GMTThemeREX · Orpheus Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.8.CVE-2026-62006: Unauthenticated PHP Object Injection in Nuts <= 1.12 versionshttps://patchfirst.co/cve/CVE-2026-62006/CVE-2026-62006Thu, 29 Oct 2026 16:18:13 GMTThemeREX · Nuts Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.8.CVE-2026-62005: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versionshttps://patchfirst.co/cve/CVE-2026-62005/CVE-2026-62005Thu, 29 Oct 2026 16:18:13 GMTThemeREX · Muzicon Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.3.CVE-2026-62004: Unauthenticated PHP Object Injection in Motorix <= 1.11 versionshttps://patchfirst.co/cve/CVE-2026-62004/CVE-2026-62004Thu, 29 Oct 2026 16:18:13 GMTThemeREX · Motorix Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.3.CVE-2026-62003: Unauthenticated PHP Object Injection in Mission <= 1.22 versionshttps://patchfirst.co/cve/CVE-2026-62003/CVE-2026-62003Thu, 29 Oct 2026 16:18:12 GMTThemeREX · Mission Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.3.CVE-2026-62002: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versionshttps://patchfirst.co/cve/CVE-2026-62002/CVE-2026-62002Thu, 29 Oct 2026 16:18:12 GMTThemeREX · Meals & Wheels Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.3.CVE-2026-62001: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versionshttps://patchfirst.co/cve/CVE-2026-62001/CVE-2026-62001Thu, 29 Oct 2026 16:18:12 GMTThemeREX · Marcell Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 15.8.CVE-2026-61998: Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versionshttps://patchfirst.co/cve/CVE-2026-61998/CVE-2026-61998Thu, 29 Oct 2026 16:18:12 GMTThemeREX · Le Truffe Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 15.8.CVE-2026-61997: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versionshttps://patchfirst.co/cve/CVE-2026-61997/CVE-2026-61997Thu, 29 Oct 2026 16:18:12 GMTThemeREX · Legal Stone Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.3.CVE-2026-61992: Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versionshttps://patchfirst.co/cve/CVE-2026-61992/CVE-2026-61992Thu, 29 Oct 2026 16:18:11 GMTVon Eyal Fitoussi · GEO my WordPress Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.1.CVE-2026-61991: Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versionshttps://patchfirst.co/cve/CVE-2026-61991/CVE-2026-61991Thu, 29 Oct 2026 16:18:11 GMTAjax Load More · AjaxLoadMore Cache Not in CISA KEV. EPSS 0.7%. CVSS 10.0. Priority 18.7.CVE-2026-54860: Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versionshttps://patchfirst.co/cve/CVE-2026-54860/CVE-2026-54860Thu, 29 Oct 2026 16:18:10 GMTThemeREX · Ozisti Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.0.CVE-2026-54859: Unauthenticated PHP Object Injection in Preservation <= 1.15 versionshttps://patchfirst.co/cve/CVE-2026-54859/CVE-2026-54859Thu, 29 Oct 2026 16:18:10 GMTThemeREX · Preservation Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.5.CVE-2026-54858: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versionshttps://patchfirst.co/cve/CVE-2026-54858/CVE-2026-54858Thu, 29 Oct 2026 16:18:09 GMTThemeREX · Printy Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.0.CVE-2026-54857: Unauthenticated PHP Object Injection in Quirky <= 1.23 versionshttps://patchfirst.co/cve/CVE-2026-54857/CVE-2026-54857Thu, 29 Oct 2026 16:18:09 GMTThemeREX · Quirky Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.0.CVE-2026-54856: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versionshttps://patchfirst.co/cve/CVE-2026-54856/CVE-2026-54856Thu, 29 Oct 2026 16:18:09 GMTThemeREX · RexCoin Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.0.CVE-2026-18894: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…https://patchfirst.co/cve/CVE-2026-18894/CVE-2026-18894Thu, 29 Oct 2026 16:18:08 GMTIBM · Langflow OSS Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.9.CVE-2026-119145: Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload…https://patchfirst.co/cve/CVE-2026-119145/CVE-2026-119145Thu, 29 Oct 2026 16:18:08 GMTfrappe · frappe Not in CISA KEV. EPSS 0.8%. CVSS 9.9. Priority 18.7.CVE-2026-112256: Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server…https://patchfirst.co/cve/CVE-2026-112256/CVE-2026-112256Thu, 29 Oct 2026 16:17:58 GMTOpenText · Advanced Authentication Server Not in CISA KEV. EPSS 0.2%. CVSS 9.2. Priority 9.6.CVE-2026-111732: P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the…https://patchfirst.co/cve/CVE-2026-111732/CVE-2026-111732Thu, 29 Oct 2026 16:17:57 GMTRT-Labs · P-Net Not in CISA KEV. EPSS 0.4%. CVSS 9.3. Priority 13.4.CVE-2026-110186: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control…https://patchfirst.co/cve/CVE-2026-110186/CVE-2026-110186Thu, 29 Oct 2026 16:17:55 GMTIBM · Langflow OSS Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 17.5.CVE-2026-107032: Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an…https://patchfirst.co/cve/CVE-2026-107032/CVE-2026-107032Thu, 29 Oct 2026 16:17:48 GMTNot in CISA KEV. EPSS 0.5%. CVSS 9.1. Priority 15.6.CVE-2026-104339: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…https://patchfirst.co/cve/CVE-2026-104339/CVE-2026-104339Thu, 29 Oct 2026 16:17:44 GMTIBM · Langflow OSS Not in CISA KEV. EPSS 0.7%. CVSS 9.8. Priority 18.5.CVE-2026-104317: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute…https://patchfirst.co/cve/CVE-2026-104317/CVE-2026-104317Thu, 29 Oct 2026 16:17:43 GMTIBM · Langflow OSS Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 17.0.CVE-2026-107015: Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in…https://patchfirst.co/cve/CVE-2026-107015/CVE-2026-107015Thu, 29 Oct 2026 15:17:15 GMTNot in CISA KEV. EPSS 0.5%. CVSS 9.1. Priority 15.6.CVE-2026-97854: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerabilityhttps://patchfirst.co/cve/CVE-2026-97854/CVE-2026-97854Thu, 29 Oct 2026 12:17:14 GMTYamaha Corporation · NWR100 Not in CISA KEV. EPSS 1.4%. CVSS 9.8. Priority 22.3.CVE-2026-115964: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes…https://patchfirst.co/cve/CVE-2026-115964/CVE-2026-115964Thu, 29 Oct 2026 11:17:31 GMTStylemixThemes · Motors Not in CISA KEV. EPSS 0.3%. CVSS 9.3. Priority 12.7.CVE-2026-114358: This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in…https://patchfirst.co/cve/CVE-2026-114358/CVE-2026-114358Thu, 29 Oct 2026 09:17:07 GMTRadius Synergies · Radius Xenia M2M Platform Not in CISA KEV. EPSS 0.5%. CVSS 9.3. Priority 16.2.CVE-2026-115245: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…https://patchfirst.co/cve/CVE-2026-115245/CVE-2026-115245Thu, 29 Oct 2026 06:17:19 GMTUnknown · Chat AI with Dispatcher Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.0.CVE-2026-113617: The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before…https://patchfirst.co/cve/CVE-2026-113617/CVE-2026-113617Thu, 29 Oct 2026 06:17:18 GMTUnknown · Automated Import Products to Cart Not in CISA KEV. EPSS 0.3%. CVSS 9.9. Priority 13.6.CVE-2026-113616: The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved…https://patchfirst.co/cve/CVE-2026-113616/CVE-2026-113616Thu, 29 Oct 2026 06:17:18 GMTUnknown · LogixFast Auth Not in CISA KEV. EPSS 0.3%. CVSS 9.8. Priority 13.5.CVE-2026-42922: A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)https://patchfirst.co/cve/CVE-2026-42922/CVE-2026-42922Thu, 29 Oct 2026 04:18:36 GMTfrangoteam · Frangoteam Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 17.0.CVE-2026-109516: The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account…https://patchfirst.co/cve/CVE-2026-109516/CVE-2026-109516Thu, 29 Oct 2026 04:18:22 GMTguruteam · Bot for Telegram on WooCommerce Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 17.0.CVE-2026-66088: In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating…https://patchfirst.co/cve/CVE-2026-66088/CVE-2026-66088Thu, 29 Oct 2026 02:16:52 GMTApereo Foundation · openEQUELLA Not in CISA KEV. EPSS 0.7%. CVSS 9.4. Priority 18.2.CVE-2026-118579: A weakness has been identified in D-Link DIR-505 1.10B02https://patchfirst.co/cve/CVE-2026-118579/CVE-2026-118579Wed, 28 Oct 2026 23:17:09 GMTD-Link · DIR-505 Not in CISA KEV. EPSS 0.8%. CVSS 9.8. Priority 19.2.CVE-2026-61567: AVideo is a video-sharing Platformhttps://patchfirst.co/cve/CVE-2026-61567/CVE-2026-61567Wed, 28 Oct 2026 22:17:15 GMTWWBN · AVideo-Encoder Not in CISA KEV. EPSS 0.5%. CVSS 10.0. Priority 17.0.CVE-2026-61564: AVideo is a video-sharing Platformhttps://patchfirst.co/cve/CVE-2026-61564/CVE-2026-61564Wed, 28 Oct 2026 22:17:15 GMTWWBN · AVideo-Encoder Not in CISA KEV. EPSS 0.5%. CVSS 10.0. Priority 17.2.CVE-2026-118690: Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…https://patchfirst.co/cve/CVE-2026-118690/CVE-2026-118690Wed, 28 Oct 2026 22:17:13 GMTSignalK · signalk-server Not in CISA KEV. EPSS 0.7%. CVSS 9.8. Priority 18.5.CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…https://patchfirst.co/cve/CVE-2026-76418/CVE-2026-76418Wed, 28 Oct 2026 20:18:47 GMTCisco · Secure Firewall ASA Software and Cisco Secure FTD Software In CISA KEV since 2026-10-29. EPSS 0.9%. CVSS 8.6. Priority 64.4.KEVCVE-2026-63190: FearlessCMS is a flat-file `content` management system centered on simplicity and open sourcehttps://patchfirst.co/cve/CVE-2026-63190/CVE-2026-63190Wed, 28 Oct 2026 20:18:37 GMTfearlessgeekmedia · FearlessCMS Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 16.8.CVE-2026-118264: Echo is a Go web frameworkhttps://patchfirst.co/cve/CVE-2026-118264/CVE-2026-118264Wed, 28 Oct 2026 19:17:31 GMTlabstack · echo Not in CISA KEV. EPSS 0.4%. CVSS 9.1. Priority 14.9.CVE-2026-103409: A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an…https://patchfirst.co/cve/CVE-2026-103409/CVE-2026-103409Wed, 28 Oct 2026 17:17:27 GMTJuniper Networks · Session Smart Router Not in CISA KEV. EPSS 0.3%. CVSS 9.8. Priority 13.2.CVE-2026-103406: An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in…https://patchfirst.co/cve/CVE-2026-103406/CVE-2026-103406Wed, 28 Oct 2026 17:17:25 GMTJuniper Networks · Session Smart Conductor Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.3.CVE-2026-44179: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluencehttps://patchfirst.co/cve/CVE-2026-44179/CVE-2026-44179Wed, 28 Oct 2026 16:17:07 GMTxwikisas · xwiki-pro-macros Not in CISA KEV. EPSS 0.7%. CVSS 9.9. Priority 18.6.CVE-2026-115968: Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object…https://patchfirst.co/cve/CVE-2026-115968/CVE-2026-115968Wed, 28 Oct 2026 14:16:58 GMTUltimate Member · Ultimate Member Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 15.0.CVE-2026-105420: Wing FTP Server does not verify user's base folderhttps://patchfirst.co/cve/CVE-2026-105420/CVE-2026-105420Wed, 28 Oct 2026 14:16:56 GMTWing Soft Technology · Wing FTP Server Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 16.1.CVE-2026-67074: HCL BigFix AEX is affected by a Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-67074/CVE-2026-67074Wed, 28 Oct 2026 13:17:08 GMTHCL Software · BigFix AEX Not in CISA KEV. EPSS 0.5%. CVSS 9.1. Priority 15.7.CVE-2026-115904: Topluyo is a social networking platformhttps://patchfirst.co/cve/CVE-2026-115904/CVE-2026-115904Wed, 28 Oct 2026 13:17:05 GMTtopluyo · App Not in CISA KEV. EPSS 0.7%. CVSS 9.6. Priority 19.0.CVE-2026-115607: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite…https://patchfirst.co/cve/CVE-2026-115607/CVE-2026-115607Wed, 28 Oct 2026 13:17:04 GMTCrowd Favorite · DXP ToolKit Not in CISA KEV. EPSS 0.2%. CVSS 9.3. Priority 10.8.CVE-2026-111411: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit…https://patchfirst.co/cve/CVE-2026-111411/CVE-2026-111411Wed, 28 Oct 2026 13:17:04 GMTAman · FunnelKit Automations Not in CISA KEV. EPSS 0.3%. CVSS 9.3. Priority 13.1.CVE-2026-118477: The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injectionhttps://patchfirst.co/cve/CVE-2026-118477/CVE-2026-118477Wed, 28 Oct 2026 12:17:40 GMTEISGE · Kalifast Not in CISA KEV. EPSS 1.1%. CVSS 9.8. Priority 21.4.CVE-2026-114278: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…https://patchfirst.co/cve/CVE-2026-114278/CVE-2026-114278Wed, 28 Oct 2026 12:17:39 GMTEclipse Foundation · Eclipse Che Not in CISA KEV. EPSS 0.9%. CVSS 9.8. Priority 20.1.CVE-2026-112197: Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI servicehttps://patchfirst.co/cve/CVE-2026-112197/CVE-2026-112197Wed, 28 Oct 2026 11:17:15 GMTTactis · NoviGest Desktop App Not in CISA KEV. EPSS 0.4%. CVSS 9.4. Priority 14.0.CVE-2026-103799: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…https://patchfirst.co/cve/CVE-2026-103799/CVE-2026-103799Wed, 28 Oct 2026 11:17:14 GMTDell · PowerProtect Data Domain Management Center Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 13.3.CVE-2026-103792: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…https://patchfirst.co/cve/CVE-2026-103792/CVE-2026-103792Wed, 28 Oct 2026 11:17:14 GMTDell · PowerProtect Data Domain Management Center Not in CISA KEV. EPSS 0.4%. CVSS 9.6. Priority 14.0.CVE-2026-103780: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…https://patchfirst.co/cve/CVE-2026-103780/CVE-2026-103780Wed, 28 Oct 2026 11:17:14 GMTDell · PowerProtect Data Domain Not in CISA KEV. EPSS 0.8%. CVSS 9.8. Priority 19.4.CVE-2026-86384: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…https://patchfirst.co/cve/CVE-2026-86384/CVE-2026-86384Wed, 28 Oct 2026 10:17:09 GMTDell · PowerProtect Data Domain Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 16.4.CVE-2026-86400: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…https://patchfirst.co/cve/CVE-2026-86400/CVE-2026-86400Wed, 28 Oct 2026 09:17:08 GMTDell · PowerProtect Data Domain Not in CISA KEV. EPSS 0.9%. CVSS 9.8. Priority 20.1.CVE-2026-86397: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…https://patchfirst.co/cve/CVE-2026-86397/CVE-2026-86397Wed, 28 Oct 2026 09:17:07 GMTDell · PowerProtect Data Domain Not in CISA KEV. EPSS 0.3%. CVSS 9.8. Priority 13.6.CVE-2026-109218: The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including…https://patchfirst.co/cve/CVE-2026-109218/CVE-2026-109218Wed, 28 Oct 2026 07:16:44 GMTkleor · Contact Manager Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 18.1.CVE-2026-103688: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its…https://patchfirst.co/cve/CVE-2026-103688/CVE-2026-103688Wed, 28 Oct 2026 06:16:32 GMTUnknown · Checkout Files Upload for WooCommerce Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 67.8.CVE-2026-104383: Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on…https://patchfirst.co/cve/CVE-2026-104383/CVE-2026-104383Wed, 28 Oct 2026 05:16:59 GMTEagleCloud · Aquila Not in CISA KEV. EPSS 0.4%. CVSS 9.4. Priority 13.8.CVE-2026-84999: The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to…https://patchfirst.co/cve/CVE-2026-84999/CVE-2026-84999Wed, 28 Oct 2026 03:17:16 GMTPie Register · Pie Register Premium Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 61.6.CVE-2026-106013: The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler…https://patchfirst.co/cve/CVE-2026-106013/CVE-2026-106013Wed, 28 Oct 2026 02:17:01 GMTartbees · Jupiter X Core Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 17.2.CVE-2026-110879: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its…https://patchfirst.co/cve/CVE-2026-110879/CVE-2026-110879Wed, 28 Oct 2026 01:16:55 GMTFasterXML · jackson-databind Not in CISA KEV. EPSS 1.2%. CVSS 9.8. Priority 21.6.CVE-2026-58256: GRR is a resource management and reservation applicationhttps://patchfirst.co/cve/CVE-2026-58256/CVE-2026-58256Tue, 27 Oct 2026 23:17:06 GMTJeromeDevome · GRR Not in CISA KEV. EPSS 0.6%. CVSS 9.1. Priority 17.2.CVE-2026-118355: Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-118355/CVE-2026-118355Tue, 27 Oct 2026 23:17:04 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 12.5.CVE-2026-118342: Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-118342/CVE-2026-118342Tue, 27 Oct 2026 23:17:03 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 12.5.CVE-2026-118340: Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-118340/CVE-2026-118340Tue, 27 Oct 2026 23:17:02 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.4%. CVSS 9.6. Priority 13.9.CVE-2026-118337: Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web…https://patchfirst.co/cve/CVE-2026-118337/CVE-2026-118337Tue, 27 Oct 2026 23:17:02 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.2%. CVSS 9.3. Priority 9.7.CVE-2026-118333: Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin…https://patchfirst.co/cve/CVE-2026-118333/CVE-2026-118333Tue, 27 Oct 2026 23:17:01 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.2%. CVSS 9.3. Priority 9.7.CVE-2026-118332: Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-118332/CVE-2026-118332Tue, 27 Oct 2026 23:17:01 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 12.5.CVE-2026-118321: Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-118321/CVE-2026-118321Tue, 27 Oct 2026 23:17:00 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.4%. CVSS 9.6. Priority 13.9.CVE-2026-118316: Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-118316/CVE-2026-118316Tue, 27 Oct 2026 23:17:00 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 12.5.CVE-2026-118312: Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-118312/CVE-2026-118312Tue, 27 Oct 2026 23:16:59 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 12.8.CVE-2026-118310: Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-118310/CVE-2026-118310Tue, 27 Oct 2026 23:16:59 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 12.8.CVE-2026-118309: Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-118309/CVE-2026-118309Tue, 27 Oct 2026 23:16:59 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 12.8.CVE-2026-118308: Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-118308/CVE-2026-118308Tue, 27 Oct 2026 23:16:59 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.3%. CVSS 9.6. Priority 12.8.CVE-2026-118306: Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-118306/CVE-2026-118306Tue, 27 Oct 2026 23:16:59 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.4%. CVSS 9.6. Priority 14.2.CVE-2026-118305: Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-118305/CVE-2026-118305Tue, 27 Oct 2026 23:16:58 GMTGoogle · Chrome Not in CISA KEV. EPSS 0.4%. CVSS 9.6. Priority 14.2.CVE-2026-116692: MLflow is an open source AI engineering platform for agents, large language models, and machine learning modelshttps://patchfirst.co/cve/CVE-2026-116692/CVE-2026-116692Tue, 27 Oct 2026 21:18:05 GMTmlflow · mlflow Not in CISA KEV. EPSS 0.7%. CVSS 9.8. Priority 23.9.CVE-2026-116690: MLflow is an open source AI engineering platform for agents, large language models, and machine learning modelshttps://patchfirst.co/cve/CVE-2026-116690/CVE-2026-116690Tue, 27 Oct 2026 20:17:14 GMTmlflow · mlflow Not in CISA KEV. EPSS 0.6%. CVSS 7.5. Priority 60.9.CVE-2026-112352: Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote…https://patchfirst.co/cve/CVE-2026-112352/CVE-2026-112352Tue, 27 Oct 2026 20:17:12 GMTSunhillo Corporation · SureLine Not in CISA KEV. EPSS 1.3%. CVSS 9.1. Priority 21.6.CVE-2026-48360: Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could…https://patchfirst.co/cve/CVE-2026-48360/CVE-2026-48360Tue, 27 Oct 2026 17:17:00 GMTAdobe · Adobe Connect Desktop App Not in CISA KEV. EPSS 0.4%. CVSS 9.6. Priority 16.1.CVE-2026-114595: In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be…https://patchfirst.co/cve/CVE-2026-114595/CVE-2026-114595Tue, 27 Oct 2026 17:16:58 GMTThe EPICS Community · EPICS Base Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 21.8.CVE-2026-112353: GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the…https://patchfirst.co/cve/CVE-2026-112353/CVE-2026-112353Tue, 27 Oct 2026 17:16:58 GMTGFI USA, LLC · GFI KerioConnect Not in CISA KEV. EPSS 0.2%. CVSS 8.2. Priority 54.9.CVE-2026-108142: A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Servicehttps://patchfirst.co/cve/CVE-2026-108142/CVE-2026-108142Tue, 27 Oct 2026 17:16:57 GMTVeeam · Backup and Replication Not in CISA KEV. EPSS 0.4%. CVSS 9.1. Priority 14.3.CVE-2026-105781: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…https://patchfirst.co/cve/CVE-2026-105781/CVE-2026-105781Tue, 27 Oct 2026 17:16:56 GMTAdobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.5%. CVSS 10.0. Priority 16.9.CVE-2026-105780: Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…https://patchfirst.co/cve/CVE-2026-105780/CVE-2026-105780Tue, 27 Oct 2026 17:16:56 GMTAdobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.5%. CVSS 9.9. Priority 16.4.CVE-2026-105779: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…https://patchfirst.co/cve/CVE-2026-105779/CVE-2026-105779Tue, 27 Oct 2026 17:16:56 GMTAdobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.3%. CVSS 9.1. Priority 11.9.CVE-2026-105489: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…https://patchfirst.co/cve/CVE-2026-105489/CVE-2026-105489Tue, 27 Oct 2026 17:16:56 GMTAdobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.5%. CVSS 9.9. Priority 16.2.CVE-2026-104354: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…https://patchfirst.co/cve/CVE-2026-104354/CVE-2026-104354Tue, 27 Oct 2026 17:16:55 GMTAdobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.5%. CVSS 9.1. Priority 16.0.CVE-2026-104353: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…https://patchfirst.co/cve/CVE-2026-104353/CVE-2026-104353Tue, 27 Oct 2026 17:16:55 GMTAdobe · Adobe Campaign Classic Not in CISA KEV. EPSS 1.3%. CVSS 9.9. Priority 22.1.CVE-2026-104351: Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability…https://patchfirst.co/cve/CVE-2026-104351/CVE-2026-104351Tue, 27 Oct 2026 17:16:55 GMTAdobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.6%. CVSS 9.9. Priority 17.5.CVE-2026-104350: Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerabilityhttps://patchfirst.co/cve/CVE-2026-104350/CVE-2026-104350Tue, 27 Oct 2026 17:16:55 GMTAdobe · Adobe Campaign Classic Not in CISA KEV. EPSS 0.6%. CVSS 9.3. Priority 17.4.CVE-2026-93866: An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal…https://patchfirst.co/cve/CVE-2026-93866/CVE-2026-93866Tue, 27 Oct 2026 16:17:33 GMTWatchGuard · Fireware OS Not in CISA KEV. EPSS 0.4%. CVSS 9.2. Priority 15.6.CVE-2026-93865: A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote…https://patchfirst.co/cve/CVE-2026-93865/CVE-2026-93865Tue, 27 Oct 2026 16:17:32 GMTWatchGuard · Fireware OS Not in CISA KEV. EPSS 0.5%. CVSS 9.2. Priority 15.8.CVE-2026-93857: A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to…https://patchfirst.co/cve/CVE-2026-93857/CVE-2026-93857Tue, 27 Oct 2026 16:17:32 GMTWatchGuard · Fireware OS Not in CISA KEV. EPSS 0.5%. CVSS 9.2. Priority 16.0.CVE-2026-90465: A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster…https://patchfirst.co/cve/CVE-2026-90465/CVE-2026-90465Tue, 27 Oct 2026 16:17:31 GMTWatchGuard · Fireware OS Not in CISA KEV. EPSS 0.2%. CVSS 9.4. Priority 10.9.CVE-2026-116863: Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site…https://patchfirst.co/cve/CVE-2026-116863/CVE-2026-116863Tue, 27 Oct 2026 16:17:30 GMTTribulant Software · Newsletters Not in CISA KEV. EPSS 0.2%. CVSS 9.6. Priority 9.5.CVE-2026-112710: A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who…https://patchfirst.co/cve/CVE-2026-112710/CVE-2026-112710Tue, 27 Oct 2026 16:17:30 GMTWatchGuard · Fireware OS Not in CISA KEV. EPSS 0.4%. CVSS 9.2. Priority 14.8.CVE-2026-112709: A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls…https://patchfirst.co/cve/CVE-2026-112709/CVE-2026-112709Tue, 27 Oct 2026 16:17:29 GMTWatchGuard · Fireware OS Not in CISA KEV. EPSS 0.4%. CVSS 9.2. Priority 14.8.CVE-2026-103594: A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote…https://patchfirst.co/cve/CVE-2026-103594/CVE-2026-103594Tue, 27 Oct 2026 16:17:28 GMTWatchGuard · Fireware OS Not in CISA KEV. EPSS 0.4%. CVSS 9.5. Priority 15.2.CVE-2026-78845: Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light…https://patchfirst.co/cve/CVE-2026-78845/CVE-2026-78845Tue, 27 Oct 2026 15:17:00 GMTNot in CISA KEV. EPSS 0.3%. CVSS 9.8. Priority 13.4.CVE-2026-117601: Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing…https://patchfirst.co/cve/CVE-2026-117601/CVE-2026-117601Tue, 27 Oct 2026 14:16:39 GMTspesmilo · electrum Not in CISA KEV. EPSS 0.2%. CVSS 7.5. Priority 53.0.CVE-2026-117564: nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…https://patchfirst.co/cve/CVE-2026-117564/CVE-2026-117564Tue, 27 Oct 2026 14:16:38 GMTbuqiyuan · nest-admin Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 18.0.CVE-2026-65145: NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issuehttps://patchfirst.co/cve/CVE-2026-65145/CVE-2026-65145Tue, 27 Oct 2026 13:16:59 GMTNVIDIA · NeMo Agent Toolkit Not in CISA KEV. EPSS 0.5%. CVSS 10.0. Priority 17.3.CVE-2026-112362: @fastify/express is a Fastify plugin that runs Express middleware inside Fastifyhttps://patchfirst.co/cve/CVE-2026-112362/CVE-2026-112362Tue, 27 Oct 2026 12:17:04 GMT@fastify/express · @fastify/express Not in CISA KEV. EPSS 0.4%. CVSS 9.1. Priority 13.5.CVE-2026-117532: REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin…https://patchfirst.co/cve/CVE-2026-117532/CVE-2026-117532Tue, 27 Oct 2026 11:17:33 GMTredaxo · core Not in CISA KEV. EPSS 0.7%. CVSS 9.8. Priority 23.7.CVE-2026-86577: Out-of-bounds Write Vulnerability in JP1 Productshttps://patchfirst.co/cve/CVE-2026-86577/CVE-2026-86577Tue, 27 Oct 2026 10:16:56 GMTHitachi · JP1/Integrated Management 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 15.9.CVE-2026-86576: Heap-based Buffer Overflow Vulnerability in JP1 Productshttps://patchfirst.co/cve/CVE-2026-86576/CVE-2026-86576Tue, 27 Oct 2026 10:16:56 GMTHitachi · JP1/Integrated Management 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 15.8.CVE-2026-86575: Stack-based Buffer Overflow Vulnerability in JP1 Productshttps://patchfirst.co/cve/CVE-2026-86575/CVE-2026-86575Tue, 27 Oct 2026 10:16:56 GMTHitachi · JP1/Integrated Management 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 15.8.CVE-2026-86574: Heap-based Buffer Overflow Vulnerability in JP1/Basehttps://patchfirst.co/cve/CVE-2026-86574/CVE-2026-86574Tue, 27 Oct 2026 10:16:56 GMTHitachi · JP1/Base Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 17.0.CVE-2026-82122: Stack-based Buffer Overflow Vulnerability in HiRDBhttps://patchfirst.co/cve/CVE-2026-82122/CVE-2026-82122Tue, 27 Oct 2026 10:16:56 GMTHitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 15.8.CVE-2026-82120: Heap-based Buffer Overflow Vulnerability in HiRDBhttps://patchfirst.co/cve/CVE-2026-82120/CVE-2026-82120Tue, 27 Oct 2026 10:16:56 GMTHitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.3.CVE-2026-82119: OS Command Injection Vulnerability in HiRDBhttps://patchfirst.co/cve/CVE-2026-82119/CVE-2026-82119Tue, 27 Oct 2026 10:16:56 GMTHitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 1.0%. CVSS 9.8. Priority 21.1.CVE-2026-82118: Stack-based Buffer Overflow Vulnerability in HiRDBhttps://patchfirst.co/cve/CVE-2026-82118/CVE-2026-82118Tue, 27 Oct 2026 10:16:55 GMTHitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 17.0.CVE-2026-82117: Authentication Bypass by Spoofing Vulnerability in HiRDBhttps://patchfirst.co/cve/CVE-2026-82117/CVE-2026-82117Tue, 27 Oct 2026 10:16:55 GMTHitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 18.4.CVE-2026-82116: Missing Authentication for Critical Function Vulnerability in HiRDBhttps://patchfirst.co/cve/CVE-2026-82116/CVE-2026-82116Tue, 27 Oct 2026 10:16:55 GMTHitachi · HiRDB Server Version 10 Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 18.0.CVE-2026-76939: Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3https://patchfirst.co/cve/CVE-2026-76939/CVE-2026-76939Tue, 27 Oct 2026 10:16:55 GMTHitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 17.0.CVE-2026-76938: Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3https://patchfirst.co/cve/CVE-2026-76938/CVE-2026-76938Tue, 27 Oct 2026 10:16:55 GMTHitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.6%. CVSS 9.8. Priority 18.4.CVE-2026-76937: Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3https://patchfirst.co/cve/CVE-2026-76937/CVE-2026-76937Tue, 27 Oct 2026 10:16:55 GMTHitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 15.8.CVE-2026-76936: Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3https://patchfirst.co/cve/CVE-2026-76936/CVE-2026-76936Tue, 27 Oct 2026 10:16:55 GMTHitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 15.8.CVE-2026-76935: Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3https://patchfirst.co/cve/CVE-2026-76935/CVE-2026-76935Tue, 27 Oct 2026 10:16:55 GMTHitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.3%. CVSS 9.4. Priority 13.1.CVE-2026-76934: Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3https://patchfirst.co/cve/CVE-2026-76934/CVE-2026-76934Tue, 27 Oct 2026 10:16:54 GMTHitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.8. Priority 17.0.CVE-2026-76933: Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3https://patchfirst.co/cve/CVE-2026-76933/CVE-2026-76933Tue, 27 Oct 2026 10:16:54 GMTHitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 15.8.CVE-2026-76932: Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3https://patchfirst.co/cve/CVE-2026-76932/CVE-2026-76932Tue, 27 Oct 2026 10:16:54 GMTHitachi · JP1/Automatic Job Management System 3 - Manager Not in CISA KEV. EPSS 0.5%. CVSS 9.4. Priority 15.8.CVE-2026-102789: Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2…https://patchfirst.co/cve/CVE-2026-102789/CVE-2026-102789Tue, 27 Oct 2026 10:16:53 GMTbalbooa.com · Gridbox extension for Joomla Not in CISA KEV. EPSS 0.3%. CVSS 9.3. Priority 12.5.CVE-2026-102788: Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages…https://patchfirst.co/cve/CVE-2026-102788/CVE-2026-102788Tue, 27 Oct 2026 10:16:53 GMTbalbooa.com · Gridbox extension for Joomla Not in CISA KEV. EPSS 0.4%. CVSS 9.3. Priority 14.1.CVE-2026-92885: The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all…https://patchfirst.co/cve/CVE-2026-92885/CVE-2026-92885Tue, 27 Oct 2026 09:16:34 GMTQode Themes · Qode Membership Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 14.6.CVE-2026-18450: The BMC does not correctly enforce integrity and encryption requirements for IPMI commandshttps://patchfirst.co/cve/CVE-2026-18450/CVE-2026-18450Tue, 27 Oct 2026 08:16:53 GMTSMCI · X12SPI Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 15.3.CVE-2026-116508: A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-116508/CVE-2026-116508Mon, 26 Oct 2026 22:16:54 GMTTOTOLINK · A950RG Not in CISA KEV. EPSS 0.6%. CVSS 10.0. Priority 18.4.CVE-2026-116506: A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-116506/CVE-2026-116506Mon, 26 Oct 2026 21:18:13 GMTTOTOLINK · A950RG Not in CISA KEV. EPSS 1.9%. CVSS 9.9. Priority 24.4.CVE-2026-116505: A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-116505/CVE-2026-116505Mon, 26 Oct 2026 21:18:12 GMTTOTOLINK · A950RG Not in CISA KEV. EPSS 2.7%. CVSS 9.1. Priority 25.2.CVE-2026-116504: A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-116504/CVE-2026-116504Mon, 26 Oct 2026 21:18:12 GMTTOTOLINK · A950RG Not in CISA KEV. EPSS 1.5%. CVSS 9.9. Priority 23.5.CVE-2026-110720: Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding…https://patchfirst.co/cve/CVE-2026-110720/CVE-2026-110720Mon, 26 Oct 2026 19:16:29 GMTHashiCorp · Tooling Not in CISA KEV. EPSS 0.4%. CVSS 9.9. Priority 19.4.CVE-2026-115915: vLLM is an inference and serving engine for large language modelshttps://patchfirst.co/cve/CVE-2026-115915/CVE-2026-115915Mon, 26 Oct 2026 18:17:38 GMTvllm-project · vllm Not in CISA KEV. EPSS 0.7%. CVSS 9.8. Priority 18.8.CVE-2026-10757: There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may…https://patchfirst.co/cve/CVE-2026-10757/CVE-2026-10757Mon, 26 Oct 2026 18:17:34 GMTEsri · ArcGIS Server Not in CISA KEV. EPSS 0.4%. CVSS 9.8. Priority 16.0.CVE-2026-102649: Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operatorhttps://patchfirst.co/cve/CVE-2026-102649/CVE-2026-102649Mon, 26 Oct 2026 18:17:21 GMTpadok-team · burrito Not in CISA KEV. EPSS 0.5%. CVSS 9.9. Priority 16.5.CVE-2026-116370: A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68https://patchfirst.co/cve/CVE-2026-116370/CVE-2026-116370Mon, 26 Oct 2026 17:17:25 GMT2K Games · Sid Meier's Civilization VI Not in CISA KEV. EPSS 0.4%. CVSS 9.6. Priority 20.0.CVE-2026-115905: zip is a zip library for Rust that supports reading and writing simple ZIP fileshttps://patchfirst.co/cve/CVE-2026-115905/CVE-2026-115905Mon, 26 Oct 2026 17:17:17 GMTzip-rs · zip2 Not in CISA KEV. EPSS 0.3%. CVSS 10.0. Priority 18.6.