Week 40, 2026

28 September to 4 October 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 2,531
Critical: 315
High: 1,070
Added to KEV: 6

Critical 315High 1,070Medium 1,039Low 106Not scored 1All 2,531 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-88779
Memory overflow vulnerability leading to Denial of Service
NetScaler · ADC
ExploitedHigh8.7
CVE-2026-102489
Undisclosed RCE in Zammad v6.3 and higher
Zammad GmbH · Zammad
ExploitedHigh8.7
CVE-2026-102490
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
Zammad GmbH · Zammad
ExploitedHigh8.5
CVE-2026-104286
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0…
Fortinet · FortiMail
ExploitedCritical9.8
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedCritical9.8
CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1,…
Apple · iOS and iPadOS
ExploitedHigh8.8

Most severe new CVEsBy CVSS score

CVE-2026-105134
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
Ahsay · AhsayCBS
ExploitedCritical10.0
CVE-2026-101001
Netcore NBR200V2 Web Management network_tools eval os command injection
Netcore · NBR200V2
Critical10.0
CVE-2026-103956
Missing authentication for critical function in Loom for AWS
AWS · loom
Critical10.0
CVE-2026-101075
Netcore NR289-GE Location Time location_time.cgi system os command injection
Netcore · NR289-GE
Critical10.0
CVE-2026-102240
Netcore NAP930 Network Tools CGI network_tools eval os command injection
Netcore · NAP930
Critical10.0
CVE-2026-101076
Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection
Netcore · NR289-GE
Critical10.0
CVE-2026-101072
Netcore NR289-GE CGI ap_ip.cgi system os command injection
Netcore · NR289-GE
Critical10.0
CVE-2026-102427
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
ordasoft.com · OrdaSoft Joomla CCK
Critical10.0
CVE-2026-55107
Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
elct9620 · kobako
Critical10.0
CVE-2026-105135
InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection
InternLM · MindSearch
Critical10.0

Week 40, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses