Week 41, 2026

5 October to 11 October 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 3,211
Critical: 373
High: 1,170
Added to KEV: 5

Critical 373High 1,170Medium 1,381Low 125Not scored 162All 3,211 in the list

Added to KEVAttackers use these now; patch them first

CVE-2015-3306
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Product not named
ExploitedCritical10.0
CVE-2021-3199
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an…
Product not named
ExploitedCritical9.8
CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…
Product not named
ExploitedHigh8.1
CVE-2015-5477
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon…
Product not named
ExploitedHigh7.5
CVE-2023-22894
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can…
Product not named
ExploitedHigh7.2

Most severe new CVEsBy CVSS score

CVE-2026-108576
TOZED X300 IPPingDiagnostics process_ping os command injection
TOZED · X300
Critical10.0
CVE-2026-105484
TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
TOTOLINK · X6000R
Critical10.0
CVE-2026-102255
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path,…
SonicWall · SMA1000
Critical10.0
CVE-2026-105284
Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization
Totolink · A3002MU
Critical10.0
CVE-2026-96207
Microsoft Partner Center Elevation of Privilege Vulnerability
Microsoft · Microsoft Partner Center
Critical10.0
CVE-2026-105285
Totolink A3002MU QoS Rule formIpQoS stack-based overflow
Totolink · A3002MU
Critical10.0
CVE-2025-70518
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user…
Product not named
Critical10.0
CVE-2026-63688
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the…
Dell · Dell Container Storage Modules (CSM)
Critical10.0
CVE-2026-32579
WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability
kognetiks · Kognetiks Chatbot for WordPress
Critical10.0
CVE-2026-105857
Payload: RCE in Payload Form Builder
payloadcms · payload
Critical10.0

Week 41, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses