Skip to content
CVE Tracker

Week 42, 2026

12 October to 18 October 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
5,460
Critical
425
High
2,500
Added to KEV
9

Critical 425High 2,500Medium 1,972Low 120Not scored 443All 5,460 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2026-102764

    Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

    BeyondTrust · Remote Support

    ExploitedCritical9.3
  • CVE-2025-61624

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0…

    Fortinet · FortiOS

    ExploitedMedium5.4
  • CVE-2026-21589

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…

    Atlassian · Bamboo Data Center

    ExploitedCritical9.3
  • CVE-2026-105134

    Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

    Ahsay · AhsayCBS

    ExploitedCritical10.0
  • CVE-2026-76519

    Cisco Secure Email Gateway Arbitrary File Write Vulnerability

    Cisco · Cisco Secure Email

    ExploitedCritical9.8
  • CVE-2026-0322

    PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

    Palo Alto Networks · Cloud NGFW

    ExploitedHigh8.6
  • CVE-2026-105133

    Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

    Ahsay · AhsayCBS

    ExploitedMedium6.9
  • CVE-2026-96951

    Windows Shell Security Feature Bypass Vulnerability

    Microsoft · Microsoft Edge (Chromium-based)

    ExploitedHigh8.8
  • CVE-2026-104935

    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…

    Ivanti · Connect Secure

    ExploitedHigh8.6

Most severe new CVEsBy CVSS score

  • CVE-2026-97229

    Integer Overflow or Wraparound in GitLab

    GitLab · GitLab

    ExploitedCritical10.0
  • CVE-2026-94169

    WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

    Theme-one · The Grid

    Critical10.0
  • CVE-2026-110957

    Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection

    Wavlink · WL-WN530BE2-A

    Critical10.0
  • CVE-2026-110536

    D-Link DIR-868L HNAP CGI cgibin system os command injection

    D-Link · DIR-868L

    Critical10.0
  • CVE-2026-108804

    TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection

    TRENDnet · TEW-751DR

    Critical10.0
  • CVE-2026-109110

    Wavlink WL-WN592AX6 wmapd system os command injection

    Wavlink · WL-WN592AX6

    Critical10.0
  • CVE-2026-108918

    Edimax BR-6208AC formWlanMP command injection

    Edimax · BR-6208AC

    Critical10.0
  • CVE-2026-108917

    Edimax BR-6208AC formAutoFWupgrade command injection

    Edimax · BR-6208AC

    Critical10.0
  • CVE-2026-108907

    Netcore NR268 CGI Execution user_ok improper authentication

    Netcore · NR268

    Critical10.0
  • CVE-2026-103849

    Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

    Adobe · Adobe Commerce

    Critical10.0

Vendors with the most CVEs

  1. Microsoft1,441
  2. Linux484
  3. Adobe177
  4. Juniper Networks153
  5. frappe94
  6. IBM88
  7. Mozilla83
  8. Red Hat68
  9. FreeRDP62
  10. Gitea48

Most common weaknesses

  1. CWE-416 Use after free407
  2. CWE-122 Heap-based buffer overflow373
  3. CWE-79 Cross-site scripting (XSS)353
  4. CWE-125 Out-of-bounds read336
  5. CWE-862 Missing authorization304
  6. CWE-639 Authorization bypass through a user-controlled key (IDOR)193
  7. CWE-863 Incorrect authorization168
  8. CWE-89 SQL injection160
  9. CWE-22 Path traversal127
  10. CWE-787 Out-of-bounds write124