Daily digest · in progress
Thursday 15 October 2026
No new CVEs landed this day so far. 85 existing records changed (re-scores, KEV additions, exploit evidence).
0
New CVEs
0
Critical
0
KEV additions
85
Records changed
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2026-102554Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryErrorseverity, cvss, exploit_available57
- CVE-2026-107734SumatraPDF is a multi-format reader for Windowsseverity, cvss, exploit_available51
- CVE-2026-107735SumatraPDF is a multi-format reader for Windowsseverity, cvss, exploit_available42
- CVE-2023-27534A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indic…severity, cvss61
- CVE-2026-107378CairoSVG is an SVG converter based on Cairo, a 2D graphics librarycvss, exploit_available60
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2025-30237The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpointsseverity, cvss48
- CVE-2026-105672TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443severity, cvss48