Daily digest · in progress

Thursday 22 October 2026

A quiet day: only 254 new CVEs against a recent average of about 691 so far. Of those, 34 critical and 64 high. 25 arrived with exploitation evidence or public exploit code already attached. Drupal was the most-affected vendor with 72.

254

New CVEs

Critical

KEV additions

Records changed

New this day, ranked by depth score

The 12 that matter most of the 254 published.

MAL-2026-18176Critical⚠ Exploited

today

Most-changed records

Existing CVEs whose severity, score, KEV or exploitation status moved.

CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL pathsseverity, cvss37
CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
CVE-2014-6407Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.cvss42
CVE-2025-55654A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.severity, cvss, exploit_available42
CVE-2026-107081SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management Sys…severity, cvss66
CVE-2026-111958Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Tokenseverity, cvss41
CVE-2026-97328WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parserseverity, cvss41
CVE-2026-109927CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_roleseverity, cvss40

Most-affected vendors

By CVEs published in the period.

Thursday 22 October 2026

New this day, ranked by depth score

Malicious code in voxweaver (PyPI)

Malicious code in voicekit (PyPI)

Malicious code in vocabblend (PyPI)

Malicious code in vocabbench (PyPI)

Malicious code in ttsweaver (PyPI)

Malicious code in ttsprobe (PyPI)

Malicious code in ttsflow (PyPI)

Malicious code in ttsdock (PyPI)

Malicious code in speechprobe (PyPI)

Malicious code in speaksocket (PyPI)

Malicious code in speakbench (PyPI)

Malicious code in soundsocket (PyPI)

Most-changed records

Most-affected vendors