Weekly digest · in progress
Week 42, 2026 (12–18 Oct)
No new CVEs landed this week so far. 27 existing records changed (re-scores, KEV additions, exploit evidence).
0
New CVEs
0
Critical
0
KEV additions
27
Records changed
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901EnvoyProxy Envoy Missing HTTP URL path normalizationseverity, cvss56
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2026-34910A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.epss, kev89
- CVE-2026-73570A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabledepss88
- CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directoriesepss78
- CVE-2026-66066Action Pack is a framework for handling and responding to web requestsepss70
- CVE-2026-94503Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.exploit_available67
- CVE-2025-69872DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by defaultexploit_available66