IT SBIT Services
Schneeberger
DEEN
CVE tracker

New vulnerabilities – clearly explained

Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.

434published today
2,931in the last 7 days
16,818in the last 30 days
234critical (7 days)
6newly exploited (7 days)
289with a public exploit (30 days)

New CVEs in the last 30 days by severity

  • Critical
  • High
  • Medium
  • Low
  • Not rated
01,0002,0003,000Wed, 7 Oct 2026: 340 CVE (Critical 53, High 131, Medium 145, Low 9, Not rated 2)7 OctThu, 8 Oct 2026: 495 CVE (Critical 62, High 193, Medium 219, Low 21)Fri, 9 Oct 2026: 315 CVE (Critical 42, High 152, Medium 105, Low 11, Not rated 5)Sat, 10 Oct 2026: 412 CVE (Critical 78, High 143, Medium 178, Low 13)Sun, 11 Oct 2026: 229 CVE (Critical 16, High 73, Medium 101, Low 39)Mon, 12 Oct 2026: 674 CVE (Critical 48, High 264, Medium 282, Low 80)12 OctTue, 13 Oct 2026: 2,303 CVE (Critical 170, High 1,361, Medium 729, Low 43)Wed, 14 Oct 2026: 824 CVE (Critical 92, High 373, Medium 286, Low 30, Not rated 43)Thu, 15 Oct 2026: 546 CVE (Critical 51, High 232, Medium 244, Low 19)Fri, 16 Oct 2026: 465 CVE (Critical 53, High 179, Medium 219, Low 14)Sat, 17 Oct 2026: 100 CVE (Critical 4, High 42, Medium 50, Low 4)17 OctSun, 18 Oct 2026: 549 CVE (Critical 10, High 55, Medium 65, Low 19, Not rated 400)Mon, 19 Oct 2026: 437 CVE (Critical 32, High 133, Medium 206, Low 66)Tue, 20 Oct 2026: 1,923 CVE (Critical 169, High 815, Medium 811, Low 128)Wed, 21 Oct 2026: 542 CVE (Critical 52, High 218, Medium 225, Low 47)Thu, 22 Oct 2026: 492 CVE (Critical 69, High 162, Medium 207, Low 54)22 OctFri, 23 Oct 2026: 492 CVE (Critical 40, High 170, Medium 91, Low 27, Not rated 164)Sat, 24 Oct 2026: 73 CVE (Critical 12, High 20, Medium 35, Low 6)Sun, 25 Oct 2026: 131 CVE (Critical 4, High 35, Medium 66, Low 26)Mon, 26 Oct 2026: 738 CVE (Critical 32, High 252, Medium 369, Low 71, Not rated 14)Tue, 27 Oct 2026: 648 CVE (Critical 89, High 303, Medium 223, Low 33)27 OctWed, 28 Oct 2026: 626 CVE (Critical 41, High 238, Medium 228, Low 31, Not rated 88)Thu, 29 Oct 2026: 537 CVE (Critical 86, High 205, Medium 227, Low 19)Fri, 30 Oct 2026: 669 CVE (Critical 48, High 224, Medium 264, Low 32, Not rated 101)Sat, 31 Oct 2026: 112 CVE (Critical 11, High 44, Medium 51, Low 1, Not rated 5)Sun, 1 Nov 2026: 98 CVE (Critical 8, High 24, Medium 27, Low 15, Not rated 24)1 NovMon, 2 Nov 2026: 476 CVE (Critical 30, High 197, Medium 178, Low 20, Not rated 51)Tue, 3 Nov 2026: 723 CVE (Critical 60, High 256, Medium 290, Low 38, Not rated 79)Wed, 4 Nov 2026: 415 CVE (Critical 38, High 169, Medium 141, Low 34, Not rated 33)Thu, 5 Nov 2026: 434 CVE (Critical 38, High 164, Medium 100, Low 30, Not rated 102)5 Nov

Per day (UTC); hover over a bar for the figures.

Show as table
DayCriticalHighMediumLowNot ratedTotal
Thu, 5 Nov 20263816410030102434
Wed, 4 Nov 2026381691413433415
Tue, 3 Nov 2026602562903879723
Mon, 2 Nov 2026301971782051476
Sun, 1 Nov 202682427152498
Sat, 31 Oct 202611445115112
Fri, 30 Oct 20264822426432101669
Thu, 29 Oct 202686205227190537
Wed, 28 Oct 2026412382283188626
Tue, 27 Oct 202689303223330648
Mon, 26 Oct 2026322523697114738
Sun, 25 Oct 202643566260131
Sat, 24 Oct 20261220356073
Fri, 23 Oct 2026401709127164492
Thu, 22 Oct 202669162207540492
Wed, 21 Oct 202652218225470542
Tue, 20 Oct 202616981581112801,923
Mon, 19 Oct 202632133206660437
Sun, 18 Oct 202610556519400549
Sat, 17 Oct 20264425040100
Fri, 16 Oct 202653179219140465
Thu, 15 Oct 202651232244190546
Wed, 14 Oct 2026923732863043824
Tue, 13 Oct 20261701,3617294302,303
Mon, 12 Oct 202648264282800674
Sun, 11 Oct 20261673101390229
Sat, 10 Oct 202678143178130412
Fri, 9 Oct 202642152105115315
Thu, 8 Oct 202662193219210495
Wed, 7 Oct 20265313114592340

2,931 vulnerabilities

CVE-2026-107263Medium 5.4

Research and translation in progress – available shortly.

CVE-2026-107262Medium 5.3

Research and translation in progress – available shortly.

CVE-2026-107261Medium 4.2

Research and translation in progress – available shortly.

CVE-2026-107260Not rated

Research and translation in progress – available shortly.

CVE-2026-107259Medium 5.4

Research and translation in progress – available shortly.

CVE-2026-107258Medium 5.4

Research and translation in progress – available shortly.

CVE-2026-107257Medium 6.5

Drupal Actstream: Incorrect authorization in account configuration route

Drupal Actstream, a contributed module that aggregates external activity such as RSS feeds, has an incorrect authorization flaw in a configuration route. The route does not sufficiently check that the user editing it is the account owner or a user administrator. An attacker with a site account may be able to edit accounts they should not, which could enable account takeover or privilege changes. Only sites with Actstream installed are affected. The CVE text describes the issue as forceful browsing, but the Drupal advisory describes a missing ownership check, and this entry follows the advisory.

Drupal Security Team · Actstream

CVE-2026-107256Not rated

Research and translation in progress – available shortly.

CVE-2026-107255Not rated

Research and translation in progress – available shortly.

CVE-2026-107254Medium 4.8

Research and translation in progress – available shortly.

CVE-2026-107253Medium 5.9

Research and translation in progress – available shortly.

CVE-2026-107252Medium 5.4

Research and translation in progress – available shortly.

CVE-2026-107251Medium 6.5

Entity Reference Manager (Merge entities): Incorrect authorization in merge function

The Drupal contrib module Entity Reference Manager (Merge entities) up to version 1.0.3 (exclusive) contains an incorrect authorization flaw that allows forceful browsing. According to the Drupal advisory SA-CONTRIB-2026-194, users who can view content can reach the entity merge function and delete nodes, taxonomy terms or media entities. The CVSS score of 6.5 is based on NVD's preliminary analysis and may understate the impact.

Drupal · Entity Reference Manager (Merge entities)

CVE-2026-107250Medium 5.9

Research and translation in progress – available shortly.

CVE-2026-107249Critical 9.8

Drupal Block AJAX: PHP object injection via unvalidated block data

The Drupal contrib module Block AJAX (block_ajax) does not sufficiently validate user-supplied data it uses to construct a block. In the worst case, this can lead to PHP object injection and remote code execution. According to Drupal, the issue only affects sites with Layout Builder enabled or another block plugin that handles the data unsafely; the authentication requirements are not yet confirmed.

Drupal · Block AJAX

CVE-2026-91920Medium 6.5

Undertow: HTTP request smuggling via chunk-size overflow in ChunkReader

A flaw in the ChunkReader component of the Undertow web server, which handles chunked transfer encoding, allows a crafted 15-digit chunk size to bypass the size check. An attacker can make the server end a request body early and treat the remaining data as a second, smuggled request. Exploitation requires specific TCP segmentation control, and the CVSS score is 6.5 (Medium). Red Hat rates the issue Moderate.

Red Hat · Undertow

CVE-2026-74915High 8.8

Graphics DDK: Out-of-bounds write in GPU GLES user-space library

Imagination's Graphics DDK, a GPU driver development kit, contains an out-of-bounds read and/or write in the GPU GLES user-space shared library. A web page with unusual WebGPU content loaded into the GPU render process can trigger it and crash that process. On certain platforms where the graphics process runs with system privileges, this could enable further exploits on the device. The CVSS vector should be verified with the vendor before relying on the score.

Imagination Technologies · Graphics DDK

CVE-2026-74912Critical 9.8

Imagination Graphics DDK: Integer truncation limits GPU buffer mapping

A kernel-mode GPU driver bug in the Imagination Graphics DDK (PowerVR) causes integer truncation when mapping GPU buffer pages in the 0 to 4 GB range. This produces mapping errors and limits driver functionality, and it appears on systems where the fix for CVE-2026-49746 is applied. The sources describe functional breakage rather than code execution or data disclosure, and the CVSS score of 9.8 in the request is not supported by the sources.

Imagination Technologies · Graphics DDK

CVE-2026-65587Medium 5.5

Research and translation in progress – available shortly.

CVE-2026-65586High 7.1

Research and translation in progress – available shortly.

CVE-2026-65584High 7.8

Research and translation in progress – available shortly.

CVE-2026-19199High 7.1

Research and translation in progress – available shortly.

CVE-2026-18629High 7.5

Research and translation in progress – available shortly.

CVE-2026-15466High 7.0

Research and translation in progress – available shortly.

CVE-2026-118475Low 3.6

Research and translation in progress – available shortly.

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed