IT SBIT Services
Schneeberger
DEEN
CVE tracker

New vulnerabilities – clearly explained

Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.

1published today
3,136in the last 7 days
16,728in the last 30 days
263critical (7 days)
7newly exploited (7 days)
303with a public exploit (30 days)

New CVEs in the last 30 days by severity

  • Critical
  • High
  • Medium
  • Low
  • Not rated
01,0002,0003,000Mon, 5 Oct 2026: 405 CVE (Critical 31, High 119, Medium 210, Low 45)5 OctTue, 6 Oct 2026: 1,014 CVE (Critical 105, High 371, Medium 345, Low 38, Not rated 155)Wed, 7 Oct 2026: 340 CVE (Critical 53, High 131, Medium 145, Low 9, Not rated 2)Thu, 8 Oct 2026: 497 CVE (Critical 62, High 194, Medium 220, Low 21)Fri, 9 Oct 2026: 315 CVE (Critical 42, High 152, Medium 105, Low 11, Not rated 5)Sat, 10 Oct 2026: 412 CVE (Critical 78, High 143, Medium 178, Low 13)10 OctSun, 11 Oct 2026: 229 CVE (Critical 16, High 73, Medium 101, Low 39)Mon, 12 Oct 2026: 674 CVE (Critical 48, High 264, Medium 282, Low 80)Tue, 13 Oct 2026: 2,303 CVE (Critical 170, High 1,361, Medium 729, Low 43)Wed, 14 Oct 2026: 824 CVE (Critical 92, High 374, Medium 285, Low 30, Not rated 43)Thu, 15 Oct 2026: 546 CVE (Critical 51, High 232, Medium 244, Low 19)15 OctFri, 16 Oct 2026: 465 CVE (Critical 53, High 179, Medium 219, Low 14)Sat, 17 Oct 2026: 100 CVE (Critical 4, High 42, Medium 50, Low 4)Sun, 18 Oct 2026: 549 CVE (Critical 10, High 55, Medium 65, Low 19, Not rated 400)Mon, 19 Oct 2026: 437 CVE (Critical 29, High 128, Medium 204, Low 66, Not rated 10)Tue, 20 Oct 2026: 1,923 CVE (Critical 169, High 814, Medium 812, Low 127, Not rated 1)20 OctWed, 21 Oct 2026: 542 CVE (Critical 52, High 218, Medium 225, Low 47)Thu, 22 Oct 2026: 492 CVE (Critical 69, High 161, Medium 208, Low 54)Fri, 23 Oct 2026: 492 CVE (Critical 40, High 170, Medium 91, Low 27, Not rated 164)Sat, 24 Oct 2026: 73 CVE (Critical 12, High 20, Medium 35, Low 6)Sun, 25 Oct 2026: 131 CVE (Critical 4, High 35, Medium 66, Low 26)25 OctMon, 26 Oct 2026: 738 CVE (Critical 21, High 159, Medium 266, Low 57, Not rated 235)Tue, 27 Oct 2026: 648 CVE (Critical 69, High 188, Medium 177, Low 33, Not rated 181)Wed, 28 Oct 2026: 626 CVE (Critical 35, High 223, Medium 214, Low 31, Not rated 123)Thu, 29 Oct 2026: 537 CVE (Critical 69, High 198, Medium 221, Low 22, Not rated 27)Fri, 30 Oct 2026: 668 CVE (Critical 44, High 218, Medium 261, Low 30, Not rated 115)30 OctSat, 31 Oct 2026: 112 CVE (Critical 11, High 44, Medium 51, Low 1, Not rated 5)Sun, 1 Nov 2026: 98 CVE (Critical 8, High 24, Medium 27, Low 15, Not rated 24)Mon, 2 Nov 2026: 477 CVE (Critical 27, High 151, Medium 141, Low 19, Not rated 139)Tue, 3 Nov 2026: 1 CVE (High 1)3 Nov

Per day (UTC); hover over a bar for the figures.

Show as table
DayCriticalHighMediumLowNot ratedTotal
Tue, 3 Nov 2026010001
Mon, 2 Nov 20262715114119139477
Sun, 1 Nov 202682427152498
Sat, 31 Oct 202611445115112
Fri, 30 Oct 20264421826130115668
Thu, 29 Oct 2026691982212227537
Wed, 28 Oct 20263522321431123626
Tue, 27 Oct 20266918817733181648
Mon, 26 Oct 20262115926657235738
Sun, 25 Oct 202643566260131
Sat, 24 Oct 20261220356073
Fri, 23 Oct 2026401709127164492
Thu, 22 Oct 202669161208540492
Wed, 21 Oct 202652218225470542
Tue, 20 Oct 202616981481212711,923
Mon, 19 Oct 2026291282046610437
Sun, 18 Oct 202610556519400549
Sat, 17 Oct 20264425040100
Fri, 16 Oct 202653179219140465
Thu, 15 Oct 202651232244190546
Wed, 14 Oct 2026923742853043824
Tue, 13 Oct 20261701,3617294302,303
Mon, 12 Oct 202648264282800674
Sun, 11 Oct 20261673101390229
Sat, 10 Oct 202678143178130412
Fri, 9 Oct 202642152105115315
Thu, 8 Oct 202662194220210497
Wed, 7 Oct 20265313114592340
Tue, 6 Oct 2026105371345381551,014
Mon, 5 Oct 202631119210450405

3,136 vulnerabilities

CVE-2026-107027Not rated

Research and translation in progress – available shortly.

CVE-2026-107026High 7.5

Share to Clipboard: Improperly exported Android activity allows clipboard overwrite

Share to Clipboard for Android, version 1.14.1 (versionCode 32), exports an activity that is not protected by a permission. Any app installed on the same device can start it and silently replace the content of the system clipboard with its own text, without confirmation. The attacker cannot read the clipboard, and no code execution or privilege escalation is claimed. The risk is that a value a user pastes later, such as a password or customer data, has been replaced.

Tengu · Share to Clipboard

CVE-2026-107025High 7.5

WikiAndPad alpha/beta: Improper export of Android application component

WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) for Android exports a headless activity without a permission or caller check. Any app installed on the same device can append text to the app's snippet store and, according to the advisory, read the stored snippets back through the app's own list screen. The CVE record describes data export by an unauthorized attacker, with no user interaction needed. The NVD score of 7.5 conflicts with the VulDB rating, and the advisory's mechanism has not been independently confirmed.

Michael Butscher · WikiAndPad alpha/beta

CVE-2026-106036Medium 6.9

Research and translation in progress – available shortly.

CVE-2026-104339Critical 9.8

Langflow OSS: Code injection enables remote code execution

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an OS command injection flaw (CWE-94 per NVD, description matches CWE-78) that allows remote code execution on the server. According to the CVE record, an attacker needs no privileges and no user interaction, so the flaw is reachable over the network. The CVSS base score is 9.8 (critical), and the CVE was published on 29 October 2026.

IBM · Langflow OSS

CVE-2026-104328High 8.8

IBM Langflow OSS: Remote code execution via OS command injection

IBM Langflow OSS versions 1.0.0 through 1.12.3 do not properly neutralize special elements used in an OS command. A remote attacker with a valid, low-privileged account can execute arbitrary code on the server without user interaction, which may expose stored credentials such as API keys. Langflow listens on localhost by default, so the risk depends on how it is deployed and who can reach it.

IBM · Langflow OSS

CVE-2026-104317Critical 9.8

IBM Langflow OSS: Deserialization of untrusted data allows code execution

IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data from the message broker. A remote attacker who can reach the message broker can execute arbitrary code on the system. The NVD record rates the issue CVSS 9.8 (critical), but other sources rate it lower, so the score should be verified. No exploitation is known.

IBM · Langflow OSS

CVE-2026-103092High 8.8

IBM Langflow OSS: Arbitrary SQL command execution via improper access control

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an improper access control flaw that allows a remote attacker with a valid user account to execute arbitrary SQL commands. Successful exploitation could allow an attacker to read, modify or delete data in the underlying database. NVD lists a CVSS score of 8.8, while IBM lists 8.5 with a scope change for this CVE.

IBM · Langflow OSS

CVE-2026-102590High 7.7

IBM Langflow OSS: Server-side request forgery in authenticated API

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) flaw. A remote attacker with a low-privilege authenticated account can make the server send requests to other systems, which may expose sensitive information. The NVD and IBM CVSS scores differ, so check the current NVD record before relying on either score.

IBM · Langflow OSS

CVE-2026-101288High 8.8

Langflow OSS: Code injection leads to remote code execution

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a code injection flaw (CWE-94) caused by improper neutralization of special elements. A remote attacker with a valid low-privilege account can execute arbitrary code on the server, with high impact to confidentiality, integrity and availability (CVSS 8.8). The exact vulnerable component and trigger are not publicly described.

IBM · Langflow OSS

CVE-2025-13050Medium 5.4

Research and translation in progress – available shortly.

CVE-2026-97073Medium 5.3

Research and translation in progress – available shortly.

CVE-2026-80069Medium 5.3

Research and translation in progress – available shortly.

CVE-2026-80067Medium 5.3

Research and translation in progress – available shortly.

CVE-2026-54871Medium 5.3

Research and translation in progress – available shortly.

CVE-2026-54853Medium 5.3

Research and translation in progress – available shortly.

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed