591 CVEs tracked today. 46 Critical, 175 High, 215 Medium, 32 Low.
-
CVE-2026-118690
CRITICAL
CVSS 9.3
Unauthenticated remote attackers can pull a ZIP of the Signal K Server log/config directory from the /skServer/ziplogs route in every signalk-server release before 2.33.0, and that archive contains security.json with the server's HS256 JWT signing key. Possession of the secretKey lets an attacker forge administrator tokens or create a persistent admin account and then authenticate through the normal login flow, yielding full control over NMEA routing, plugin configuration and alarms on affected installations, including vessel deployments. The endpoint was confirmed reachable without credentials on a live signalk-server 2.32.0 instance and roughly 66 potentially affected servers were visible to Shodan at disclosure; no public exploit identified at time of analysis, and the vendor addressed the issue in 2.33.0 by placing the route behind admin middleware.
Authentication Bypass
Signalk Server
Signalk
-
CVE-2026-118633
CRITICAL
CVSS 9.2
Remote code execution as root in Sophos UTM (SG UTM) affects all versions when the email proxy is used with scanning enabled; unauthenticated network attackers can exploit a path traversal flaw, but must win a race condition by sustaining repeated attacks for several minutes. The product is end-of-life and requires a manual patch, so exposure persists until an operator actively installs the vendor fix. No public exploit has been identified at time of analysis, and the priority decision is act_now based on the vendor report and assessed impact.
RCE
Path Traversal
Sophos
Sg Utm
-
CVE-2026-118375
CRITICAL
CVSS 9.2
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthenticated network peers corrupt the rpc-server stack by advertising RDMA support in the HELLO message and sending up to 256 KiB into a 1-byte stack variable, crashing the server or potentially enabling code execution. The input CVSS 4.0 score is 9.2 Critical and the vuln.today decision is act_now, but exploitation requires the opt-in llama.cpp rpc-server to be running with the non-default RDMA transport and reachable from the attacker, which is reflected in the independent CVSS 3.1 assessment as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified in the provided intelligence at time of analysis, and the vendor fix is available in build b11865.
Buffer Overflow
Memory Corruption
Llama Cpp
Ggml Org
-
CVE-2026-118264
CRITICAL
CVSS 9.1
Echo's Proxy middleware can forward later HTTP requests straight to the configured upstream without invoking Echo's router or route-specific middleware after a client WebSocket upgrade is rejected by that upstream with an ordinary keep-alive response. This affects Echo v4 releases from 4.0.0 through 4.16.0 and v5 releases from 5.0.0 through 5.4.0, and can let unauthenticated remote attackers reach upstream resources that rely solely on Echo route-level authentication or authorization. Exploitation is conditional-it needs a reachable proxy route, an upstream that keeps the connection alive after rejecting the upgrade, and a target with no independent upstream authorization-so the independent assessment rates it high severity with high attack complexity; fixed releases are 4.16.1 and 5.4.1, and no public exploit or CISA KEV entry was identified at time of analysis.
Authentication Bypass
Request Smuggling
-
CVE-2026-117626
CRITICAL
Jenkins core 2.587 and earlier, plus LTS 2.580.1 and earlier, are the affected versions for the security batch fixed in Jenkins 2.588 and LTS 2.580.2, but the individual defect tracked as CVE-2026-117626 is not described in any of the source material available here - the supplied oss-security post and the linked Jenkins advisory 2026-10-28 both cut off at CVE-2026-117622 (SECURITY-4249). Exploitation status, CVSS, CWE and impact for this specific ID are therefore unverified: no CISA KEV entry, no confirmed working public exploit code, and no EPSS score were provided, so it should be treated as an unresolved mapping gap within an actively maintained advisory rather than as a characterized vulnerability. Analysts should read the full advisory page directly before assigning severity or exposure for this CVE. As a family characteristic of the same advisory, the sibling issues require an authenticated Jenkins account holding permissions such as Overall/Read, Item/Configure, View/Configure or Agent/Configure, and are explicitly noted as not exploitable anonymously.
Path Traversal
Jenkins
-
CVE-2026-117625
CRITICAL
Jenkins core 2.587 and earlier, along with LTS 2.580.1 and earlier, are covered by the 2026-10-28 Jenkins security advisory, and the EUVD record for this CVE points to advisory section SECURITY-4206; that section's text is not included in the material supplied here, so the specific defect, its trigger, and its exact permission prerequisites for CVE-2026-117625 cannot be confirmed from available data. What is confirmed for the advisory as a whole is that every listed issue requires an authenticated, non-anonymous Jenkins user holding a permission such as Overall/Read, Item/Configure, View/Configure, or Agent/Configure, and that several of the batch lead to remote code execution or stored cross-site scripting on the controller. No public exploit code or confirmed active exploitation is identified in the supplied sources, and the priority decision remains awaiting data, so treatment should be driven by the confirmed availability of the 2.588 / LTS 2.580.2 fix rather than by an exploitation signal.
Information Disclosure
Jenkins
-
CVE-2026-117624
CRITICAL
Jenkins core 2.587 and earlier and Jenkins LTS 2.580.1 and earlier are covered by the vendor's 2026-10-28 security advisory, which bundles fixes for several distinct flaws into Jenkins 2.588 and LTS 2.580.2; the identifier CVE-2026-117624 does not appear anywhere in the supplied advisory text, so its specific defect, prerequisites and severity could not be verified from the available sources. The sibling issues that are described are not anonymously reachable - they require an authenticated account plus a Jenkins permission such as Overall/Read, Item/Configure, View/Configure, Agent/Configure or Item/Create - and several of them can end in code execution in the controller JVM or in cross-site scripting. No public exploit code and no CISA KEV entry were identified for this identifier, no EPSS score was supplied, and the priority label is awaiting_data; the vendor advisory at https://www.jenkins.io/security/advisory/2026-10-28/ is the authoritative reference.
Authentication Bypass
Jenkins
-
CVE-2026-117623
CRITICAL
CVE-2026-117623 is one of several vulnerabilities fixed in the Jenkins 2026-10-28 security advisory, remediated only by upgrading Jenkins core to 2.588 or LTS 2.580.2. Its specific description is not present in the available sources: the advisory text enumerates CVE-2026-117612 through CVE-2026-117622 and truncates mid-sentence at SECURITY-4249 / CVE-2026-117622, so no CVSS score, CVSS vector, CWE, or trigger mechanism for CVE-2026-117623 is confirmed from the supplied data. No public exploit code is identified at time of analysis, the CVE is not noted as confirmed actively exploited (CISA KEV), and EPSS is not available; the root cause class and whether the same authenticated, permission-gated prerequisites that apply to its sibling issues apply here remain unverified.
XSS
Jenkins
-
CVE-2026-117621
CRITICAL
Cross-site scripting in the Jenkins workspace browser lets an attacker who controls a build agent have script execute in the browser of a Jenkins user who opens the workspace listing for that agent. Only jobs whose workspace resides on an agent are affected, specifically Jenkins 2.587 and earlier and Jenkins LTS 2.580.1 and earlier, and the attacker must already control the agent process while a victim must actually view the workspace browser (assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N). The Jenkins advisory publishes no CVSS score or CWE for this item, there is no CISA KEV listing, no public exploit identified at time of analysis, and no EPSS data in the supplied sources.
XSS
Jenkins
-
CVE-2026-117620
CRITICAL
CVE-2026-117620 is one of the vulnerabilities covered by the Jenkins security advisory of 2026-10-28, fixed in Jenkins 2.588 and Jenkins LTS 2.580.2, but the supplied advisory text and oss-security post do not include a standalone description for this specific identifier. By contrast, the sibling CVEs detailed in the same bundle are permission-gated issues (XStream deserialization RCE under SECURITY-4125, stored XSS via crafted job config.xml under SECURITY-4225, command agent launcher RCE, symlink-based file read/write flaws, and an unvalidated agent-loading endpoint) and are not reported as actively exploited. The exact mechanism, impact, and required permissions for CVE-2026-117620 remain unconfirmed from the available sources; no public exploit code is identified for it and the decision label is awaiting_data.
Code Injection
Jenkins
-
CVE-2026-117619
CRITICAL
Jenkins core 2.587 and earlier, along with LTS 2.580.1 and earlier, are affected by CVE-2026-117619, one of eight security issues addressed in the Jenkins advisory dated 2026-10-28 and fixed in Jenkins 2.588 and LTS 2.580.2. The per-CVE description for this specific identifier is not present in the supplied advisory excerpt, so neither the vulnerability class nor the precise attacker impact can be stated from the available data - only the affected scope and the fixed versions are confirmed. Every other entry in the same advisory requires an authenticated user holding specific Jenkins permissions (Overall/Read, Item/Configure, View/Configure, Agent/Configure, Item/Create) rather than anonymous access, which suggests a similar privilege prerequisite is likely here, but that remains unverified. No public exploit code and no CISA KEV entry are associated with this identifier in the supplied intelligence, and the priority decision is awaiting_data.
Information Disclosure
Jenkins
-
CVE-2026-117618
CRITICAL
CVE-2026-117618 is one identifier in the Jenkins Security Advisory 2026-10-28 bundle, which fixes multiple Jenkins core vulnerabilities affecting Jenkins 2.587 and earlier and LTS 2.580.1 and earlier; the vendor-released patch is Jenkins 2.588 and LTS 2.580.2. The advisory excerpt available for this analysis enumerates SECURITY-4125/CVE-2026-117612 through SECURITY-4249/CVE-2026-117622 but does not include a description mapping SECURITY-4125 through SECURITY-4249 to the -117618 identifier, so the specific vulnerable component, attack vector, and required permissions for this CVE are unverified and must be read from the advisory page. No CISA KEV listing, no EPSS score, and no public exploit code were present in the supplied data, so exploitation status is no public exploit identified at time of analysis, and the vuln.today decision label remains awaiting_data. For the sibling issues in the same advisory, exploitation requires an authenticated foothold with configuration privileges (Overall/Read plus a non-anonymous account, Item/Configure, Agent/Configure, or Item/Create depending on the issue), and several of those siblings can lead to remote code execution on the controller.
Information Disclosure
Jenkins
-
CVE-2026-117617
CRITICAL
Arbitrary file write on the Jenkins controller is possible in Jenkins 2.587 and earlier and LTS 2.580.1 and earlier when an authenticated user with Item/Configure permission archives artifacts concurrently, such as from parallel Pipeline branches. The extraction code checks for symbolic links only before creating parent directories and permits symlinks in artifacts to replace existing files or empty directories, leaving a race before the final write; successful exploitation can overwrite files outside the intended directory and lead to remote code execution. No public exploit was identified at time of analysis, and the vendor fixed the issue in Jenkins 2.588 and LTS 2.580.2.
Information Disclosure
Jenkins
-
CVE-2026-117616
CRITICAL
Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, expose an HTTP endpoint that loads agents by name without validating the name; an authenticated user with Overall/Read permission can thereby load any config.xml on the controller as an agent configuration. This can replace an existing agent or define a new one, and because the name declared in that file controls where the configuration is written, saving the agent overwrites that config.xml and can potentially lead to arbitrary code execution. The vendor fixed this in Jenkins 2.588 and LTS 2.580.2; no public exploit was identified at time of analysis.
RCE
Jenkins
-
CVE-2026-117615
CRITICAL
Arbitrary file read on the Jenkins controller affects Jenkins 2.587 and earlier and Jenkins LTS 2.580.1 and earlier when an authenticated user with both Item/Create and Item/Configure renames an item whose directory contains a symbolic link, causing the copy fallback to follow the link and disclose file contents. The direct impact is confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); disclosed secrets can enable a contingent escalation to remote code execution. No public exploit identified at time of analysis, and the supplied data contains no EPSS score or CISA KEV entry.
Information Disclosure
Jenkins
-
CVE-2026-117614
CRITICAL
Arbitrary code execution in the Jenkins controller JVM is possible for users holding Agent/Configure permission on Jenkins 2.587 and earlier and LTS 2.580.1 and earlier, because legacy agent launch commands carried over from Jenkins core are converted into Command Agent Launcher Plugin launchers without verifying that an administrator approved the command. The issue affects builds from Jenkins 2.86 / LTS 2.89.1 onward, where that launch functionality moved into the plugin, and is resolved only by upgrading to Jenkins 2.588 or LTS 2.580.2; no separate configuration workaround is documented for this specific issue. Exploitation requires an authenticated account with the elevated Agent/Configure permission, so the practical blast radius depends on how broadly that permission is delegated in a given installation; no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis, and the vulnerability remains at an 'awaiting data' prioritization state.
RCE
Jenkins
-
CVE-2026-117613
CRITICAL
Stored cross-site scripting in Jenkins core 2.587 and earlier and LTS 2.580.1 and earlier allows an attacker who already holds Item/Configure permission (or an equivalent */Configure permission such as View/Configure or Agent/Configure) to submit a crafted job config.xml through the POST config.xml API, where XStream deserialization of collection elements with unchecked types leads to script injection that executes in the browser of another user who later views the affected page. The actor cannot be anonymous and must be authorized to configure items, and exploitation requires victim interaction, so the practical impact is scoped to cross-site scripting rather than direct server compromise; Jenkins rates the issue qualitatively as High while publishing no CVSS base vector. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV. Enforcing Content Security Policy, available on Jenkins 2.539/LTS 2.541.1 and newer, mitigates the known impact, and the flaw is fixed in Jenkins 2.588 and LTS 2.580.2.
XSS
Deserialization
Jenkins
-
CVE-2026-117612
CRITICAL
Deserialization of attacker-controlled XML in Jenkins 2.587 and earlier and LTS 2.580.1 and earlier can instantiate arbitrary types because the custom XStream converter does not apply the JEP-200 deserialization filter to classes referenced by the `resolves-to` attribute, potentially leading to remote code execution in the Jenkins controller JVM. Exploitation requires Overall/Read permission plus either a non-anonymous user account or a permission set that permits POSTing config.xml (Item/Configure, View/Configure, or Agent/Configure), so anonymous or account-less read access is insufficient. The issue is assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no CISA KEV entry, EPSS score, or public exploit reference was provided in the available intelligence, so no public exploit is identified at time of analysis.
Deserialization
Jenkins
-
CVE-2026-117574
CRITICAL
CVSS 9.1
AI Gateway Payload Processing allows an authenticated tenant to submit another tenant's model identifier, causing the service to inject the victim's LLM API keys and consume the victim's model resources and quotas; CVSS 3.1 score is 9.1 with scope change and high confidentiality impact. The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key) and requires a valid tenant account plus knowledge or guessing of the target model identifier. No public exploit identified at time of analysis, but the act_now priority label reflects the critical cross-tenant key exposure.
Authentication Bypass
-
CVE-2026-115968
CRITICAL
CVSS 9.8
PHP object injection in the Ultimate Member WordPress plugin through 2.13.1 allows unauthenticated remote attackers to pass untrusted serialized data into the plugin, carrying a CVSS 9.8 score and a vuln.today act_now priority. The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability without authentication or user interaction, but the exact endpoint, parameter, or feature that reaches unserialize() is not described in the available sources. No public exploit was identified at time of analysis and no KEV entry is present in the supplied data; practical impact depends on whether a usable POP gadget chain exists in the plugin or the surrounding WordPress/PHP environment, and the high-priority signal rests on limited sourcing.
WordPress
Deserialization
Ultimate Member
Wordpress Plugin