Weekly report — week 2026-41

Added to CISA KEV (confirmed exploitation)

• CVE-2015-3306Critical · 10.0KEVPublic exploitProFTPD Improper Access Control VulnerabilityOct 8, 2026
• CVE-2021-3199Critical · 9.8KEVONLYOFFICE Docs Server Path Traversal VulnerabilityOct 8, 2026
• CVE-2015-5477High · 7.5KEVPublic exploitISC BIND Data Processing Errors VulnerabilityOct 8, 2026
• CVE-2016-3081High · 8.1KEVPublic exploitApache Struts Command Injection VulnerabilityOct 8, 2026
• CVE-2023-22894Medium · 4.9KEVStrapi Cleartext Storage of Sensitive Information VulnerabilityOct 8, 2026

Critical CVEs published (KEV and highest EPSS first)

• CVE-2026-105110Critical · 9.8Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI ParameterEPSS 2.8%
• CVE-2026-21589Critical · 9.3Public exploith3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira...EPSS 2.8%
• CVE-2026-93674Critical · 9.8Public exploitLangflow OSS is affected by multiple vulnerabilitiesEPSS 2.7%
• CVE-2026-108576Critical · 10.0TOZED X300 IPPingDiagnostics process_ping os command injectionEPSS 2.5%
• CVE-2026-105484Critical · 10.0TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injectionEPSS 2.1%
• CVE-2026-107780Critical · 9.8Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format ParameterEPSS 2.1%
• CVE-2026-91140Critical · 9.6OS command injection in Progress Software Autonomous REST Connector GenAI AgentsEPSS 1.9%
• CVE-2026-106126Critical · 9.9Command InjectionEPSS 1.9%
• CVE-2026-107703Critical · 9.8@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertToEPSS 1.8%
• CVE-2026-108540Critical · 9.9OpenSpug File Transfer transfer os command injectionEPSS 1.7%
• CVE-2026-107704Critical · 9.8image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_formatEPSS 1.7%
• CVE-2026-107699Critical · 9.8ppt2png through 0.0.6 OS Command Injection via input and output pathsEPSS 1.5%
• CVE-2026-107459Critical · 9.8Openfind｜SecuShare Pro - OS Command InjectionEPSS 1.5%
• CVE-2026-104711Critical · 9.8Apache Struts: OGNL injection in the legacy RESTful action mapperEPSS 1.2%
• CVE-2026-105794Critical · 9.1MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLEPSS 1%
• CVE-2026-105793Critical · 9.1Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`EPSS 0.9%
• CVE-2026-88131Critical · 9.8Microsoft Dataverse Remote Code Execution VulnerabilityEPSS 0.8%
• CVE-2026-63688Critical · 10.0Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing…EPSS 0.8%
• CVE-2026-105284Critical · 10.0Totolink A3002MU Authentication Check boa sub_40FCFC improper authorizationEPSS 0.8%
• CVE-2026-107202Critical · 9.1CVE-2026-107202EPSS 0.8%

Biggest EPSS increases (30-day exploitation probability)

Nothing this week.

New public exploits and templates

Nothing this week.