MediaWiki

Weekly CVE Report Tracks 2,652 New Flaws and Seven Exploited Vulnerabilities (Sept. 28 – Oct. 4, 2026) Weekly CVE report on exploited vulnerabilities from Daily Cybersecurity and CISA KEV, September 28 to October 4, 2026

Weekly CVE report on exploited vulnerabilities from Daily Cybersecurity and CISA KEV, September 28 to October 4, 2026

Weekly CVE Report Tracks 2,652 New Flaws and Seven Exploited Vulnerabilities (Sept. 28 – Oct. 4, 2026)

Do Son October 5, 2026

Researchers published 2,652 new CVEs between September 28 and October 4, 2026. This weekly CVE report, built...

MediaWiki External Data CVE-2026-100382 (CVSS 10) Unauthenticated RCE Exploited in the Wild, PoC Public MediaWiki External Data RCE CVE-2026-100382 exploited in the wild

MediaWiki External Data RCE CVE-2026-100382 exploited in the wild

MediaWiki External Data CVE-2026-100382 (CVSS 10) Unauthenticated RCE Exploited in the Wild, PoC Public

Do Son October 1, 2026

TL;DR Attackers are exploiting a MediaWiki RCE flaw tracked as CVE-2026-100382. This CVSS 10 unauthenticated RCE sits...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2014-125131CVSS 5.1
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by...
Watchtower Verified📅 Updated: Oct 21, 2026
CVE-2015-20124CVSS 8.7
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers...
Watchtower Verified📅 Updated: Oct 21, 2026
CVE-2016-20102CVSS 5.1
JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying...
Watchtower Verified📅 Updated: Oct 21, 2026
CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 21, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 21, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 21, 2026
CVE-2026-66373CVSS 7.5
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution...
Admin intel📅 Updated: Oct 20, 2026
CVE-2026-96652CVSS 5.3
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a...
CISA KEV📅 Added to KEV: Oct 20, 2026

CVE-2026-113613CVSS 9.2
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write...
📅 Updated: Oct 21, 2026
CVE-2026-113802CVSS 9.3
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos...
📅 Updated: Oct 21, 2026
CVE-2026-83862CVSS 9.8
Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over a network.
📅 Updated: Oct 21, 2026
CVE-2026-113788CVSS 9.4
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh`...
📅 Updated: Oct 21, 2026
CVE-2026-111852CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite...
📅 Updated: Oct 21, 2026
CVE-2026-111832CVSS 10.0
Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web...
📅 Updated: Oct 21, 2026
CVE-2026-111834CVSS 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a...
📅 Updated: Oct 21, 2026
CVE-2026-109618CVSS 9.2
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request....
📅 Updated: Oct 21, 2026