Zammad

Weekly CVE Report Tracks 2,652 New Flaws and Seven Exploited Vulnerabilities (Sept. 28 – Oct. 4, 2026) Weekly CVE report on exploited vulnerabilities from Daily Cybersecurity and CISA KEV, September 28 to October 4, 2026

Weekly CVE report on exploited vulnerabilities from Daily Cybersecurity and CISA KEV, September 28 to October 4, 2026

Weekly CVE Report Tracks 2,652 New Flaws and Seven Exploited Vulnerabilities (Sept. 28 – Oct. 4, 2026)

Do Son October 5, 2026

Researchers published 2,652 new CVEs between September 28 and October 4, 2026. This weekly CVE report, built...

Zammad Zero-Day Chain CVE-2026-102489 Exploited in the Wild in AI-Driven DIVD Breach Zammad zero-day CVE-2026-102489 CVE-2026-102490 exploited in DIVD breach

Zammad zero-day CVE-2026-102489 CVE-2026-102490 exploited in DIVD breach

Zammad Zero-Day Chain CVE-2026-102489 Exploited in the Wild in AI-Driven DIVD Breach

Do Son October 2, 2026

TL;DR Attackers chained two Zammad zero-day flaws to break into the Dutch Institute for Vulnerability Disclosure (DIVD)...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2017-20287CVSS 8.7
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2017-20288CVSS 5.1
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2017-20289CVSS 7.7
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 22, 2026
CVE-2026-109619CVSS 9.2
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not...
Admin intel📅 Updated: Oct 22, 2026
CVE-2026-109618CVSS 9.2
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request....
Admin intel📅 Updated: Oct 22, 2026

CVE-2026-115324CVSS 9.2
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by...
📅 Updated: Oct 22, 2026
CVE-2021-48016CVSS 9.3
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written...
📅 Updated: Oct 22, 2026
CVE-2021-48014CVSS 9.3
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write...
📅 Updated: Oct 22, 2026
CVE-2026-112327CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows...
📅 Updated: Oct 22, 2026
CVE-2026-112241CVSS 9.8
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a...
📅 Updated: Oct 22, 2026
CVE-2026-15143CVSS 9.3
A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to...
📅 Updated: Oct 22, 2026
CVE-2026-114220CVSS 9.3
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a...
📅 Updated: Oct 22, 2026
CVE-2026-114219CVSS 9.1
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded...
📅 Updated: Oct 22, 2026