Emerging, not confirmed
Reported exploitation that has no CVE yet, or none we have confirmed. Treat as unverified until a CVE and a fixed version exist.
unconfirmed Arista patches new VeloCloud Orchestrator zero-day exploited in attacks Full Disclosure (seclists) · 2026-10-22 unconfirmed [0day-rubbish] TRENDnet TV-IP302PI firmware 1.02.38 authenticated NTP server-address OS command injection to root command execution via a shell-form system() call (7.2 High, PR:H) Cisco Talos · 2026-10-20 unconfirmed [0day-rubbish] Royal Render 9.1.26b: default-unauthenticated job submission on rrServer TCP 7773 reaches worker-side shell execution as the worker identity, measured root (8.1 High) Cisco Talos · 2026-10-20 unconfirmed [0day-rubbish] ProSoft Technology RLX-IFH24E v2.2.44 unsigned firmware upgrade package to root command execution and full account-database overwrite (7.2) Cisco Talos · 2026-10-20 unconfirmed [0day-rubbish] Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT anonymous deserialization in the database restore path to JSP command execution as uid=1000 (9.8) Cisco Talos · 2026-10-20 unconfirmed [0day-rubbish] Exasol Database 7.1.30 docker-db form: shipped default SYS credential to PYTHON3 UDF os.popen command execution as uid=500(exadefusr), output returned in-band (8.8) Cisco Talos · 2026-10-20 unconfirmed [0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the setWAN WAN-configuration handler, root command execution (7.2) Cisco Talos · 2026-10-20 unconfirmed [0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the formWlanMP manufacturing-test handler, root command execution (7.2) Cisco Talos · 2026-10-20 unconfirmed [0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5) Cisco Talos · 2026-10-15 unconfirmed [0day-rubbish] South River Technologies Titan MFT Server 26.0.0 first-run administrator setup chained to job post-command injection, NT AUTHORITY\SYSTEM (8.1) Cisco Talos · 2026-10-15 unconfirmed ZDI-26-756: (0Day) Genesis World load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability Mandiant · 2026-10-13 unconfirmed ZDI-26-755: (0Day) Genesis World glTF Server-Side Request Forgery Vulnerability Mandiant · 2026-10-13 unconfirmed ZDI-26-754: (0Day) Genesis World URDF Directory Traversal Information Disclosure Vulnerability Mandiant · 2026-10-13 unconfirmed ZDI-26-753: (0Day) Genesis World MJCF Directory Traversal Information Disclosure Vulnerability Mandiant · 2026-10-13 unconfirmed ZDI-26-752: (0Day) Genesis World decompress_usdz Directory Traversal Remote Code Execution Vulnerability Mandiant · 2026-10-13