CVE Watch: 542 New Vulnerabilities in 24 Hours, 2 Rated Critical
Our daily count of new CVE records for October 1, 2026, with the highest-rated flaws and the vendors that appear most.
Key points
- 542 new CVE records in 24 hours.
- 19 rated 8.0+, 2 critical.
- Table lists the highest-rated records.
The CVE Program published 542 new vulnerability records in the past 24 hours. Of those, our monitoring logged 19 rated 8.0 or higher on the CVSS scale, including 2 rated critical (9.0 or above).
At a glance
- New CVEs (24h)
- 542
- CVSS 8.0+
- 19
- Critical (9.0+)
- 2
Which vendors appear most?
Among the high-severity records, the most frequent vendors were TryGhost (7), n8n-io (3), Apache Software Foundation (2), tornadoweb (2), VillaTheme (1), Unlimited Elements (1).
What should defenders do with this?
Volume alone is not risk. Prioritise records for products you run, anything listed as exploited by CISA, and internet-facing systems. The table lists the highest-rated new records.
Highest-rated new CVEs
| CVE | Product | CVSS |
|---|---|---|
| CVE-2026-103244 | sgoudelis ground-station | 9.3 |
| CVE-2026-103264 | fleetdm fleet | 9.3 |
| CVE-2026-103262 | tornadoweb tornado | 8.7 |
| CVE-2026-103268 | TryGhost Ghost | 8.7 |
| CVE-2026-103271 | TryGhost Ghost | 8.7 |
| CVE-2026-103272 | TryGhost Ghost | 8.7 |
| CVE-2026-88789 | Apache Software Foundation Apache Camel Quarkus | 8.6 |
| CVE-2026-103277 | TryGhost Ghost | 8.6 |
| CVE-2026-103283 | TryGhost Ghost | 8.6 |
| CVE-2026-102379 | VillaTheme BuildKit – Product Builder for WooCommer | 8.5 |
How we counted
We counted records marked new in the CVE Program's public delta log in the 24 hours to 13:28 UTC on October 01, 2026. Severity figures cover records whose publisher supplied a CVSS score of 8.0 or more; records without a score are counted in the total only.
What to do and how to stay safe
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many new CVEs were published in the last 24 hours?
542, by our count of the public data.
