CVEs in the news
Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
| CVE | Vulnerability | CVSS | Exploitation | EPSS | Articles | Seen |
|---|---|---|---|---|---|---|
| CVE-2026-118539 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-33096 | HTTP.sys Denial of Service VulnerabilityMicrosoft Windows 11 version 23H2 | 7.5High | Not in KEV | EPSS 1.3% | 3 articles | |
| CVE-2026-109619 | RCE via stale global statePHP Group PHP | 9.2Critical | ExploitedDue today | EPSS 99.9% | 52 articles | |
| CVE-2026-109618 | RCE via OOM corruptionPHP Group PHP | 9.2Critical | ExploitedDue today | EPSS 99.9% | 53 articles | |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLabGitLab | 10.0Critical | Not in KEV | EPSS 18% | 10 articles | |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write VulnerabilityApple iOS and iPadOS | 8.8High | Exploited | EPSS 26% | 17 articles | |
| CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Software | 8.6High | Not in KEV | EPSS 0.6% | 3 articles | |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCisco Catalyst SD-WAN Controller and Manager | 10.0Critical | Exploited | EPSS 89% | 24 articles | |
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 8.6High | Exploited | EPSS 1.0% | 8 articles | |
| CVE-2026-59310 | Broadcom VMware vCenter Path Traversal VulnerabilityBroadcom VMware vCenter | 9.8Critical | Exploited | EPSS 2.6% | 12 articles | |
| CVE-2026-59309 | vCenter authentication-bypass vulnerabilityVMware Cloud Foundation | 9.8Critical | Not in KEV | EPSS 0.6% | 6 articles | |
| CVE-2026-41709 | ESX insufficient logging vulnerabilityVMware Cloud Foundation | 2.7Low | ExploitedDue 11 Nov | EPSS 0.3% | 6 articles | |
| CVE-2026-46300 | net: skbuff: preserve shared-frag marker during coalescingLinux | 7.8High | ExploitedDue in 2 days | EPSS 10% | 10 articles | |
| CVE-2026-116593 | Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpointApache Software Foundation Apache Kafka | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-112375 | Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigsApache Software Foundation Apache Kafka | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-110985 | Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredApache Software Foundation Apache Kafka | Unrated | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2026-110952 | Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaultApache Software Foundation Apache Kafka | Unrated | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2026-116790 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-116785 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-116779 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-112353 | GFI KerioConnect < 10.0.8p2 Stored XSS via SVG AttachmentGFI USA, LLC GFI KerioConnect | 8.2High | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-115926 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115925 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-86400 | Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain | 9.8Critical | Not in KEV | EPSS 0.9% | 1 article | |
| CVE-2026-86397 | Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain | 9.8Critical | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-86384 | Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain | 9.8Critical | Not in KEV | EPSS 0.5% | 1 article | |
| CVE-2026-103799 | Dell PowerProtect Data Domain Management Center vulnerabilityDell PowerProtect Data Domain Management Center | 9.6Critical | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-103792 | Dell PowerProtect Data Domain Management Center vulnerabilityDell PowerProtect Data Domain Management Center | 9.6Critical | Not in KEV | EPSS 0.4% | 1 article | |
| CVE-2026-103780 | Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain | 9.8Critical | Not in KEV | EPSS 0.8% | 1 article | |
| CVE-2026-54512 | jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationFasterXML jackson-databind | 8.1High | Not in KEV | EPSS 0.9% | 1 article | |
| CVE-2026-110879 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)FasterXML jackson-databind | 9.8Critical | Not in KEV | EPSS 1.2% | 1 article | |
| CVE-2026-97631 | Pre-boot RCE in EDK II PXE driverTianoCore EDK2 | 9.5Critical | Not in KEV | EPSS 0.5% | 4 articles | |
| CVE-2026-117617 | Jenkins Project Jenkins vulnerabilityJenkins Project Jenkins | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-117616 | Jenkins Project Jenkins vulnerabilityJenkins Project Jenkins | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-117615 | Jenkins Project Jenkins vulnerabilityJenkins Project Jenkins | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-117614 | Jenkins Project Jenkins vulnerabilityJenkins Project Jenkins | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-117613 | Jenkins Project Jenkins vulnerabilityJenkins Project Jenkins | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-117612 | Jenkins Project Jenkins vulnerabilityJenkins Project Jenkins | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-16812 | Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityArista VeloCloud Orchestrator | 10.0Critical | Exploited | EPSS 1.0% | 9 articles | |
| CVE-2024-39717 | Versa Director Dangerous File Type Upload VulnerabilityVersa Director | 6.6Medium | Exploited | EPSS 4.0% | 1 article | |
| CVE-2024-34102 | XXE can expose crypt key and other secrets granting full admin accessAdobe Commerce and Magento Open Source | 9.8Critical | Exploited | EPSS 99.9% | 1 article | |
| CVE-2026-45495 | Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge (Chromium-based) | 8.8High | Not in KEV | EPSS 1.0% | 1 article | |
| CVE-2026-45494 | Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge (Chromium-based) | 5.4Medium | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-45492 | Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge (Chromium-based) | 5.4Medium | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-98432 | ipv4: free inet_opt and ireq_opt after an RCU grace periodLinux | 9.8Critical | Not in KEV | EPSS 0.4% | 2 articles | |
| CVE-2026-116690 | MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version sourcemlflow | 7.5High | Not in KEV | EPSS 0.6% | 2 articles | |
| CVE-2026-101767 | Oracle Corporation Oracle Application Object Library vulnerabilityOracle Corporation Oracle Application Object Library | 9.8Critical | Not in KEV | EPSS 0.6% | 5 articles | |
| CVE-2026-103409 | Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessedJuniper Networks Session Smart Router | 9.8Critical | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-103406 | Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.Juniper Networks Session Smart Conductor | 9.8Critical | Not in KEV | EPSS 0.5% | 1 article | |
| CVE-2026-116692 | MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modulesmlflow | 9.8Critical | Not in KEV | EPSS 0.7% | 1 article |
No CVE on this page matches. Clear the filter, or search every CVE.
50 of 199 CVEs in the news this week · 387 exploited CVEs in the CISA KEV catalogue.
Next 50