Skip to content

CVEs in the news

Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
179CVEs this week26in CISA KEV3federal deadlines
CVEs 51–100 of 179 in the news this week
CVEs in the news: All recent, sorted by most recent
CVEVulnerabilityCVSSExploitationEPSSArticlesSeen
CVE-2026-80841net/packet: defer vmalloc TX_RING free until skbs finishLinuxUnratedNot in KEVEPSS 0.2%1 article
CVE-2026-80521af_unix: Unlink scc_entry in unix_del_edge().Linux7.8HighNot in KEVEPSS 0.2%2 articles
CVE-2026-74753perf: Reject exited events as group leadersLinux7.8HighNot in KEVEPSS 0.1%1 article
CVE-2026-24834Kata Container to Guest micro VM privilege escalationkata-containers9.4CriticalNot in KEVEPSS 0.2%1 article
CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora Online - Built-in CODE Server9.2CriticalExploitedEPSS 12%7 articles
CVE-2026-63030WordPress Core Interpretation Conflict VulnerabilityWordPress Core9.8CriticalExploitedEPSS 11%15 articles
CVE-2026-42208BerriAI LiteLLM SQL Injection VulnerabilityBerriAI LiteLLM9.3CriticalExploitedEPSS 89%9 articles
CVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityWebPros cPanel & WHM and WP2 (WordPress Squared)9.8CriticalExploitedEPSS 99%16 articles
CVE-2026-35616Fortinet FortiClient EMS Improper Access Control VulnerabilityFortinet FortiClient EMS9.1CriticalExploitedEPSS 94%15 articles
CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall SMA1000 Appliances10.0CriticalExploitedEPSS 6.8%19 articles
CVE-2024-57727SimpleHelp Path Traversal VulnerabilitySimpleHelp9.1CriticalExploitedEPSS 97%3 articles
CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks PAN-OS7.8HighExploitedEPSS 95%27 articles
CVE-2025-64446Fortinet FortiWeb Path Traversal VulnerabilityFortinet FortiWeb9.4CriticalExploitedEPSS 91%2 articles
CVE-2026-113501LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice DismissalVendor not yet named3.1LowNot in KEVEPSS 0.2%1 article
CVE-2026-113500LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display OptimizationVendor not yet named7.5HighNot in KEVEPSS 0.3%1 article
CVE-2026-113499LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS RewritingVendor not yet named7.5HighNot in KEVEPSS 0.3%1 article
CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCEpython-pillow Pillow9.2CriticalNot in KEVEPSS 1.1%1 article
CVE-2026-112393Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOpython-pillow Pillow9.2CriticalNot in KEVEPSS 0.8%1 article
CVE-2026-93952Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityArista VeloCloud Orchestrator10.0CriticalExploitedEPSS 1.4%6 articles
CVE-2026-16812Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityArista VeloCloud Orchestrator10.0CriticalExploitedEPSS 1.0%8 articles
CVE-2026-77185Apache MINA SSHD: Asynchronous authentication can bypass signature verificationApache Software Foundation Apache MINA SSHD9.1CriticalNot in KEVEPSS 0.4%1 article
CVE-2026-75595Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextnetty9.1CriticalNot in KEVEPSS 0.3%2 articles
CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsApache Software Foundation Apache Tomcat9.1CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteApache Software Foundation Apache Tomcat9.8CriticalNot in KEVEPSS 0.6%2 articles
CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraintApache Software Foundation Apache Tomcat9.1CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-115547Command Execution via Admin Console Input in Okta Access GatewayOkta Access Gateway9.1CriticalNot in KEVEPSS 0.5%1 article
CVE-2026-115546Authentication Source Verification Issue in Okta Access GatewayOkta Access Gateway8.1HighNot in KEVEPSS 0.4%1 article
CVE-2026-91403Oracle Corporation Oracle Java SE vulnerabilityOracle Corporation Oracle Java SE9.1CriticalNot in KEVEPSS 0.3%2 articles
CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityFortinet FortiOS6.5MediumExploitedEPSS 6.6%1 article
CVE-2026-79852Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS (AOS)9.8CriticalNot in KEVEPSS 0.6%1 article
CVE-2026-79848Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)10.0CriticalNot in KEVEPSS 0.7%1 article
CVE-2026-79847Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)10.0CriticalNot in KEVEPSS 0.8%1 article
CVE-2026-79846Unauthenticated Command Injection Vulnerabilities in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)10.0CriticalNot in KEVEPSS 1.4%1 article
CVE-2026-79844Authentication Bypass Leading to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)10.0CriticalNot in KEVEPSS 0.7%1 article
CVE-2026-114509Laravel TokenGuard authentication bypass through non-string API credentialslaravel framework9.2CriticalNot in KEVEPSS 0.7%2 articles
CVE-2025-41450Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2Danfoss AK-SM 8xxA Series8.2HighNot in KEVEPSS 0.9%5 articles
CVE-2026-107663No description published yetVendor not yet namedUnratedNot in KEVEPSS –1 article
CVE-2022-21894Microsoft Windows 10 Version 1809 vulnerabilityMicrosoft Windows 10 Version 18094.4MediumNot in KEVEPSS 6.8%2 articles
CVE-2026-44850Portainer: Bind-mount restriction bypass via HostConfig.Mountsportainer8.5HighNot in KEVEPSS 0.2%1 article
CVE-2026-44849Portainer: Endpoint security bypass via Swarm service create/updateportainer9.4CriticalNot in KEVEPSS 0.4%1 article
CVE-2026-76474Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication VulnerabilitiesCisco Emergency Responder9.8CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-76473Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.Cisco Emergency Responder9.8CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-76466Cisco Expressway Series Remote Code Execution VulnerabilityCisco TelePresence Video Communication Server (VCS) Expressway9.8CriticalNot in KEVEPSS 0.4%2 articles
CVE-2026-12523Resource exhaustion in quiche HTTP/3 and QPACK layersCloudflare quiche7.5HighNot in KEVEPSS 0.5%2 articles
CVE-2025-64702quic-go HTTP/3 QPACK Header Expansion DoSquic-go5.3MediumNot in KEVEPSS 0.9%2 articles
CVE-2025-13945Improperly Controlled Sequential Memory Allocation in WiresharkWireshark Foundation Wireshark5.5MediumNot in KEVEPSS 0.2%2 articles
CVE-2026-76531Files or Directories Accessible to External Parties in Splunk SOARSplunk SOARUnratedNot in KEVEPSS 0.4%1 article
CVE-2026-76298Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk EnterpriseSplunk Enterprise8.8HighNot in KEVEPSS 0.3%1 article
CVE-2026-76293Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk EnterpriseSplunk Enterprise7.2HighNot in KEVEPSS 0.5%1 article
CVE-2026-76291Improper Access Control through Scheduled Search Safeguards in Splunk EnterpriseSplunk Enterprise8.8HighNot in KEVEPSS 0.4%1 article

CVEs 51–100 of 179 in the news this week · 376 exploited CVEs tracked overall.

First page
CyberSIXTSignal over noise
Updated AboutDevelopersSign in