Skip to content

CVEs in the news

Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
179CVEs this week26in CISA KEV3federal deadlines
CVEs 101–150 of 179 in the news this week
CVEs in the news: All recent, sorted by most recent
CVEVulnerabilityCVSSExploitationEPSSArticlesSeen
CVE-2026-76290Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk EnterpriseSplunk Enterprise7.5HighNot in KEVEPSS 0.5%1 article
CVE-2026-76288Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk EnterpriseSplunk Enterprise7.5HighNot in KEVEPSS 0.5%1 article
CVE-2026-76524Open Source Snort 3 Control Channel Socket Aribitrary Command Execution VulnerabilityCisco Open Source Snort37.8HighNot in KEVEPSS 0.2%1 article
CVE-2026-76445Multiple Cisco Products Snort 3 Denial of Service VulnerabilityCisco Open Source Snort35.3MediumNot in KEVEPSS 0.5%1 article
CVE-2026-20221Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service VulnerabilitiesCisco Cyber Vision5.8MediumNot in KEVEPSS 0.6%1 article
CVE-2026-20043Multiple Cisco Products Snort 3 Software Hardening Release: October 2026Cisco Cyber Vision9.0CriticalNot in KEVEPSS 0.4%1 article
CVE-2026-20011Multiple Cisco Products Snort 3 SMTP MIME Denial of Service VulnerabilityCisco Open Source Snort35.8MediumNot in KEVEPSS 0.5%1 article
CVE-2026-9547SSH improper host validationcurl7.4HighNot in KEVEPSS 0.4%1 article
CVE-2026-101781Oracle Corporation MySQL Server vulnerabilityOracle Corporation MySQL Server8.8HighNot in KEVEPSS 0.3%1 article
CVE-2025-15467OpenSSL vulnerabilityOpenSSL8.8HighNot in KEVEPSS 75%5 articles
CVE-2026-86249Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.authApache Software Foundation Apache bRPCUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-86147Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprofApache Software Foundation Apache bRPCUnratedNot in KEVEPSS 0.2%1 article
CVE-2026-86146Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header ParsingApache Software Foundation Apache bRPCUnratedNot in KEVEPSS 0.2%1 article
CVE-2026-84747Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path SegmentsApache Software Foundation Apache bRPCUnratedNot in KEVEPSS 0.2%1 article
CVE-2026-78334Apache bRPC: Missing Authentication for Streaming RPC FramesApache Software Foundation Apache bRPCUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-48830Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsApache Software Foundation Apache bRPCUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-76487Cisco Unified Communications Manager Improper Access Control VulnerabilityCisco Unified Communications Manager5.3MediumNot in KEVEPSS 0.6%1 article
CVE-2026-82078PaperCut NG/MF Unsafe Reflection VulnerabilityPaperCut NG/MF9.4CriticalExploitedEPSS 61%22 articles
CVE-2026-81578PaperCut NG/MF Missing Authentication for Critical Function VulnerabilityPaperCut NG/MF8.8HighExploitedEPSS 84%23 articles
CVE-2026-111813Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationApache Software Foundation Apache Traffic Server10.0CriticalNot in KEVEPSS 0.5%1 article
CVE-2026-76497Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Expressway6.6MediumNot in KEVEPSS 0.2%1 article
CVE-2026-76490Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Expressway8.6HighNot in KEVEPSS 0.4%1 article
CVE-2026-76435Cisco Expressway Series Information Disclosure VulnerabilityCisco TelePresence Video Communication Server (VCS) Expressway5.3MediumNot in KEVEPSS 0.4%1 article
CVE-2026-59229Apache IoTDB: Legacy Pipe Privilege EscalationApache Software Foundation Apache IoTDBUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-58663Apache IoTDB: Auth Bypass in pipeTransfer() interfaceApache Software Foundation Apache IoTDBUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-105945Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package StorageApache Software Foundation Apache Pulsar7.7HighNot in KEVEPSS 0.5%1 article
CVE-2026-105944Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of lifeApache Software Foundation Apache Pulsar Manager10.0CriticalNot in KEVEPSS 0.7%1 article
CVE-2026-105937Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic dataApache Software Foundation Apache Pulsar8.7HighNot in KEVEPSS 0.2%1 article
CVE-2026-105869Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user roleApache Software Foundation Apache Pulsar9.2CriticalNot in KEVEPSS 0.3%1 article
CVE-2026-15723GitLab vulnerabilityGitLab8.2HighNot in KEVEPSS 0.4%1 article
CVE-2026-112212GitLab vulnerabilityGitLab7.5HighNot in KEVEPSS 0.2%1 article
CVE-2026-82814Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injectionsmub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More8.8HighNot in KEVEPSS 0.7%1 article
CVE-2026-106069nodejs node vulnerabilitynodejs nodeUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-105483nodejs node vulnerabilitynodejs nodeUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-105482nodejs node vulnerabilitynodejs nodeUnratedNot in KEVEPSS 0.4%1 article
CVE-2026-113470Cryptographic issue in the Security Block-lists, Allow-lists, and other State componentMozilla Firefox5.4MediumNot in KEVEPSS 0.5%2 articles
CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509Go standard library crypto/x509UnratedNot in KEVEPSS 0.3%3 articles
CVE-2026-101809Oracle Corporation Workflow vulnerabilityOracle Corporation Workflow10.0CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-101808Oracle Corporation Oracle Product Workbench vulnerabilityOracle Corporation Oracle Product Workbench9.1CriticalNot in KEVEPSS 0.4%1 article
CVE-2026-101767Oracle Corporation Oracle Application Object Library vulnerabilityOracle Corporation Oracle Application Object Library9.8CriticalNot in KEVEPSS 0.6%2 articles
CVE-2026-101634Oracle Corporation Oracle Mobile Field Service vulnerabilityOracle Corporation Oracle Mobile Field Service9.1CriticalNot in KEVEPSS 0.6%1 article
CVE-2026-111862Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious CodeRankMath Rank Math SEO PRO9.8CriticalNot in KEVEPSS 0.7%3 articles
CVE-2026-10795UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpcdavidanderson UpdraftPlus: WP Backup & Migration Plugin8.1HighNot in KEVEPSS 4.3%2 articles
CVE-2026-90800Apache CouchDB: Auth bypass in prefixed _users and _replicator databasesApache Software Foundation Apache CouchDB8.1HighNot in KEVEPSS 0.6%1 article
CVE-2026-90799Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence valuesApache Software Foundation Apache CouchDB1.3LowNot in KEVEPSS 0.6%1 article
CVE-2026-90797Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionApache Software Foundation Apache CouchDB7.7HighNot in KEVEPSS 0.7%1 article
CVE-2026-86471Apache CouchDB: Admin credentials leading to code execution as operating system userApache Software Foundation Apache CouchDB9.3CriticalNot in KEVEPSS 0.6%1 article
CVE-2026-108089Apache Cocoon: Unauthenticated access to diagnostic interfacesApache Software Foundation Apache Cocoon7.5HighNot in KEVEPSS 0.5%1 article
CVE-2026-107755Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLsApache Software Foundation Apache CouchDB6.0MediumNot in KEVEPSS 0.6%1 article
CVE-2026-92262MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.MariaDB server9.9CriticalNot in KEVEPSS 1.4%1 article

CVEs 101–150 of 179 in the news this week · 376 exploited CVEs tracked overall.

First page
CyberSIXTSignal over noise
Updated AboutDevelopersSign in