Skip to content

CVEs in the news

Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
165CVEs this week26in CISA KEV3federal deadlines
50 of 165 CVEs in the news this week
CVEs in the news: All recent, sorted by most recent
CVEVulnerabilityCVSSExploitationEPSSArticlesSeen
CVE-2026-86990Apple iOS and iPadOS vulnerabilityApple iOS and iPadOSUnratedNot in KEVEPSS –1 article
CVE-2026-86950Apple Multiple Products Out-of-Bounds Write VulnerabilityApple iOS and iPadOS8.8HighExploitedEPSS 26%14 articles
CVE-2026-28864Apple iOS and iPadOS vulnerabilityApple iOS and iPadOS3.3LowNot in KEVEPSS 0.2%1 article
CVE-2026-112424Apple macOS vulnerabilityApple macOSUnratedNot in KEVEPSS –1 article
CVE-2026-112414Apple iOS and iPadOS vulnerabilityApple iOS and iPadOSUnratedNot in KEVEPSS –1 article
CVE-2026-112410Apple macOS vulnerabilityApple macOSUnratedNot in KEVEPSS –1 article
CVE-2026-109619RCE via stale global statePHP Group PHP9.2CriticalNot in KEVEPSS 99.9%40 articles
CVE-2026-109618RCE via OOM corruptionPHP Group PHP9.2CriticalNot in KEVEPSS 99.9%41 articles
CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe Commerce9.3CriticalNot in KEVEPSS 1.0%3 articles
CVE-2025-54236Adobe Commerce and Magento Improper Input Validation VulnerabilityAdobe Commerce and Magento9.1CriticalExploitedEPSS 95%4 articles
CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli9.2CriticalNot in KEVEPSS 36%12 articles
CVE-2026-110264GitLab vulnerabilityGitLab10.0CriticalNot in KEVEPSS 1.0%3 articles
CVE-2026-30612No description published yetVendor not yet named9.8CriticalNot in KEVEPSS 0.4%2 articles
CVE-2026-115893Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance wasmtime9.9CriticalNot in KEVEPSS 0.4%1 article
CVE-2026-115889Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance wasmtime9.9CriticalNot in KEVEPSS 0.5%1 article
CVE-2026-70197.NET and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET 10.0 installed on Linux8.1HighNot in KEVEPSS 0.8%2 articles
CVE-2026-114148No description published yetVendor not yet namedUnratedNot in KEVEPSS –2 articles
CVE-2026-102870ASP.NET Core Remote Code Execution VulnerabilityMicrosoft .NET 10.0 installed on Linux8.8HighNot in KEVEPSS 0.9%2 articles
CVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityAdobe Commerce10.0CriticalExploitedEPSS 4.0%8 articles
CVE-2026-115560No description published yetVendor not yet namedUnratedNot in KEVEPSS –5 articles
CVE-2026-95664Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsApache Software Foundation Apache CamelUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryApache Software Foundation Apache CamelUnratedNot in KEVEPSS 0.2%1 article
CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)Apache Software Foundation Apache CamelUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-94386Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token CacheApache Software Foundation Apache Camel4.8MediumNot in KEVEPSS –1 article
CVE-2026-90885Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was ResolvedApache Software Foundation Apache CamelUnratedNot in KEVEPSS –1 article
CVE-2026-71569No description published yetVendor not yet namedUnratedNot in KEVEPSS –1 article
CVE-2026-97229Integer Overflow or Wraparound in GitLabGitLab10.0CriticalNot in KEVEPSS 18%8 articles
CVE-2026-93577GitLab vulnerabilityGitLab9.9CriticalNot in KEVEPSS 0.6%2 articles
CVE-2026-89078GitLab vulnerabilityGitLab9.9CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-96656Plex Media Server External Control of File Name or Path VulnerabilityPlex Media Server8.6HighExploitedEPSS 1.8%6 articles
CVE-2026-96654Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityPlex Media Server6.9MediumExploitedEPSS 1.9%6 articles
CVE-2026-114625Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista Networks VeloCloud Orchestrator9.9CriticalExploitedEPSS 1.0%8 articles
CVE-2026-106173Fortinet FortiSIEM vulnerabilityFortinet FortiSIEM9.4CriticalNot in KEVEPSS 1.0%6 articles
CVE-2026-114125Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitesstorybookjs storybook8.6HighNot in KEVEPSS 0.4%1 article
CVE-2026-43501ipv6: rpl: reserve mac_len headroom when recompressed SRH growsLinux9.8CriticalNot in KEVEPSS 0.7%1 article
CVE-2026-113380Signal RingRTC vulnerabilitySignal RingRTC9.3CriticalNot in KEVEPSS 0.9%6 articles
CVE-2026-80841net/packet: defer vmalloc TX_RING free until skbs finishLinuxUnratedNot in KEVEPSS 0.2%1 article
CVE-2026-80521af_unix: Unlink scc_entry in unix_del_edge().Linux7.8HighNot in KEVEPSS 0.2%2 articles
CVE-2026-74753perf: Reject exited events as group leadersLinux7.8HighNot in KEVEPSS 0.1%1 article
CVE-2026-24834Kata Container to Guest micro VM privilege escalationkata-containers9.4CriticalNot in KEVEPSS 0.2%1 article
CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora Online - Built-in CODE Server9.2CriticalExploitedEPSS 12%7 articles
CVE-2026-63030WordPress Core Interpretation Conflict VulnerabilityWordPress Core9.8CriticalExploitedEPSS 11%15 articles
CVE-2026-42208BerriAI LiteLLM SQL Injection VulnerabilityBerriAI LiteLLM9.3CriticalExploitedEPSS 89%9 articles
CVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityWebPros cPanel & WHM and WP2 (WordPress Squared)9.8CriticalExploitedEPSS 99%16 articles
CVE-2026-35616Fortinet FortiClient EMS Improper Access Control VulnerabilityFortinet FortiClient EMS9.1CriticalExploitedEPSS 94%15 articles
CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall SMA1000 Appliances10.0CriticalExploitedEPSS 6.8%19 articles
CVE-2024-57727SimpleHelp Path Traversal VulnerabilitySimpleHelp9.1CriticalExploitedEPSS 97%3 articles
CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks PAN-OS7.8HighExploitedEPSS 95%27 articles
CVE-2025-64446Fortinet FortiWeb Path Traversal VulnerabilityFortinet FortiWeb9.4CriticalExploitedEPSS 91%2 articles
CVE-2026-113501LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice DismissalVendor not yet named3.1LowNot in KEVEPSS 0.2%1 article

50 of 165 CVEs in the news this week · 376 exploited CVEs tracked overall.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in