CVEs in the news
Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
| CVE | Vulnerability | CVSS | Exploitation | EPSS | Articles | Seen |
|---|---|---|---|---|---|---|
| CVE-2026-112487 | Apple macOS vulnerabilityApple macOS | 7.8High | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-98432 | ipv4: free inet_opt and ireq_opt after an RCU grace periodLinux | 9.8Critical | Not in KEV | EPSS 0.5% | 8 articles | |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli | 9.2Critical | ExploitedDue 10 Nov | EPSS 83% | 22 articles | |
| CVE-2026-58984 | Google Android vulnerabilityGoogle Android | 8.4High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-58936 | Google Android vulnerabilityGoogle Android | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-58876 | Google Android vulnerabilityGoogle Android | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-58868 | Google Android vulnerabilityGoogle Android | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-55283 | Google Android vulnerabilityGoogle Android | 8.4High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-55275 | Google Android vulnerabilityGoogle Android | 8.4High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-64618 | Apache Fineract: SQL injection vulnerability in Search APIApache Software Foundation Apache Fineract | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-114364 | Apache Syncope: SQL injection via unsanitized opEvent in Audit Events searchApache Software Foundation Apache Syncope | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-113687 | Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypassApache Software Foundation Apache Syncope | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-111959 | Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds readsApache Software Foundation Apache Arrow Rust | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-88811 | Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxySUSE Rancher | 9.1Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-88809 | Rancher meta proxy allowlist bypass leading to server-side request forgerySUSE Rancher | 7.6High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-104623 | Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management clusterSUSE Rancher | 6.3Medium | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-99185 | firewire: core: fix race condition in split transaction handlingLinux | 8.8High | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-99170 | namespace: a mount that copy_tree() leaves out can't take over a lockLinux | 8.8High | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2026-99154 | scsi: libiscsi: Reject a negative task index from parse_pdu_ittLinux | 9.8Critical | Not in KEV | EPSS 0.5% | 1 article | |
| CVE-2026-99153 | scsi: libiscsi: Validate the ITT reflected in a Reject PDULinux | 9.8Critical | Not in KEV | EPSS 0.6% | 1 article | |
| CVE-2026-99152 | scsi: libiscsi: Validate the task named by a management responseLinux | 7.5High | Not in KEV | EPSS 0.5% | 1 article | |
| CVE-2026-58115 | Siemens SIMATIC IoT2050 Advanced vulnerabilitySiemens SIMATIC IoT2050 Advanced | 10.0Critical | Not in KEV | EPSS 0.9% | 2 articles | |
| CVE-2026-63286 | Axis Communications AB AXIS Camera Station Pro vulnerabilityAxis Communications AB AXIS Camera Station Pro | 7.1High | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2025-30026 | Axis Communications AB AXIS Camera Station Pro vulnerabilityAxis Communications AB AXIS Camera Station Pro | 5.3Medium | Not in KEV | EPSS 0.7% | 1 article | |
| CVE-2025-30023 | Axis Communications AB AXIS Camera Station Pro vulnerabilityAxis Communications AB AXIS Camera Station Pro | 9.0Critical | Not in KEV | EPSS 0.6% | 1 article | |
| CVE-2026-91141 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-90975 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115893 | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance wasmtime | 9.9Critical | Not in KEV | EPSS 1.0% | 3 articles | |
| CVE-2026-115889 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance wasmtime | 9.9Critical | Not in KEV | EPSS 0.5% | 3 articles | |
| CVE-2026-106378 | Google Chrome vulnerabilityGoogle Chrome | 8.3High | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-40217 | BerriAI LiteLLM vulnerabilityBerriAI LiteLLM | 8.8High | Not in KEV | EPSS 16% | 2 articles | |
| CVE-2026-116606 | Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security GatewayBarracuda Networks Barracuda Email Security Gateway (ESG) | 9.3Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-111560 | OS Command Injection in Barracuda AppliancesBarracuda Networks Barracuda Email Security Gateway (ESG) | 8.6High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-93680 | Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS | 9.8Critical | Not in KEV | EPSS 2.2% | 1 article | |
| CVE-2026-110193 | Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS | 8.8High | Not in KEV | EPSS 0.8% | 1 article | |
| CVE-2026-110192 | Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS | 6.5Medium | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-110186 | Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS | 9.8Critical | Not in KEV | EPSS 0.6% | 1 article | |
| CVE-2026-104339 | Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS | 9.8Critical | Not in KEV | EPSS 0.8% | 1 article | |
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityIvanti Connect Secure | Unrated | ExploitedDue 13 Nov | EPSS – | 8 articles | |
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityIvanti Connect Secure | 7.0High | Exploited | EPSS 0.5% | 8 articles | |
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityIvanti Connect Secure | 8.6High | Exploited | EPSS 87% | 21 articles | |
| CVE-2026-20118 | Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service VulnerabilityCisco IOS XR Software | 6.8Medium | Not in KEV | EPSS 0.3% | 2 articles | |
| CVE-2026-20051 | Cisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service VulnerabilityCisco NX-OS Software | 7.4High | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-120281 | WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflowWAVLINK WN536AX6-A | 10.0Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-20563 | MediaTek, Inc. MediaTek chipset vulnerabilityMediaTek, Inc. MediaTek chipset | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-20562 | MediaTek, Inc. MediaTek chipset vulnerabilityMediaTek, Inc. MediaTek chipset | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-20552 | MediaTek, Inc. MediaTek chipset vulnerabilityMediaTek, Inc. MediaTek chipset | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-20499 | MediaTek, Inc. MediaTek chipset vulnerabilityMediaTek, Inc. MediaTek chipset | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Software | 8.6High | Exploited | EPSS 0.8% | 7 articles | |
| CVE-2026-118539 | Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254Drupal Commerce Core | Unrated | Not in KEV | EPSS 0.3% | 6 articles |
No CVE on this page matches. Clear the filter, or search every CVE.
50 of 221 CVEs in the news this week · 391 exploited CVEs in the CISA KEV catalogue.
Next 50