Skip to content
Sign in

CVEs in the news

Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
208CVEs this week38in CISA KEV6federal deadlines
50 of 208 CVEs in the news this week
CVEs in the news: All recent, sorted by most recent
CVEVulnerabilityCVSSExploitationEPSSArticlesSeen
CVE-2026-20127Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCisco Catalyst SD-WAN Controller and Manager10.0CriticalExploitedEPSS 89%22 articles
CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescingLinux7.8HighExploitedDue in 2 daysEPSS 10%10 articles
CVE-2026-109619RCE via stale global statePHP Group PHP9.2CriticalExploitedDue todayEPSS 99.9%50 articles
CVE-2026-109618RCE via OOM corruptionPHP Group PHP9.2CriticalExploitedDue todayEPSS 99.9%51 articles
CVE-2026-115926No description published yetVendor not yet namedUnratedNot in KEVEPSS –1 article
CVE-2026-115925No description published yetVendor not yet namedUnratedNot in KEVEPSS –1 article
CVE-2026-86400Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain9.8CriticalNot in KEVEPSS 0.9%1 article
CVE-2026-86397Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain9.8CriticalNot in KEVEPSS 0.3%1 article
CVE-2026-86384Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain9.8CriticalNot in KEVEPSS 0.5%1 article
CVE-2026-103799Dell PowerProtect Data Domain Management Center vulnerabilityDell PowerProtect Data Domain Management Center9.6CriticalNot in KEVEPSS –1 article
CVE-2026-103792Dell PowerProtect Data Domain Management Center vulnerabilityDell PowerProtect Data Domain Management Center9.6CriticalNot in KEVEPSS –1 article
CVE-2026-103780Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain9.8CriticalNot in KEVEPSS –1 article
CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationFasterXML jackson-databind8.1HighNot in KEVEPSS 0.9%1 article
CVE-2026-110879jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)FasterXML jackson-databind9.8CriticalNot in KEVEPSS 1.2%1 article
CVE-2026-97631Pre-boot RCE in EDK II PXE driverTianoCore EDK29.5CriticalNot in KEVEPSS 0.5%4 articles
CVE-2026-117617Jenkins Project Jenkins vulnerabilityJenkins Project JenkinsUnratedNot in KEVEPSS –1 article
CVE-2026-117616Jenkins Project Jenkins vulnerabilityJenkins Project JenkinsUnratedNot in KEVEPSS –1 article
CVE-2026-117615Jenkins Project Jenkins vulnerabilityJenkins Project JenkinsUnratedNot in KEVEPSS –1 article
CVE-2026-117614Jenkins Project Jenkins vulnerabilityJenkins Project JenkinsUnratedNot in KEVEPSS –1 article
CVE-2026-117613Jenkins Project Jenkins vulnerabilityJenkins Project JenkinsUnratedNot in KEVEPSS –1 article
CVE-2026-117612Jenkins Project Jenkins vulnerabilityJenkins Project JenkinsUnratedNot in KEVEPSS –1 article
CVE-2026-41709ESX insufficient logging vulnerabilityVMware Cloud Foundation2.7LowExploitedDue 11 NovEPSS 0.3%4 articles
CVE-2026-97229Integer Overflow or Wraparound in GitLabGitLab10.0CriticalNot in KEVEPSS 18%9 articles
CVE-2026-76418Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Software8.6HighNot in KEVEPSS –1 article
CVE-2026-16812Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityArista VeloCloud Orchestrator10.0CriticalExploitedEPSS 1.0%9 articles
CVE-2024-39717Versa Director Dangerous File Type Upload VulnerabilityVersa Director6.6MediumExploitedEPSS 4.0%1 article
CVE-2024-34102XXE can expose crypt key and other secrets granting full admin accessAdobe Commerce and Magento Open Source9.8CriticalExploitedEPSS 99.9%1 article
CVE-2026-45495Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge (Chromium-based)8.8HighNot in KEVEPSS 1.0%1 article
CVE-2026-45494Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge (Chromium-based)5.4MediumNot in KEVEPSS 0.3%1 article
CVE-2026-45492Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge (Chromium-based)5.4MediumNot in KEVEPSS 0.3%1 article
CVE-2026-98432ipv4: free inet_opt and ireq_opt after an RCU grace periodLinux9.8CriticalNot in KEVEPSS 0.4%2 articles
CVE-2026-33096HTTP.sys Denial of Service VulnerabilityMicrosoft Windows 11 version 23H27.5HighNot in KEVEPSS 1.3%2 articles
CVE-2026-116690MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version sourcemlflow7.5HighNot in KEVEPSS 0.6%2 articles
CVE-2026-101767Oracle Corporation Oracle Application Object Library vulnerabilityOracle Corporation Oracle Application Object Library9.8CriticalNot in KEVEPSS 0.6%5 articles
CVE-2026-103409Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessedJuniper Networks Session Smart Router9.8CriticalNot in KEVEPSS –1 article
CVE-2026-103406Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.Juniper Networks Session Smart Conductor9.8CriticalNot in KEVEPSS –1 article
CVE-2026-116692MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modulesmlflow9.8CriticalNot in KEVEPSS 0.7%1 article
CVE-2026-46817Oracle E-Business Suite Improper Privilege Management VulnerabilityOracle E-Business Suite9.8CriticalExploitedEPSS 12%9 articles
CVE-2025-61882Oracle E-Business Suite Unspecified VulnerabilityOracle E-Business Suite9.8CriticalExploitedEPSS 99.7%8 articles
CVE-2026-118306Google Chrome vulnerabilityGoogle ChromeUnratedNot in KEVEPSS 0.2%2 articles
CVE-2026-115884No description published yetVendor not yet namedUnratedNot in KEVEPSS –3 articles
CVE-2026-115881No description published yetVendor not yet namedUnratedNot in KEVEPSS –3 articles
CVE-2026-111181body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodybody-parser7.5HighNot in KEVEPSS 0.4%1 article
CVE-2026-105781Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Campaign Classic10.0CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-105780Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)Adobe Campaign Classic9.9CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-105489Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Campaign Classic9.9CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-104353Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)Adobe Campaign Classic9.9CriticalNot in KEVEPSS 1.3%2 articles
CVE-2026-104351Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)Adobe Campaign Classic9.9CriticalNot in KEVEPSS 0.6%2 articles
CVE-2026-104350Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Campaign Classic9.3CriticalNot in KEVEPSS 0.6%1 article
CVE-2026-114598Access of resource using incompatible type ('type confusion') in EPICS BaseThe EPICS Community EPICS Base8.7HighNot in KEVEPSS 0.3%1 article

50 of 208 CVEs in the news this week · 387 exploited CVEs in the CISA KEV catalogue.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in