CVEs in the news
Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
| CVE | Vulnerability | CVSS | Exploitation | EPSS | Articles | Seen |
|---|---|---|---|---|---|---|
| CVE-2026-115893 | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance wasmtime | 9.9Critical | Not in KEV | EPSS 0.4% | 2 articles | |
| CVE-2026-115889 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance wasmtime | 9.9Critical | Not in KEV | EPSS 0.5% | 2 articles | |
| CVE-2021-36260 | Hikvision Improper Input ValidationHikvision Security cameras web server | Unrated | Exploited | EPSS 99.8% | 4 articles | |
| CVE-2021-33045 | Dahua IP Camera Authentication Bypass VulnerabilityDahua IP Camera Firmware | 9.8Critical | Exploited | EPSS 99.5% | 2 articles | |
| CVE-2021-33044 | Dahua IP Camera Authentication Bypass VulnerabilityDahua IP Camera Firmware | 9.8Critical | Exploited | EPSS 99.9% | 6 articles | |
| CVE-2017-7921 | Hikvision Multiple Products Improper Authentication VulnerabilityHikvision Multiple Products | Unrated | Exploited | EPSS 99.9% | 10 articles | |
| CVE-2026-109619 | RCE via stale global statePHP Group PHP | 9.2Critical | ExploitedDue in 2 days | EPSS 99.9% | 42 articles | |
| CVE-2026-109618 | RCE via OOM corruptionPHP Group PHP | 9.2Critical | ExploitedDue in 2 days | EPSS 99.9% | 43 articles | |
| CVE-2026-86990 | Apple iOS and iPadOS vulnerabilityApple iOS and iPadOS | Unrated | Not in KEV | EPSS – | 2 articles | |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write VulnerabilityApple iOS and iPadOS | 8.8High | Exploited | EPSS 26% | 15 articles | |
| CVE-2026-65339 | Apple iOS and iPadOS vulnerabilityApple iOS and iPadOS | 5.0Medium | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2026-110720 | Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rulesHashiCorp Tooling | 9.9Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115193 | No description published yetVendor not yet named | 8.2High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115192 | No description published yetVendor not yet named | 7.1High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115191 | No description published yetVendor not yet named | 7.1High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115190 | No description published yetVendor not yet named | 8.0High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115189 | No description published yetVendor not yet named | 8.8High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115188 | No description published yetVendor not yet named | 9.9Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-93638 | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme ParameterZimbra Collaboration Suite | 6.1Medium | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-93634 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File RecordsZimbra Collaboration Suite | 4.3Medium | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-93633 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet CharactersZimbra Collaboration Suite | 5.4Medium | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-93631 | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account LinkingZimbra Collaboration Suite | 7.1High | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2026-50053 | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL ParametersZimbra Collaboration Suite | 8.7High | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-10632 | Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages ParameterZimbra Collaboration Suite | 8.7High | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-84570 | Apple macOS vulnerabilityApple macOS | 4.4Medium | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-84568 | Apple macOS vulnerabilityApple macOS | 7.8High | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli | 9.2Critical | Not in KEV | EPSS 36% | 13 articles | |
| CVE-2026-28864 | Apple iOS and iPadOS vulnerabilityApple iOS and iPadOS | 3.3Low | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-112424 | Apple macOS vulnerabilityApple macOS | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-112414 | Apple iOS and iPadOS vulnerabilityApple iOS and iPadOS | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-112410 | Apple macOS vulnerabilityApple macOS | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-48356 | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe Commerce | 9.3Critical | Not in KEV | EPSS 1.0% | 3 articles | |
| CVE-2025-54236 | Adobe Commerce and Magento Improper Input Validation VulnerabilityAdobe Commerce and Magento | 9.1Critical | Exploited | EPSS 95% | 4 articles | |
| CVE-2026-110264 | GitLab vulnerabilityGitLab | 10.0Critical | Not in KEV | EPSS 1.0% | 3 articles | |
| CVE-2026-30612 | No description published yetVendor not yet named | 9.8Critical | Not in KEV | EPSS 0.4% | 2 articles | |
| CVE-2026-70197 | .NET and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET 10.0 installed on Linux | 8.1High | Not in KEV | EPSS 0.8% | 2 articles | |
| CVE-2026-114148 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 2 articles | |
| CVE-2026-102870 | ASP.NET Core Remote Code Execution VulnerabilityMicrosoft .NET 10.0 installed on Linux | 8.8High | Not in KEV | EPSS 0.9% | 2 articles | |
| CVE-2026-75650 | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityAdobe Commerce | 10.0Critical | Exploited | EPSS 4.0% | 8 articles | |
| CVE-2026-115560 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 5 articles | |
| CVE-2026-95664 | Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsApache Software Foundation Apache Camel | Unrated | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-95663 | Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryApache Software Foundation Apache Camel | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-95628 | Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)Apache Software Foundation Apache Camel | Unrated | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-94386 | Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token CacheApache Software Foundation Apache Camel | 4.8Medium | Not in KEV | EPSS – | 1 article | |
| CVE-2026-90885 | Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was ResolvedApache Software Foundation Apache Camel | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-71569 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLabGitLab | 10.0Critical | Not in KEV | EPSS 18% | 8 articles | |
| CVE-2026-93577 | GitLab vulnerabilityGitLab | 9.9Critical | Not in KEV | EPSS 0.6% | 2 articles | |
| CVE-2026-89078 | GitLab vulnerabilityGitLab | 9.9Critical | Not in KEV | EPSS 0.5% | 2 articles | |
| CVE-2026-96656 | Plex Media Server External Control of File Name or Path VulnerabilityPlex Media Server | 8.6High | Exploited | EPSS 1.8% | 6 articles |
No CVE on this page matches. Clear the filter, or search every CVE.
50 of 182 CVEs in the news this week · 379 exploited CVEs in the CISA KEV catalogue.
Next 50