CVEs in the news
Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
| CVE | Vulnerability | CVSS | Exploitation | EPSS | Articles | Seen |
|---|---|---|---|---|---|---|
| CVE-2026-118539 | Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254Drupal Commerce Core | Unrated | Not in KEV | EPSS – | 2 articles | |
| CVE-2026-92374 | Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOSTeamViewer Full Client | 7.8High | Not in KEV | EPSS 0.1% | 2 articles | |
| CVE-2026-92372 | Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code ExecutionTeamViewer Full Client | 8.8High | Not in KEV | EPSS 0.4% | 2 articles | |
| CVE-2026-111585 | Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer OverflowTeamViewer Full Client | 8.8High | Not in KEV | EPSS 0.3% | 2 articles | |
| CVE-2025-57819 | Sangoma FreePBX Authentication Bypass VulnerabilitySangoma FreePBX | 10.0Critical | Exploited | EPSS 95% | 2 articles | |
| CVE-2019-19006 | Sangoma FreePBX Improper Authentication VulnerabilitySangoma FreePBX | Unrated | Exploited | EPSS 56% | 3 articles | |
| CVE-2026-98432 | ipv4: free inet_opt and ireq_opt after an RCU grace periodLinux | 9.8Critical | Not in KEV | EPSS 0.4% | 4 articles | |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLabGitLab | 10.0Critical | ExploitedDue in 2 days | EPSS 18% | 12 articles | |
| CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Software | 8.6High | ExploitedDue in 2 days | EPSS 0.6% | 5 articles | |
| CVE-2026-118527 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-111357 | Ivanti Connect Secure vulnerabilityIvanti Connect Secure | 7.0High | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityIvanti Connect Secure | 8.6High | Exploited | EPSS 87% | 16 articles | |
| CVE-2026-90868 | OS Command Injection in Progress WS_FTP ServerProgress Software WS_FTP Server | 9.9Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-90866 | Virtual Folder Path Confinement Bypass in Progress WS_FTP ServerProgress Software WS_FTP Server | 9.1Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-90865 | Command Injection via FTP Notification Variables in Progress WS_FTP ServerProgress Software WS_FTP Server | 9.0Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-90864 | Host Administrator Path Containment Bypass in Progress WS_FTP ServerProgress Software WS_FTP Server | 9.1Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-90863 | Privilege Escalation via Missing Authorization in WS_FTP ManagerProgress Software WS_FTP Server | 9.1Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-84295 | Improper Authentication in Progress WS_FTP ServerProgress Software WS_FTP Server | 10.0Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-6877 | Domain Separation Bypass in ServiceNow AI PlatformServiceNow AI Platform | 5.3Medium | Not in KEV | EPSS – | 1 article | |
| CVE-2026-103094 | Cleartext Storage of OAuth Credentials in ServiceNow AI PlatformServiceNow AI Platform | 7.1High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-103093 | Sandbox Escape via Table Rotation in ServiceNow AI PlatformServiceNow AI Platform | 9.4Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-107239 | Veeam Management Pack for Microsoft System Center vulnerabilityVeeam Management Pack for Microsoft System Center | 8.8High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-107238 | Veeam Management Pack for Microsoft System Center vulnerabilityVeeam Management Pack for Microsoft System Center | 8.7High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-106076 | Veeam Backup for Microsoft 365 vulnerabilityVeeam Backup for Microsoft 365 | 9.0Critical | Not in KEV | EPSS 0.4% | 1 article | |
| CVE-2023-22793 | Veeam Management Pack for Microsoft System Center vulnerabilityVeeam Management Pack for Microsoft System Center | 9.3Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-76024 | Google Chrome vulnerabilityGoogle Chrome | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-105134 | Ahsay AhsayCBS Command Injection VulnerabilityAhsayCBS | 10.0Critical | Exploited | EPSS 82% | 8 articles | |
| CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication VulnerabilityAhsayCBS | 7.5High | Exploited | EPSS 79% | 9 articles | |
| CVE-2026-46300 | net: skbuff: preserve shared-frag marker during coalescingLinux | 7.8High | ExploitedDue tomorrow | EPSS 16% | 11 articles | |
| CVE-2026-41709 | ESX insufficient logging vulnerabilityVMware Cloud Foundation | 2.7Low | ExploitedDue 11 Nov | EPSS 0.8% | 7 articles | |
| CVE-2026-33096 | HTTP.sys Denial of Service VulnerabilityMicrosoft Windows 11 version 23H2 | 7.5High | Not in KEV | EPSS 1.3% | 3 articles | |
| CVE-2026-109619 | RCE via stale global statePHP Group PHP | 9.2Critical | Exploited | EPSS 99.9% | 52 articles | |
| CVE-2026-109618 | RCE via OOM corruptionPHP Group PHP | 9.2Critical | Exploited | EPSS 99.9% | 53 articles | |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write VulnerabilityApple iOS and iPadOS | 8.8High | Exploited | EPSS 26% | 17 articles | |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCisco Catalyst SD-WAN Controller and Manager | 10.0Critical | Exploited | EPSS 89% | 24 articles | |
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 8.6High | Exploited | EPSS 1.0% | 8 articles | |
| CVE-2026-59310 | Broadcom VMware vCenter Path Traversal VulnerabilityBroadcom VMware vCenter | 9.8Critical | Exploited | EPSS 2.6% | 12 articles | |
| CVE-2026-59309 | vCenter authentication-bypass vulnerabilityVMware Cloud Foundation | 9.8Critical | Not in KEV | EPSS 0.6% | 6 articles | |
| CVE-2026-116593 | Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpointApache Software Foundation Apache Kafka | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-112375 | Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigsApache Software Foundation Apache Kafka | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-110985 | Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredApache Software Foundation Apache Kafka | Unrated | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2026-110952 | Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaultApache Software Foundation Apache Kafka | Unrated | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2026-116790 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-116785 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-116779 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-112353 | GFI KerioConnect < 10.0.8p2 Stored XSS via SVG AttachmentGFI USA, LLC GFI KerioConnect | 8.2High | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-115926 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-115925 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-86400 | Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain | 9.8Critical | Not in KEV | EPSS 0.9% | 1 article | |
| CVE-2026-86397 | Dell PowerProtect Data Domain vulnerabilityDell PowerProtect Data Domain | 9.8Critical | Not in KEV | EPSS 0.3% | 1 article |
No CVE on this page matches. Clear the filter, or search every CVE.
50 of 208 CVEs in the news this week · 389 exploited CVEs in the CISA KEV catalogue.
Next 50