Skip to content

CVEs in the news

Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
182CVEs this week30in CISA KEV3federal deadlines
50 of 182 CVEs in the news this week
CVEs in the news: All recent, sorted by most recent
CVEVulnerabilityCVSSExploitationEPSSArticlesSeen
CVE-2026-115893Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance wasmtime9.9CriticalNot in KEVEPSS 0.4%2 articles
CVE-2026-115889Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance wasmtime9.9CriticalNot in KEVEPSS 0.5%2 articles
CVE-2021-36260Hikvision Improper Input ValidationHikvision Security cameras web serverUnratedExploitedEPSS 99.8%4 articles
CVE-2021-33045Dahua IP Camera Authentication Bypass VulnerabilityDahua IP Camera Firmware9.8CriticalExploitedEPSS 99.5%2 articles
CVE-2021-33044Dahua IP Camera Authentication Bypass VulnerabilityDahua IP Camera Firmware9.8CriticalExploitedEPSS 99.9%6 articles
CVE-2017-7921Hikvision Multiple Products Improper Authentication VulnerabilityHikvision Multiple ProductsUnratedExploitedEPSS 99.9%10 articles
CVE-2026-109619RCE via stale global statePHP Group PHP9.2CriticalNot in KEVEPSS 99.9%42 articles
CVE-2026-109618RCE via OOM corruptionPHP Group PHP9.2CriticalNot in KEVEPSS 99.9%43 articles
CVE-2026-86990Apple iOS and iPadOS vulnerabilityApple iOS and iPadOSUnratedNot in KEVEPSS –2 articles
CVE-2026-86950Apple Multiple Products Out-of-Bounds Write VulnerabilityApple iOS and iPadOS8.8HighExploitedEPSS 26%15 articles
CVE-2026-65339Apple iOS and iPadOS vulnerabilityApple iOS and iPadOS5.0MediumNot in KEVEPSS 0.1%1 article
CVE-2026-110720Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rulesHashiCorp Tooling9.9CriticalNot in KEVEPSS –1 article
CVE-2026-115193No description published yetVendor not yet named8.2HighNot in KEVEPSS –1 article
CVE-2026-115192No description published yetVendor not yet named7.1HighNot in KEVEPSS –1 article
CVE-2026-115191No description published yetVendor not yet named7.1HighNot in KEVEPSS –1 article
CVE-2026-115190No description published yetVendor not yet named8.0HighNot in KEVEPSS –1 article
CVE-2026-115189No description published yetVendor not yet named8.8HighNot in KEVEPSS –1 article
CVE-2026-115188No description published yetVendor not yet named9.9CriticalNot in KEVEPSS –1 article
CVE-2026-93638Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme ParameterZimbra Collaboration Suite6.1MediumNot in KEVEPSS 0.2%1 article
CVE-2026-93634Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File RecordsZimbra Collaboration Suite4.3MediumNot in KEVEPSS 0.2%1 article
CVE-2026-93633Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet CharactersZimbra Collaboration Suite5.4MediumNot in KEVEPSS 0.2%1 article
CVE-2026-93631Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account LinkingZimbra Collaboration Suite7.1HighNot in KEVEPSS 0.1%1 article
CVE-2026-50053Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL ParametersZimbra Collaboration Suite8.7HighNot in KEVEPSS 0.3%1 article
CVE-2026-10632Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages ParameterZimbra Collaboration Suite8.7HighNot in KEVEPSS 0.3%1 article
CVE-2026-84570Apple macOS vulnerabilityApple macOS4.4MediumNot in KEVEPSS 0.2%1 article
CVE-2026-84568Apple macOS vulnerabilityApple macOS7.8HighNot in KEVEPSS 0.2%1 article
CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli9.2CriticalNot in KEVEPSS 36%13 articles
CVE-2026-28864Apple iOS and iPadOS vulnerabilityApple iOS and iPadOS3.3LowNot in KEVEPSS 0.2%1 article
CVE-2026-112424Apple macOS vulnerabilityApple macOSUnratedNot in KEVEPSS –1 article
CVE-2026-112414Apple iOS and iPadOS vulnerabilityApple iOS and iPadOSUnratedNot in KEVEPSS –1 article
CVE-2026-112410Apple macOS vulnerabilityApple macOSUnratedNot in KEVEPSS –1 article
CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe Commerce9.3CriticalNot in KEVEPSS 1.0%3 articles
CVE-2025-54236Adobe Commerce and Magento Improper Input Validation VulnerabilityAdobe Commerce and Magento9.1CriticalExploitedEPSS 95%4 articles
CVE-2026-110264GitLab vulnerabilityGitLab10.0CriticalNot in KEVEPSS 1.0%3 articles
CVE-2026-30612No description published yetVendor not yet named9.8CriticalNot in KEVEPSS 0.4%2 articles
CVE-2026-70197.NET and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET 10.0 installed on Linux8.1HighNot in KEVEPSS 0.8%2 articles
CVE-2026-114148No description published yetVendor not yet namedUnratedNot in KEVEPSS –2 articles
CVE-2026-102870ASP.NET Core Remote Code Execution VulnerabilityMicrosoft .NET 10.0 installed on Linux8.8HighNot in KEVEPSS 0.9%2 articles
CVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityAdobe Commerce10.0CriticalExploitedEPSS 4.0%8 articles
CVE-2026-115560No description published yetVendor not yet namedUnratedNot in KEVEPSS –5 articles
CVE-2026-95664Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsApache Software Foundation Apache CamelUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryApache Software Foundation Apache CamelUnratedNot in KEVEPSS 0.2%1 article
CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)Apache Software Foundation Apache CamelUnratedNot in KEVEPSS 0.3%1 article
CVE-2026-94386Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token CacheApache Software Foundation Apache Camel4.8MediumNot in KEVEPSS –1 article
CVE-2026-90885Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was ResolvedApache Software Foundation Apache CamelUnratedNot in KEVEPSS –1 article
CVE-2026-71569No description published yetVendor not yet namedUnratedNot in KEVEPSS –1 article
CVE-2026-97229Integer Overflow or Wraparound in GitLabGitLab10.0CriticalNot in KEVEPSS 18%8 articles
CVE-2026-93577GitLab vulnerabilityGitLab9.9CriticalNot in KEVEPSS 0.6%2 articles
CVE-2026-89078GitLab vulnerabilityGitLab9.9CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-96656Plex Media Server External Control of File Name or Path VulnerabilityPlex Media Server8.6HighExploitedEPSS 1.8%6 articles

50 of 182 CVEs in the news this week · 377 exploited CVEs tracked overall.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in