CVEs in the news
Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
| CVE | Vulnerability | CVSS | Exploitation | EPSS | Articles | Seen |
|---|---|---|---|---|---|---|
| CVE-2026-20118 | Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service VulnerabilityCisco IOS XR Software | Unrated | Not in KEV | EPSS 0.3% | 2 articles | |
| CVE-2026-20051 | Cisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service VulnerabilityCisco NX-OS Software | 7.4High | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-120281 | WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflowWAVLINK WN536AX6-A | 10.0Critical | Not in KEV | EPSS – | 1 article | |
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityIvanti Connect Secure | Unrated | ExploitedDue 13 Nov | EPSS – | 6 articles | |
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityIvanti Connect Secure | 7.0High | ExploitedDue today | EPSS 0.5% | 6 articles | |
| CVE-2026-20563 | MediaTek, Inc. MediaTek chipset vulnerabilityMediaTek, Inc. MediaTek chipset | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-20562 | MediaTek, Inc. MediaTek chipset vulnerabilityMediaTek, Inc. MediaTek chipset | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-20552 | MediaTek, Inc. MediaTek chipset vulnerabilityMediaTek, Inc. MediaTek chipset | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-20499 | MediaTek, Inc. MediaTek chipset vulnerabilityMediaTek, Inc. MediaTek chipset | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityIvanti Connect Secure | 8.6High | Exploited | EPSS 87% | 19 articles | |
| CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Software | 8.6High | Exploited | EPSS 0.8% | 7 articles | |
| CVE-2026-118539 | Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254Drupal Commerce Core | Unrated | Not in KEV | EPSS 0.3% | 6 articles | |
| CVE-2026-116779 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 2 articles | |
| CVE-2026-116690 | MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version sourcemlflow | 7.5High | Not in KEV | EPSS 0.6% | 3 articles | |
| CVE-2026-102785 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52yootheme.com YOOtheme Pro extension for Joomla | 10.0Critical | Not in KEV | EPSS 0.8% | 2 articles | |
| CVE-2026-101767 | Oracle Corporation Oracle Application Object Library vulnerabilityOracle Corporation Oracle Application Object Library | 9.8Critical | Not in KEV | EPSS 0.6% | 6 articles | |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli | 9.2Critical | ExploitedDue 10 Nov | EPSS 83% | 21 articles | |
| CVE-2026-95863 | Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupApache Software Foundation Apache Wicket | 7.6High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-84231 | Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagApache Software Foundation Apache Wicket | 7.4High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-84170 | Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourceApache Software Foundation Apache Wicket | 8.3High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-83594 | Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesApache Software Foundation Apache Wicket | 8.3High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-82956 | Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameApache Software Foundation Apache Wicket | 7.6High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-111089 | Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupApache Software Foundation Apache Wicket | 7.6High | Not in KEV | EPSS – | 1 article | |
| CVE-2026-31419 | net: bonding: fix use-after-free in bond_xmit_broadcast()Linux | 7.8High | Not in KEV | EPSS 0.1% | 1 article | |
| CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondTrust Remote Support | 9.3Critical | Exploited | EPSS 19% | 13 articles | |
| CVE-2026-116449 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-116448 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-116443 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-116441 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-116439 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-111509 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2024-10441 | Synology DiskStation Manager (DSM) vulnerabilitySynology DiskStation Manager (DSM) | 9.8Critical | Not in KEV | EPSS 1.3% | 1 article | |
| CVE-2026-116243 | pgAdmin 4: Utility binary path can point at a shared storage directorypgadmin.org pgAdmin 4 | 7.7High | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-116242 | pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identitypgadmin.org pgAdmin 4 | 8.2High | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-116241 | pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifierpgadmin.org pgAdmin 4 | 9.9Critical | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-116239 | pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernamepgadmin.org pgAdmin 4 | 8.9High | Not in KEV | EPSS 0.4% | 1 article | |
| CVE-2026-116238 | pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checkspgadmin.org pgAdmin 4 | 9.2Critical | Not in KEV | EPSS 0.4% | 1 article | |
| CVE-2026-112816 | Improper certificate validation in the HTTPS listener in LXDCanonical LXD | 10.0Critical | Not in KEV | EPSS 0.3% | 2 articles | |
| CVE-2026-98432 | ipv4: free inet_opt and ireq_opt after an RCU grace periodLinux | 9.8Critical | Not in KEV | EPSS 0.5% | 5 articles | |
| CVE-2026-58882 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS – | 1 article | |
| CVE-2026-91403 | Oracle Corporation Oracle Java SE vulnerabilityOracle Corporation Oracle Java SE | 9.1Critical | Not in KEV | EPSS 0.4% | 2 articles | |
| CVE-2026-118697 | JetBrains Toolbox App vulnerabilityJetBrains Toolbox App | 9.0Critical | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-118696 | JetBrains IntelliJ IDEA vulnerabilityJetBrains IntelliJ IDEA | 8.0High | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-9082 | Drupal Core SQL Injection VulnerabilityDrupal Core | 9.8Critical | Exploited | EPSS 89% | 9 articles | |
| CVE-2026-97406 | Authentication Bypass via Bearer Tokens to Unauthorized Credential MintingXerj Console API | 9.1Critical | Not in KEV | EPSS 0.5% | 1 article | |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLabGitLab | 10.0Critical | Exploited | EPSS 27% | 14 articles | |
| CVE-2026-117350 | No description published yetVendor not yet named | Unrated | Not in KEV | EPSS 0.2% | 1 article | |
| CVE-2026-115905 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEzip-rs zip2 | 10.0Critical | Not in KEV | EPSS 0.3% | 1 article | |
| CVE-2026-111585 | Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer OverflowTeamViewer Full Client | 8.8High | Not in KEV | EPSS 0.3% | 3 articles | |
| CVE-2026-109619 | RCE via stale global statePHP Group PHP | 9.2Critical | Exploited | EPSS 99.9% | 54 articles |
No CVE on this page matches. Clear the filter, or search every CVE.
50 of 208 CVEs in the news this week · 391 exploited CVEs in the CISA KEV catalogue.
Next 50