CVEs in the news
27 CVEs this week0 in CISA KEV
| CVE | Vulnerability | CVSS | Exploitation | EPSS | Articles | Seen |
|---|---|---|---|---|---|---|
| CVE-2026-77185 | Apache MINA SSHD: Asynchronous authentication can bypass signature verificationApache Software Foundation Apache MINA SSHD | CVSS9.1Critical | Not in KEV | EPSS0.4% | 1article | |
| CVE-2026-65637 | Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteApache Software Foundation Apache Tomcat | CVSS9.8Critical | Not in KEV | EPSS0.6% | 2articles | |
| CVE-2026-65182 | Apache Tomcat: Bypass longest prefix security constraintApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.5% | 2articles | |
| CVE-2026-68525 | Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.5% | 2articles | |
| CVE-2026-111813 | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationApache Software Foundation Apache Traffic Server | CVSS10.0Critical | Not in KEV | EPSS0.5% | 1article | |
| CVE-2026-105944 | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of lifeApache Software Foundation Apache Pulsar Manager | CVSS10.0Critical | Not in KEV | EPSS0.7% | 1article | |
| CVE-2026-105869 | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user roleApache Software Foundation Apache Pulsar | CVSS9.2Critical | Not in KEV | EPSS0.3% | 1article | |
| CVE-2026-86471 | Apache CouchDB: Admin credentials leading to code execution as operating system userApache Software Foundation Apache CouchDB | CVSS9.3Critical | Not in KEV | EPSS0.6% | 1article | |
| CVE-2026-101296 | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanismsApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.6% | 1article | |
| CVE-2026-101356 | Apache Tomcat: HTTP/2 request/response mix-up after error during async processingApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.5% | 1article | |
| CVE-2026-103119 | Apache Tomcat: AJP response mix-upApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.6% | 1article |
11 CVEs of 11 in this view in the news this week · 376 exploited CVEs tracked overall.