Skip to content

CVEs in the news

Every CVE named in CyberSIXT coverage this week, with its severity, CISA KEV status and exploit probability.
182CVEs this week30in CISA KEV3federal deadlines
50 of 80 CVEs in this view, from this week’s news
CVEs in the news: CVSS 9.0+, sorted by most recent
CVEVulnerabilityCVSSExploitationEPSSArticlesSeen
CVE-2026-115893Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance wasmtime9.9CriticalNot in KEVEPSS 0.4%2 articles
CVE-2026-115889Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance wasmtime9.9CriticalNot in KEVEPSS 0.5%2 articles
CVE-2021-33045Dahua IP Camera Authentication Bypass VulnerabilityDahua IP Camera Firmware9.8CriticalExploitedEPSS 99.5%2 articles
CVE-2021-33044Dahua IP Camera Authentication Bypass VulnerabilityDahua IP Camera Firmware9.8CriticalExploitedEPSS 99.9%6 articles
CVE-2026-109619RCE via stale global statePHP Group PHP9.2CriticalNot in KEVEPSS 99.9%42 articles
CVE-2026-109618RCE via OOM corruptionPHP Group PHP9.2CriticalNot in KEVEPSS 99.9%43 articles
CVE-2026-110720Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rulesHashiCorp Tooling9.9CriticalNot in KEVEPSS –1 article
CVE-2026-115188No description published yetVendor not yet named9.9CriticalNot in KEVEPSS –1 article
CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli9.2CriticalNot in KEVEPSS 36%13 articles
CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe Commerce9.3CriticalNot in KEVEPSS 1.0%3 articles
CVE-2025-54236Adobe Commerce and Magento Improper Input Validation VulnerabilityAdobe Commerce and Magento9.1CriticalExploitedEPSS 95%4 articles
CVE-2026-110264GitLab vulnerabilityGitLab10.0CriticalNot in KEVEPSS 1.0%3 articles
CVE-2026-30612No description published yetVendor not yet named9.8CriticalNot in KEVEPSS 0.4%2 articles
CVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityAdobe Commerce10.0CriticalExploitedEPSS 4.0%8 articles
CVE-2026-97229Integer Overflow or Wraparound in GitLabGitLab10.0CriticalNot in KEVEPSS 18%8 articles
CVE-2026-93577GitLab vulnerabilityGitLab9.9CriticalNot in KEVEPSS 0.6%2 articles
CVE-2026-89078GitLab vulnerabilityGitLab9.9CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-114625Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista Networks VeloCloud Orchestrator9.9CriticalExploitedEPSS 1.0%8 articles
CVE-2026-106173Fortinet FortiSIEM vulnerabilityFortinet FortiSIEM9.4CriticalNot in KEVEPSS 1.0%6 articles
CVE-2026-43501ipv6: rpl: reserve mac_len headroom when recompressed SRH growsLinux9.8CriticalNot in KEVEPSS 0.7%1 article
CVE-2026-113380Signal RingRTC vulnerabilitySignal RingRTC9.3CriticalNot in KEVEPSS 0.9%6 articles
CVE-2026-24834Kata Container to Guest micro VM privilege escalationkata-containers9.4CriticalNot in KEVEPSS 0.2%1 article
CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora Online - Built-in CODE Server9.2CriticalExploitedEPSS 12%7 articles
CVE-2026-63030WordPress Core Interpretation Conflict VulnerabilityWordPress Core9.8CriticalExploitedEPSS 11%15 articles
CVE-2026-42208BerriAI LiteLLM SQL Injection VulnerabilityBerriAI LiteLLM9.3CriticalExploitedEPSS 89%9 articles
CVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityWebPros cPanel & WHM and WP2 (WordPress Squared)9.8CriticalExploitedEPSS 99%16 articles
CVE-2026-35616Fortinet FortiClient EMS Improper Access Control VulnerabilityFortinet FortiClient EMS9.1CriticalExploitedEPSS 94%15 articles
CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall SMA1000 Appliances10.0CriticalExploitedEPSS 6.8%19 articles
CVE-2024-57727SimpleHelp Path Traversal VulnerabilitySimpleHelp9.1CriticalExploitedEPSS 97%3 articles
CVE-2025-64446Fortinet FortiWeb Path Traversal VulnerabilityFortinet FortiWeb9.4CriticalExploitedEPSS 91%2 articles
CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCEpython-pillow Pillow9.2CriticalNot in KEVEPSS 1.1%1 article
CVE-2026-112393Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOpython-pillow Pillow9.2CriticalNot in KEVEPSS 0.8%1 article
CVE-2026-93952Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityArista VeloCloud Orchestrator10.0CriticalExploitedEPSS 1.4%6 articles
CVE-2026-16812Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityArista VeloCloud Orchestrator10.0CriticalExploitedEPSS 1.0%8 articles
CVE-2026-77185Apache MINA SSHD: Asynchronous authentication can bypass signature verificationApache Software Foundation Apache MINA SSHD9.1CriticalNot in KEVEPSS 0.4%1 article
CVE-2026-75595Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextnetty9.1CriticalNot in KEVEPSS 0.3%2 articles
CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsApache Software Foundation Apache Tomcat9.1CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteApache Software Foundation Apache Tomcat9.8CriticalNot in KEVEPSS 0.6%2 articles
CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraintApache Software Foundation Apache Tomcat9.1CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-115547Command Execution via Admin Console Input in Okta Access GatewayOkta Access Gateway9.1CriticalNot in KEVEPSS 0.5%1 article
CVE-2026-91403Oracle Corporation Oracle Java SE vulnerabilityOracle Corporation Oracle Java SE9.1CriticalNot in KEVEPSS 0.3%2 articles
CVE-2026-79852Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS (AOS)9.8CriticalNot in KEVEPSS 0.6%1 article
CVE-2026-79848Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)10.0CriticalNot in KEVEPSS 0.7%1 article
CVE-2026-79847Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)10.0CriticalNot in KEVEPSS 0.8%1 article
CVE-2026-79846Unauthenticated Command Injection Vulnerabilities in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)10.0CriticalNot in KEVEPSS 1.4%1 article
CVE-2026-79844Authentication Bypass Leading to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)10.0CriticalNot in KEVEPSS 0.7%1 article
CVE-2026-114509Laravel TokenGuard authentication bypass through non-string API credentialslaravel framework9.2CriticalNot in KEVEPSS 0.7%2 articles
CVE-2026-44849Portainer: Endpoint security bypass via Swarm service create/updateportainer9.4CriticalNot in KEVEPSS 0.4%1 article
CVE-2026-76474Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication VulnerabilitiesCisco Emergency Responder9.8CriticalNot in KEVEPSS 0.5%2 articles
CVE-2026-76473Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.Cisco Emergency Responder9.8CriticalNot in KEVEPSS 0.5%2 articles

50 of 80 CVEs in this view, from this week’s news · 377 exploited CVEs tracked overall.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in