LegalAgent AI Legal Lab
Vulnerability News
Software and device vulnerabilities announced in Japan and abroad that drew a government advisory, were confirmed as exploited, were rated critical, led to service suspensions or were widely discussed on X, listed from vendor and government announcements.As of November 7, 2026
Vulnerabilities to watch
Among vulnerabilities first disclosed within the last 90 days: exploited ones fixed only in some versions, and those that recently led to service suspensions.
Exploited
Airbyte (Connector Builder and Manifest Server)
CVSS 9.9 (v3.1, Airbyte (GitHub security advisory))
Exploited
PHP“php2shell”
CVSS 9.2 (v4.0, PHP developers)
Exploited
Collabora Online - Built-in CODE Server (Nextcloud app)
CVSS 9.2 (v4.0, Collabora)
Exploited
Zammad
CVSS 9.8 (v3.1, NVD)
Exploited
Fortinet FortiMail
CVSS 9.8 (v3.1, Fortinet)
Listed vulnerabilities in numbers
- Listed
- 66
- Exploited
- 39
- No fix or partial fix
- 13
- Advisory in Japan
- 13
Monthly list · 2026
All · 66 listed
November 2026
-
Updated
JetBrains products (November disclosures)
JetBrains · CVE-2026-123832, CVE-2026-123831, CVE-2026-123279, CVE-2026-123294
JetBrains disclosed fixes including code execution in CLion Safe Mode, code execution by view-only Datalore collaborators and privilege escalation in Hub. Canada’s November 6 advisory also covers IntelliJ IDEA, Ktor, YouTrack and other products.
Latest announcement (Open external link)No exploitation reportFix availableBusiness apps and cloud
CVSS 9.6 (v3.1, JetBrains CNA (maximum of the four listed CVEs))Abroad: CCCS
Details and sources (2 updates)
Affected and fixed versions
Fixed versions for the listed CVEs are CLion 2026.2 (also 2026.1.4 for the Meson-setting issue), Datalore 2026.4 and Hub 2026.2.52556. Other issues covered by CCCS have fixes including CLion 2026.3/2026.2.4.1, Datalore 2026.2.4, Hub 2026.2.52519 and Ktor 3.6.1; fixed versions differ by vulnerability.
Timeline and sources
- Vendor advisorySource (Open external link)
- Canadian CCCS advisorySource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Why it is listed
Government advisory
Sources checked: 2026-11-07
-
Updated
SonicWall SonicOS (SSLVPN authentication)
SonicWall · CVE-2026-19868
SonicWall disclosed that, when SAML authentication is enabled for SSLVPN, a user with valid credentials for an alternate method may bypass SAML controls and SAML-enforced MFA. CISA added the vulnerability to KEV on November 6.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 7.1 (v3.1, SonicWall (score for this CVE))Abroad: CCCS
Details and sources (3 updates)
Affected and fixed versions
Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015. The vendor identifies 7.3.4-7013 and later for Gen7 and 8.2.3-8015 and later for Gen8 as fixed. Applies to SSLVPN with SAML enabled.
Timeline and sources
- Vendor advisorySource (Open external link)
- Canadian CCCS advisorySource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.11.06
Why it is listed
Government advisory, Confirmed exploitation
Sources checked: 2026-11-07
-
Updated
Mozilla Firefox 159.0.1 security fix
Mozilla · CVE-2026-120572
On November 3 Mozilla released Firefox 159.0.1 to address incorrect boundary conditions in the Layout: Block and Inline component, rated High. Canada’s CCCS issued an advisory on November 6.
Latest announcement (Open external link)No exploitation reportFix availableWeb platforms and languages
CVSS not publishedAbroad: CCCS
Details and sources (2 updates)
Affected and fixed versions
Firefox before 159.0.1; fixed in 159.0.1. The vendor advisory gives no numeric CVSS score.
Timeline and sources
- Vendor advisorySource (Open external link)
- Canadian CCCS advisorySource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Why it is listed
Government advisory
Sources checked: 2026-11-07
-
Updated
Ruby on Rails (Active Storage)
Rails · GHSA-f3w6-w445-fwh9
Rails disclosed a flaw in Active Storage when images are processed with ImageMagick: by having a crafted file attached, an unauthenticated attacker may write arbitrary files on the server. When attachments are stored with the Disk service, files readable by the application process may also be read, and the advisory says exposure of secret_key_base and other credentials may lead to remote code execution. No CVE has been assigned yet.
Latest announcement (Open external link)No exploitation reportFix availableWeb platforms and languages
CVSS 9.8 (v3.0, Rails (GitHub security advisory))Abroad: CCCS
Details and sources (2 updates)
Affected and fixed versions
activestorage before 8.0.5.2, and 8.1 to before 8.1.4.1. Fixed in 8.0.5.2 and 8.1.4.1. Applications are affected if they process images with ImageMagick (the default for load_defaults 6.1 or earlier) and accept uploads from untrusted users.
Timeline and sources
- Rails published the security advisory (CVSS 3.0 9.8)Source (Open external link)
- Canada's CCCS issued advisory AV26-1129Source (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+), Government advisory
Sources checked: 2026-11-07
-
Updated
Siemens SIMATIC IoT2050 (Node-RED)
Siemens · CVE-2026-58115
On these industrial gateways with Node-RED installed, the Node-RED HTTP interface does not enforce authentication, allowing unauthenticated arbitrary code execution. VulnCheck reported attacks using the flaw against its sensor network from October 30.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 10.0 (v3.1, Siemens (CNA))Abroad: CCCS
Details and sources (4 updates)
Affected and fixed versions
SIMATIC IoT2050 Advanced, Basic, M.2 and SM: all versions before V4.3.4-1 running Industrial OS with Node-RED installed. Fixed in V4.3.4-1.
Timeline and sources
- Siemens published advisory SSA-834709Source (Open external link)
- VulnCheck reported exploitation observed from October 30Source (Open external link)
- Canada's CCCS updated advisory AV26-802 to note reports of in-the-wild exploitationSource (Open external link)
- Siemens updated the advisory to V1.1, clarifying the list of affected productsSource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-06
-
Updated
Airbyte (Connector Builder and Manifest Server)
Airbyte · GHSA-g35w-6r6v-h4r7
Airbyte disclosed that the Connector Builder and Manifest Server did not restrict which Python classes a declarative manifest could reference as custom components, letting a user able to submit a manifest execute arbitrary commands inside the container. On November 4, JVN stated that exploitation has been confirmed. No CVE has been assigned yet.
Latest announcement (Open external link)ExploitedPartially fixedBusiness apps and cloud
CVSS 9.9 (v3.1, Airbyte (GitHub security advisory))No advisory
Details and sources (2 updates)
Affected and fixed versions
Versions before 2.2.0. On 2.x, a user with Workspace Reader or Organization Reader access or higher could exploit it; on 1.x deployed with the legacy Helm chart, anyone with network access to the Connector Builder service could exploit it without authenticating. Fixed in 2.2.0; 1.x will not receive a fix. Airbyte said Airbyte Cloud customers need no action.
Timeline and sources
- Airbyte published the security advisory (CVSS 3.1 9.9)Source (Open external link)
- JVN published a vulnerability note stating exploitation has been confirmedSource (Open external link)
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-05
-
Updated
WatchGuard AuthPoint Authentication Gateway
WatchGuard · CVE-2026-121639, CVE-2026-121638, CVE-2026-121640
WatchGuard disclosed flaws in the authentication gateway that let an unauthenticated attacker disrupt authentication services and delete the sync configuration, intercept and modify traffic due to improper certificate validation, or perform administrative actions by replaying legitimate requests. The vendor said it is not aware of exploitation.
Latest announcement (Open external link)No known exploitationFix availableNetwork appliances
CVSS 9.2 (v4.0, WatchGuard (CNA; highest of three))No advisory
Details and sources (3 updates)
Affected and fixed versions
Versions 1.0 to before 7.6.0 (exposure depends on configuration). Fixed in 7.6.0.
Timeline and sources
- WatchGuard published the advisoriesSource (Open external link)
- Advisory for CVE-2026-121639 (CVSS 4.0 9.2)Source (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-05
-
Updated
Zyxel GS1900 series switches
Zyxel · CVE-2026-107441
An out-of-bounds write in the CGI program of the web management interface lets an unauthenticated attacker on the same network execute OS commands. Canada's CCCS updated its advisory to note reports of in-the-wild exploitation. According to reports, the exploit used in attacks that compromised about 1,000 devices targeted this flaw.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 8.8 (v3.1, Zyxel (CNA))Abroad: CCCS
Details and sources (5 updates)
Affected and fixed versions
Firmware 2.90(identifier.2)C0 and earlier on each of GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 (for example, 2.90(AAHH.2)C0 and earlier on GS1900-8). Fixed in 2.90(identifier.3)C0 for each model (2.90(AAHH.3)C0 for GS1900-8).
Timeline and sources
- Zyxel published the advisory and fixed firmwareSource (Open external link)
- CVE-2026-107441 publishedSource (Open external link)
- Canada's CCCS issued advisory AV26-1114Source (Open external link)
- Canada's CCCS updated the advisory to note reports of in-the-wild exploitationSource (Open external link)
- Reports said Binarly found that the exploit used to compromise about 1,000 devices targeted this flawSource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-05
-
Updated
Apple Safari, iOS, macOS and other products (WebKit)
Apple · CVE-2024-27834
A WebKit flaw that lets an attacker with arbitrary read and write capability bypass Pointer Authentication, fixed in May 2024. Sekoia reported its use in an exploit chain targeting iOS 16.7 in a watering-hole campaign it attributed to APT29, and CISA added it to KEV.
Latest announcement (Open external link)ExploitedFix availableOS and browsers
CVSS 5.5 (v3.1, CISA-ADP)No advisory
Details and sources (5 updates)
Affected and fixed versions
Versions before Safari 17.5, iOS and iPadOS 16.7.8, iOS and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. Fixed in those releases (published May 13, 2024).
Timeline and sources
- Apple fixed the flaw in Safari 17.5Source (Open external link)
- Apple fixed the flaw in iOS and iPadOS 16.7.8Source (Open external link)
- Apple fixed the flaw in macOS Sonoma 14.5 and other releasesSource (Open external link)
- Sekoia reported the flaw's use in an exploit chain targeting iOS 16.7 in a watering-hole campaign it attributed to APT29Source (Open external link)
- CISA added the CVE to the KEV catalogSource (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.11.04
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-05
-
Updated
Cisco Secure Email Gateway (SQL injection)
Cisco · CVE-2026-76461
A crafted email lets an unauthenticated attacker run SQL statements that lead to OS command execution as root. Cisco became aware of exploitation in September 2026, and on October 31 updated the fix in 15.5.5-014 after new information about exploit code available online.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 9.8 (v3.1, Cisco)Japan: JPCERT/CC
Details and sources (4 updates)
Affected and fixed versions
AsyncOS for Secure Email Gateway 15.5 and earlier (fixed in 15.5.5-014), 16.0 (fixed in 16.0.4-302) and 16.5 (fixed in 16.5.0-780). The updated fix for 15.5.5-014 is delivered with Retro Remediation Engine 4.0.2 or later.
Timeline and sources
- Cisco published the advisory, noting active exploitationSource (Open external link)
- CISA added the CVE to the KEV catalogSource (Open external link)
- JPCERT/CC published an alertSource (Open external link)
- Advisory updated, stating that the fix in 15.5.5-014 was updated on Oct 31 in light of new information about exploit code available onlineSource (Open external link)
Advisories
- Japan · JPCERT/CCSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.09.14
Why it is listed
Confirmed exploitation, Critical severity (CVSS 9.0+), Government advisory
Sources checked: 2026-11-04
-
Updated
Google Chrome (November 2026 stable updates)
Google · CVE-2026-121156, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035 and 2 more
The Chrome 157 stable release on November 3 included 213 security fixes, seven of which Google rated Critical. CISA-ADP scored six of the seven at CVSS 9.6.
Latest announcement (Open external link)No exploitation reportFix availableOS and browsers
CVSS 9.6 (v3.1, CISA-ADP)No advisory
Details and sources (2 updates)
Affected and fixed versions
Desktop versions before 157.0.8103.38 (Linux) and 157.0.8103.38/.39 (Windows and Mac). Extended Stable 156.0.8078.88 (Windows and Mac) fixes CVE-2026-121156 and others.
Timeline and sources
- 157.0.8103.38 released (7 Critical)Source (Open external link)
- Extended Stable 156.0.8078.88 released (3 Critical)Source (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-04
-
SonicWall Global Management System (GMS)
SonicWall · CVE-2026-109593, CVE-2026-109594
SonicWall disclosed an unauthenticated internal file read (CVSS 9.1) and a post-authentication SQL injection (CVSS 6.8) in GMS, a management product that has reached end of life.
Latest announcement (Open external link)No exploitation reportNo fix yetNetwork appliances
CVSS 9.1 (v3.1, SonicWall)No advisory
Details and sources
Affected and fixed versions
GMS (virtual appliance and Windows) 9.5.2 and earlier. The product has reached end of life and no fixed version will be released.
Timeline and sources
- SonicWall published advisory SNWLID-2026-0019 (no fix)Source (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-04
-
Updated
WordPress core
WordPress · CVE-2026-119977
Full-package core upgrades use predictable, web-accessible staging paths, letting unauthenticated attackers execute code on the server during the upgrade window. Wordfence observed exploitation attempts, and CISA added the flaw to KEV.
Latest announcement (Open external link)ExploitedFix availableWeb platforms and languages
CVSS 8.1 (v3.1, Wordfence (CNA))Abroad: CISA, CCCS
Details and sources (6 updates)
Affected and fixed versions
Versions 4.7 through 7.1.3 (in each branch, 7.0.7, 6.9.10, 4.7.38 and earlier, among others). Fixed in 7.1.4 and in releases for each branch from 4.7 (7.0.8, 6.9.11, 4.7.39 and others, published Oct 28).
Timeline and sources
- WordPress 7.1.4 released, fixing remote code execution during upgrades and other issuesSource (Open external link)
- Fixed releases for each branch from 4.7 publishedSource (Open external link)
- Reports said Wordfence blocked 62,969 attacks in 24 hoursSource (Open external link)
- CVE-2026-119977 publishedSource (Open external link)
- CISA added the CVE to the KEV catalogSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Advisories
- Abroad · CISASource (Open external link)
- Abroad · CCCSSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.11.03
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-04
-
Updated
GitLab CE/EE (critical patch 19.4.2 and others)
GitLab · CVE-2026-97229
An integer overflow in CI/CD regular expression handling lets an unauthenticated user execute arbitrary code on the GitLab server.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 10.0 (v3.1, GitLab)Abroad: CERT-EU
Details and sources (8 updates)
Affected and fixed versions
Versions 19.2 through 19.4 before 19.2.8, 19.3.5 and 19.4.2. GitLab.com and other GitLab-managed environments are patched.
Timeline and sources
- Versions 19.4.2, 19.3.5 and 19.2.8 releasedSource (Open external link)
- CERT-EU issued an advisorySource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
- Ruby team explained the underlying regex fixesSource (Open external link)
- Alpine Linux disclosed an attempt to exploit the flaw on its own GitLab on Oct 20-21 (it found no evidence of success)Source (Open external link)
- Added to KEVSource (Open external link)
- Added to CISA KEVSource (Open external link)
- Reported that Shadowserver tracks over 1,000 internet-exposed GitLab instances vulnerable to the flawSource (Open external link)
Advisories
- Abroad · CERT-EUSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.29
Why it is listed
Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)
Sources checked: 2026-11-03
-
Updated
Linux kernel
Linux kernel · CVE-2026-98432
A use-after-free in IPv4 TCP connection handling. Researchers showed unauthenticated root command execution on servers exposing an MPTCP listener.
Latest announcement (Open external link)No exploitation reportFix availableOS and browsers
CVSS 9.8 (v3.1, Linux kernel (CNA))No advisory
Details and sources (10 updates)
Affected and fixed versions
Kernels before 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, among others (per CCCS).
Timeline and sources
- Fix committed upstreamSource (Open external link)
- CVE-2026-98432 publishedSource (Open external link)
- Linux kernel CNA published the CVESource (Open external link)
- Anthropic published how it was found and exploitedSource (Open external link)
- Go Security Team announced impact and mitigationsSource (Open external link)
- Posts urging patching spread widely on social mediaSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
- CVE record updated (CVSS 3.1 9.8 listed)Source (Open external link)
- Red Hat released fixed kernels for RHEL 8, 9 and 10 and rated the flaw CriticalSource (Open external link)
- Fortinet said it is investigating the impact on its productsSource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+), Widely discussed on X
Sources checked: 2026-11-04
-
Updated
PHP“php2shell”
The PHP Group · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
Two flaws that can let unauthenticated remote attackers execute arbitrary code. CISA added them to its KEV catalog, and many Japanese services suspended operations as a precaution.
Latest announcement (Open external link)ExploitedPartially fixedWeb platforms and languages
CVSS 9.2 (v4.0, PHP developers)Japan: IPA, National Cybersecurity Office (Japan), JPCERT/CCAbroad: CERT-EU, CISA, NCSC (UK), CCCS
Details and sources (17 updates)
Affected and fixed versions
Versions before 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No official releases for 8.1 and earlier; minimal backports were published for 7.4 to 8.1. No fixed release yet for CVE-2026-115560.
Main impact
In Japan, organizations including the Ministry of Finance, au Jibun Bank, NTT Docomo, SoftBank, Kyushu Electric Power, Osaka Prefecture and futureshop suspended parts of their websites or services, or carried out emergency maintenance, around the release of the fixes. The piyolog blog counted 246 organizations whose own notices it had confirmed by midday on October 23.
- Ministry of Finance, Japan notice (Oct 21) (Open external link)
- au Jibun Bank notice (Oct 22) (Open external link)
- SoftBank Corp. notice (Oct 23) (Open external link)
- NTT Docomo notice (Oct 23) (Open external link)
- Future Shop (futureshop) notice (Oct 21) (Open external link)
- Kyushu Electric Power notice (Oct 23) (Open external link)
- Osaka Prefectural Government notice (Oct 23) (Open external link)
- piyolog (count of organizations' notices) (Open external link)
- Nikkei xTECH (Oct 21, 2026) (Open external link)
- Impress Watch (Oct 21, 2026) (Open external link)
- Business+IT (Oct 22, 2026) (Open external link)
- GIGAZINE (Oct 21, 2026) (Open external link)
- XServer notice (Open external link)
- SoftBank notice (Oct 23, 2026) (Open external link)
- Onamae.com notice (Oct 22, 2026) (Open external link)
Timeline and sources
- PHP announced an upcoming critical security releaseSource (Open external link)
- CERT-EU published an advisorySource (Open external link)
- IPA asked operators to prepare for the releaseSource (Open external link)
- Japan's National Cybersecurity Office issued an alert on XSource (Open external link)
- Japanese services reportedly suspended operations for emergency maintenanceSource (Open external link)
- Fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releasedSource (Open external link)
- CISA published an alertSource (Open external link)
- The UK NCSC published an alertSource (Open external link)
- Canada's CCCS issued an alert (updated Oct 27)Source (Open external link)
- JPCERT/CC published an alertSource (Open external link)
- IPA published an alertSource (Open external link)
- JVN published a vulnerability noteSource (Open external link)
- PHP published an informational advisory on a related third flaw (CVE-2026-115560)Source (Open external link)
- CISA added both CVEs to the KEV catalogSource (Open external link)
- JPCERT/CC added a report of an apparent successful compromise of a firewall productSource (Open external link)
- Palo Alto Networks reported that PAN-OS is affected and that exploitation targeting internet-exposed management interfaces has been observed; fixed releases for each branch were out by Oct 29Source (Open external link)
- IPA added a note on PHP embedded in VPN and security appliancesSource (Open external link)
Advisories
- Abroad · CERT-EUSource (Open external link)
- Japan · IPASource (Open external link)
- Japan · National Cybersecurity Office (Japan)Source (Open external link)
- Abroad · CISASource (Open external link)
- Abroad · NCSC (UK)Source (Open external link)
- Abroad · CCCSSource (Open external link)
- Japan · JPCERT/CCSource (Open external link)
- Japan · IPASource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.26
Why it is listed
Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+), Service suspensions, Widely discussed on X
Sources checked: 2026-11-03
October 2026
-
Updated
Brotli (C implementation)“Node2Shell / HTTP2Shell”
Google · CVE-2026-111497
An out-of-bounds write in the Brotli decoder. Crafted compressed data can cause crashes, memory disclosure or arbitrary code execution. Node.js and Python packages are also affected.
Latest announcement (Open external link)ExploitedFix availableOpen-source libraries
CVSS 9.2 (v4.0, Google (CNA))Japan: JPCERT/CCAbroad: CISA, CCCS, CSA (Singapore)
Details and sources (16 updates)
Affected and fixed versions
v1.2.0 to before v1.2.1, v1.1.0 to before v1.1.1, and v1.0.3 to before v1.0.10. Fixed in v1.2.1, v1.1.1 and v1.0.10.
Timeline and sources
- Google released fixed versions including v1.2.1Source (Open external link)
- Node.js shipped security releases including the fixSource (Open external link)
- Fixed releases including 1.2.1 publishedSource (Open external link)
- GitHub advisory published covering the Python packagesSource (Open external link)
- CVE-2026-111497 publishedSource (Open external link)
- OpenAI announced the finding on X and the post spread widelySource (Open external link)
- Microsoft released out-of-band .NET updates (8.0.33, 9.0.22, 10.0.14, 11 RC3)Source (Open external link)
- JPCERT/CC published an alertSource (Open external link)
- PHP updated its Windows buildsSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
- CISA added the CVE to the KEV catalogSource (Open external link)
- Added to KEVSource (Open external link)
- Canada's CCCS issued an alertSource (Open external link)
- Broadcom published the impact on VMware Cloud Foundation (VMSA-2026-0008)Source (Open external link)
- Singapore's CSA published an alert on active exploitationSource (Open external link)
- Palo Alto Networks published the impact on its productsSource (Open external link)
Advisories
- Japan · JPCERT/CCSource (Open external link)
- Abroad · CISASource (Open external link)
- Abroad · CCCSSource (Open external link)
- Abroad · CSA (Singapore)Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.27
Why it is listed
Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+), Widely discussed on X
Sources checked: 2026-11-05
-
Updated
Ivanti Connect Secure
Ivanti · CVE-2026-104935, CVE-2026-111357, CVE-2026-118527
An authentication bypass leading to command execution (CVE-2026-104935) and a privilege escalation flaw were exploited before patches were available.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 8.6 (v3.1, Ivanti (CVE-2026-104935))Abroad: CISA, CCCS, CSA Singapore
Details and sources (9 updates)
Affected and fixed versions
Versions 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior (per CISA). Versions 22.7R2.14 and earlier are not affected by CVE-2026-104935.
Timeline and sources
- Exploitation began (per Volexity)Source (Open external link)
- Fix for CVE-2026-104935 releasedSource (Open external link)
- CISA issued an alert and added it to KEVSource (Open external link)
- Volexity published its analysis of the chained exploitationSource (Open external link)
- Added to CISA KEV (CVE-2026-104935)Source (Open external link)
- Fix for the privilege escalation (CVE-2026-111357) releasedSource (Open external link)
- Ivanti updated the advisory to add CVE-2026-111357 and CVE-2026-118527 with fixed versionsSource (Open external link)
- CVE-2026-111357 and CVE-2026-118527 added to KEVSource (Open external link)
- CISA updated its alert to add the two CVEs and affected versionsSource (Open external link)
Advisories
- Abroad · CISASource (Open external link)
- Abroad · CCCSSource (Open external link)
- Abroad · CSA SingaporeSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.13
Why it is listed
Government advisory, Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
Drupal Commerce Core
Drupal · CVE-2026-118539
A missing authorization flaw in the e-commerce module for Drupal allows access controls to be bypassed. The Drupal Security Team rated it Highly critical (21 of 25) and said it is being actively exploited.
Latest announcement (Open external link)ExploitedFix availableWeb platforms and languages
CVSS 6.5 (v3.1, CISA-ADP)Abroad: CCCS
Details and sources (3 updates)
Affected and fixed versions
Commerce Core before 2.41, and 3.0.0 up to but not including 3.3.13. Fixed in 8.x-2.41 and 3.3.13.
Timeline and sources
- The Drupal Security Team published SA-CONTRIB-2026-254, stating the flaw is being actively exploitedSource (Open external link)
- CVE-2026-118539 publishedSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-03
-
Updated
Google Chrome (October 2026 stable updates)
Google · CVE-2026-106197, CVE-2026-106358, CVE-2026-106382, CVE-2026-110136 and 6 more
Six stable updates in October fixed 23 flaws Google rated Critical. CISA-ADP scored 10 of them at CVSS 9.6.
Latest announcement (Open external link)No exploitation reportFix availableOS and browsers
CVSS 9.6 (v3.1, CISA-ADP)No advisory
Details and sources (6 updates)
Affected and fixed versions
Desktop versions before 156.0.8078.79 (Linux) and 156.0.8078.79/.80 (Windows and Mac). The 10 flaws scored 9.6 were fixed in 156.0.8078.73 (Linux) and 156.0.8078.73/.74 (Windows and Mac).
Timeline and sources
- 155.0.8059.39 released (4 Critical)Source (Open external link)
- 155.0.8059.79 released (7 Critical)Source (Open external link)
- 155.0.8059.84 released (1 Critical)Source (Open external link)
- 156.0.8078.47 released (6 Critical)Source (Open external link)
- 156.0.8078.73 released (4 Critical)Source (Open external link)
- 156.0.8078.79 released (1 Critical)Source (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-03
-
Updated
Cisco Secure Firewall ASA / FTD
Cisco · CVE-2026-76418
When secondary authentication is configured on a remote access SSL VPN tunnel group, an unauthenticated attacker can send a crafted request to reload the device, causing a denial of service. Cisco confirmed exploitation.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 8.6 (v3.1, Cisco)Abroad: CCCS
Details and sources (2 updates)
Affected and fixed versions
ASA and FTD with SSL remote access VPN enabled and secondary authentication configured on a tunnel group. Fixed in ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
Timeline and sources
- Cisco published its advisory and fixed releasesSource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.29
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
Cisco Catalyst SD-WAN Controller, Manager and Validator
Cisco · CVE-2026-20127
A peering authentication flaw lets an unauthenticated attacker log in as a high-privileged internal account and manipulate the SD-WAN configuration. On October 28, Cisco Talos published an analysis of the group UAT-11473 exploiting the flaw and of KeyDrift, malware that collects keying material.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 10.0 (v3.1, Cisco)Abroad: CISA
Details and sources (3 updates)
Affected and fixed versions
Releases 20.9 (fixed in 20.9.8.2), 20.12 (fixed in 20.12.5.3 and 20.12.6.1), 20.15 (fixed in 20.15.4.2) and 20.18 (fixed in 20.18.2.1), among others. Releases past end of software maintenance have no fix of their own.
Timeline and sources
- Cisco published the advisory, noting limited exploitationSource (Open external link)
- CISA issued Emergency Directive 26-03 and added the CVE to KEVSource (Open external link)
- Cisco Talos published an analysis of exploitation by UAT-11473 and the KeyDrift malwareSource (Open external link)
Advisories
- Abroad · CISASource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.02.25
Why it is listed
Confirmed exploitation, Critical severity (CVSS 9.0+), Government advisory
Sources checked: 2026-11-04
-
Updated
Juniper Session Smart Router and Session Smart Conductor
Juniper Networks · CVE-2026-103406, CVE-2026-103409
One flaw lets an unauthenticated attacker run root commands through key management on the Conductor; the other lets an unauthenticated attacker gain administrative privileges on a Router before it is onboarded to Mist or a Conductor. Juniper said it is not aware of exploitation.
Latest announcement (Open external link)No known exploitationFix availableNetwork appliances
CVSS 9.8 (v3.1, Juniper Networks (CNA))Abroad: CCCS
Details and sources (2 updates)
Affected and fixed versions
Versions before 7.0.5, 7.1.7 and 7.2.3. Fixed in those releases of each branch.
Timeline and sources
- Juniper published out-of-cycle bulletin JSA112183Source (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+), Government advisory
Sources checked: 2026-11-04
-
Updated
Yamaha NWR100 wireless LAN router
Yamaha Corporation · CVE-2026-97854
A crafted request can run arbitrary OS commands on the router. A separate flaw that lets exported configuration files be read without authentication was disclosed at the same time.
Latest announcement (Open external link)No exploitation reportFix availableNetwork appliances · Made in Japan
CVSS 9.3 (v4.0, JVN (JPCERT/CC))No advisory
Details and sources (2 updates)
Affected and fixed versions
Firmware Rev.26.00.07 and earlier. Fixed in Rev.26.00.08.
Timeline and sources
- Yamaha published fixed firmware and an advisorySource (Open external link)
- JVN published a vulnerability noteSource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Sophos UTM
Sophos · CVE-2026-118633
When the email proxy is used with scanning enabled, a path traversal flaw combined with a race condition can let an unauthenticated remote attacker execute arbitrary code as root.
Latest announcement (Open external link)No exploitation reportFix availableNetwork appliances
CVSS 9.2 (v4.0, Sophos (CNA))No advisory
Details and sources (2 updates)
Affected and fixed versions
All versions (9.724 and earlier). The product is end-of-life; the patch is not delivered automatically and was provided for manual installation.
Timeline and sources
- Sophos published an advisory and a patchSource (Open external link)
- CVE-2026-118633 publishedSource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-03
-
Updated
Veeam Backup & Replication and Backup for Microsoft 365
Veeam · CVE-2026-108142, CVE-2026-106076
Veeam fixed an unauthenticated authorization bypass in the Backup & Replication CDP Coordinator Service (CVSS 9.1) and a SQL injection leading to code execution in Backup for Microsoft 365 (9.0).
Latest announcement (Open external link)No exploitation reportFix availableBusiness apps and cloud
CVSS 9.1 (v4.0, Veeam)No advisory
Details and sources (3 updates)
Affected and fixed versions
Backup & Replication 13.1 builds up to 13.1.1.18 and 13.0 builds up to 13.0.2.29 (fixed in 13.1.2 and 13.0.3), and Backup for Microsoft 365 version 8 up to 8.5.0.1014 (fixed in 8.6).
Timeline and sources
- Fixes in Backup & Replication 13.1.2 publishedSource (Open external link)
- Fixes in Backup for Microsoft 365 8.6 publishedSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Linux kernel“Fragnesia”
Linux · CVE-2026-46300
A flaw in ESP (IPsec) handling lets a local user overwrite the page cache of read-only files and gain root. CISA notes it can be chained with PHP flaws.
Latest announcement (Open external link)ExploitedFix availableOS and browsers
CVSS 7.8 (v3.1, Linux kernel (CNA))No advisory
Details and sources (3 updates)
Affected and fixed versions
Linux 3.9 and later. Fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1.
Timeline and sources
- Researchers disclosed details and proof of conceptSource (Open external link)
- CVE publishedSource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.28
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
VMware ESX
Broadcom · CVE-2026-41709
An insufficient logging flaw that lets a malicious administrator perform certain operations without being logged. Fixes were released on July 29, 2026.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 2.7 (v3.1, Broadcom)No advisory
Details and sources (2 updates)
Affected and fixed versions
VMware ESX 9.1.x (before ESXi-9.1.0.0-25370933), 9.0.x (before ESXi-9.0.2.0100-25595025), 8.0 (before ESXi80U3j-25429389), VMware Cloud Foundation 5.x (before 5.2.4), and related products.
Timeline and sources
- Broadcom published VMSA-2026-0006Source (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.28
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
Adobe Commerce / Magento Open Source
Adobe · CVE-2026-48356
An unrestricted upload of files with a dangerous type that could lead to arbitrary code execution. Fixes were released on July 14, 2026.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 9.6 (v3.1, Adobe)No advisory
Details and sources (2 updates)
Affected and fixed versions
Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier; Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier; Adobe Commerce B2B; Adobe Commerce Events 1.6.0 to 1.20.0.
Timeline and sources
- Adobe published APSB26-73Source (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.27
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
WatchGuard Fireware OS
WatchGuard · CVE-2026-103594, CVE-2026-112710, CVE-2026-112709, CVE-2026-93865 and 3 more
WatchGuard disclosed a batch of Firebox OS flaws, seven scored CVSS 9.0 or higher, in WireGuard configuration, AD authentication, FireCluster sync, the SIP proxy, the Access Portal and the logging service. The vendor said it is not aware of exploitation.
Latest announcement (Open external link)No known exploitationFix availableNetwork appliances
CVSS 9.5 (v4.0, WatchGuard (highest of seven))No advisory
Details and sources (2 updates)
Affected and fixed versions
Fireware OS 2025.1 to before 2026.4 and 12.0 to before 12.12.4 (T15 and T35: before 12.5.22). CVE-2026-103594 affects only 2026.2 and later and the 12.12 branch. Fixed in 2026.4, 12.12.4 and 12.5.22.
Timeline and sources
- WatchGuard published the advisoriesSource (Open external link)
- Advisory for CVE-2026-103594 (CVSS 4.0 9.5)Source (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-04
-
Updated
Oracle Critical Patch Update (October 2026)
Oracle · CVE-2026-91299, CVE-2026-91231, CVE-2026-91221, CVE-2026-91216 and 2 more
Oracle released 1,295 security patches. Ninety-five unique CVEs scored CVSS 9.0 or higher, six of them 10.0.
Latest announcement (Open external link)No exploitation reportFix availableBusiness apps and cloud
CVSS 10.0 (v3.1, Oracle)No advisory
Details and sources (3 updates)
Affected and fixed versions
Many products, including SOA Suite, Access Manager, JD Edwards EnterpriseOne, WebLogic Server, MySQL and Essbase.
Timeline and sources
- October 2026 CPU releasedSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
- Advisory revised (Rev 2)Source (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Microsoft products (October 2026 security updates)
Microsoft · CVE-2026-96951, CVE-2026-96207, CVE-2026-94510, CVE-2026-70242 and 11 more
October 2026 monthly updates. Microsoft disclosed that a Windows Shell security feature bypass flaw is being exploited.
Latest announcement (Open external link)ExploitedFix availableOS and browsers
CVSS 9.8 (v3.1, Microsoft, highest listed)Japan: IPA, JPCERT/CCAbroad: CCCS
Details and sources (8 updates)
Affected and fixed versions
Windows (affected versions are listed in Microsoft's Security Update Guide).
Timeline and sources
- Microsoft released its monthly security updatesSource (Open external link)
- CISA added CVE-2026-96951 to the KEV catalogSource (Open external link)
- Monthly security updates releasedSource (Open external link)
- CVE-2026-96951 added to KEVSource (Open external link)
- ZDI published its review of the releaseSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
- JPCERT/CC and IPA published alertsSource (Open external link)
- Microsoft added Edge to the security updates tableSource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
- Japan · IPASource (Open external link)
- Japan · JPCERT/CCSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.13
Why it is listed
Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Arista VeloCloud Orchestrator (on-prem)
Arista Networks · CVE-2026-114625
An SQL injection in the SD-WAN orchestrator lets any authenticated user reach internal functions and gain operator privileges. Arista detected the issue and said it is actively exploited.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 9.9 (v3.1, Arista)Abroad: Canadian Centre for Cyber Security（AV26-1080）
Details and sources (3 updates)
Affected and fixed versions
On-prem VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. End-of-support versions were not assessed. Hosted and Dedicated VCO are already patched.
Timeline and sources
- Arista published Security Advisory 0199 and fixed versionsSource (Open external link)
- Added to CISA KEVSource (Open external link)
- Canadian Cyber Centre issued AV26-1080Source (Open external link)
Advisories
- Abroad · Canadian Centre for Cyber Security（AV26-1080）Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.23
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
Fortinet FortiSIEM and FortiSandbox
Fortinet · CVE-2026-107656, CVE-2026-106173
Fortinet's October 13 release fixed a FortiSandbox authentication bypass (CVSS 9.6) and a FortiSIEM path traversal leading to code execution (9.4).
Latest announcement (Open external link)No exploitation reportPartially fixedNetwork appliances
CVSS 9.6 (v3.1, Fortinet)No advisory
Details and sources (3 updates)
Affected and fixed versions
FortiSandbox 5.0.0-5.0.6 and 4.4.0-4.4.9 (no fix for 4.2 and some PaaS versions), and FortiSIEM 7.5.0.
Timeline and sources
- FortiSandbox advisory publishedSource (Open external link)
- FortiSIEM advisory publishedSource (Open external link)
- Canada's CCCS noted reports of FortiSIEM exploitationSource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Collabora Online - Built-in CODE Server (Nextcloud app)
Collabora · CVE-2026-110447
An unauthenticated OS command injection in the Nextcloud app's built-in CODE server, reachable while the CODE server is not running. It was exploited in September and October 2026.
Latest announcement (Open external link)ExploitedPartially fixedBusiness apps and cloud
CVSS 9.2 (v4.0, Collabora)No advisory
Details and sources (3 updates)
Affected and fixed versions
The Nextcloud app richdocumentscode before 26.4.303. End-of-life Nextcloud versions up to 29 are also affected. Standalone Collabora Online servers are not affected.
Timeline and sources
- Exploitation reported on Nextcloud forumSource (Open external link)
- Collabora published advisory (fixed in 26.4.303)Source (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.23
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
GitLab CE/EE (critical patch 19.5.1 and others)
GitLab · CVE-2026-110264
An integer overflow when compiling crafted regular expressions lets an unauthenticated user execute arbitrary code. Fixes were also backported to older versions.
Latest announcement (Open external link)No exploitation reportFix availableBusiness apps and cloud
CVSS 10.0 (v3.1, GitLab)Abroad: CERT-EU
Details and sources (3 updates)
Affected and fixed versions
All versions from 7.0 before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1.
Timeline and sources
- Version 19.5.1 and others releasedSource (Open external link)
- CERT-EU issued an advisorySource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Advisories
- Abroad · CERT-EUSource (Open external link)
Why it is listed
Government advisory, Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Siemens Software Center
Siemens · CVE-2026-110936
The software download and install application loads a crafted DLL from an uncontrolled search path, allowing code execution. Siemens reported exploitation in a ClickFix campaign bundling the signed binary with malicious DLLs.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 8.4 (v4.0, Siemens)Abroad: Canadian Centre for Cyber Security（AV26-1063）, CISA (ICS advisory ICSA-26-295-03)
Details and sources (6 updates)
Affected and fixed versions
All versions before V4.0.9.8. Fixed in V4.0.9.8; existing installations update automatically at next startup.
Timeline and sources
- Siemens published SSA-580366Source (Open external link)
- Fixed version V4.0.9.8 added to the advisorySource (Open external link)
- Siemens reported active exploitationSource (Open external link)
- Canadian Cyber Centre issued AV26-1063Source (Open external link)
- Added to CISA KEVSource (Open external link)
- CISA republished it as ICSA-26-295-03Source (Open external link)
Advisories
- Abroad · Canadian Centre for Cyber Security（AV26-1063）Source (Open external link)
- Abroad · CISA (ICS advisory ICSA-26-295-03)Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.20
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
Cisco Expressway, Unified Communications and others (October 21 release)
Cisco · CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475 and 1 more
Cisco disclosed an unauthenticated root command execution flaw in Expressway (CVSS 9.8) and hardening releases for Unified CM and related products and Snort 3.
Latest announcement (Open external link)No known exploitationFix availableNetwork appliances
CVSS 9.8 (v3.1, Cisco)No advisory
Details and sources (3 updates)
Affected and fixed versions
Expressway before X15.5.20 (no fix for X14 and earlier), Unified CM, Unity Connection and related products before 15SU5, and products using Snort 3.
Timeline and sources
- Expressway RCE advisory publishedSource (Open external link)
- Unified Communications hardening release publishedSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Oracle Java SE (October 2026 CPU)
Oracle · CVE-2026-91403
Java SE flaws fixed in the October 2026 Critical Patch Update. A JSSE flaw can let unauthenticated network attackers modify or access critical data.
Latest announcement (Open external link)No exploitation reportFix availableWeb platforms and languages
CVSS 9.1 (v3.1, Oracle)Japan: IPA
Details and sources
Affected and fixed versions
Oracle Java SE 27, 26.0.2, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1, 8 Update 503 and others (per IPA).
Timeline and sources
- IPA published an alertSource (Open external link)
Advisories
- Japan · IPASource (Open external link)
Why it is listed
Government advisory, Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Plex Media Server“Plex2Shell”
Plex · CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Chaining four flaws lets an unauthenticated remote attacker run code on the server. Plex says they were widely exploited after a public proof of concept, including for cryptocurrency mining.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 8.6 (v4.0, CISA (CNA))No advisory
Details and sources (5 updates)
Affected and fixed versions
Plex Media Server versions before 1.43.3.10861. Fixed in 1.43.3.10861.
Timeline and sources
- Plex announced security update (1.43.3)Source (Open external link)
- CVEs published (CISA VA-26-266-01)Source (Open external link)
- Researcher published details and proof of conceptSource (Open external link)
- Plex reported active, widespread exploitationSource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.20
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
SiteGuard Server Edition
EG Secure Solutions · CVE-2026-106931
An OS command injection flaw in the statistics feature of this host-based WAF. It can let attackers run commands as root or SYSTEM. The vendor has confirmed exploitation.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud · Made in Japan
CVSS 8.5 (v4.0, JVN (JPCERT/CC))Japan: JPCERT/CC
Details and sources (6 updates)
Affected and fixed versions
Ver2.20 and later with the statistics feature enabled (on by default): Apache, Nginx and IIS editions before Ver8.00 Update5, and FreeBSD Apache and Nginx editions before Ver7.00 Update6. IIS Ver3.10 to Ver4.00 Update4 are not affected.
Timeline and sources
- Vendor notified customers with direct support contractsSource (Open external link)
- Vendor published fixed versions and a replacement patchSource (Open external link)
- JVN published a vulnerability noteSource (Open external link)
- JPCERT/CC published an alertSource (Open external link)
- CISA added the CVE to the KEV catalogSource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
- Japan · JPCERT/CCSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.20
Why it is listed
Government advisory, Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
BeyondTrust Remote Support
BeyondTrust · CVE-2026-102764
Insufficient origin validation of internal messages lets an unauthenticated attacker perform file operations on the appliance. It was exploited as a zero-day.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 9.3 (v4.0, BeyondTrust)Abroad: CISA, CCCS
Details and sources (7 updates)
Affected and fixed versions
All versions up to 26.2.3. Versions 24.3.1 and later are fixed by patch BT26-05-RS; there is no patch for versions before 24.3.1. SaaS instances were patched by October 9, 2026.
Timeline and sources
- Fix applied to all SaaS instancesSource (Open external link)
- Advisory BT26-05 publishedSource (Open external link)
- CVE publishedSource (Open external link)
- Mandiant published its analysis of the attackerSource (Open external link)
- CISA issued an alert and added it to KEVSource (Open external link)
- Canada's CCCS issued an alertSource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
- Abroad · CISASource (Open external link)
- Abroad · CCCSSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.16
Why it is listed
Government advisory, Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
Fortinet FortiOS / FortiPAM / FortiProxy / FortiSwitchManager
Fortinet · CVE-2025-61624
A CLI path traversal flaw disclosed in April 2026. An admin with read-write permissions can write or delete arbitrary files via specific commands.
Latest announcement (Open external link)ExploitedPartially fixedNetwork appliances
CVSS 6.0 (v3.1, Fortinet)No advisory
Details and sources (2 updates)
Affected and fixed versions
FortiOS 7.6.0-7.6.4, 7.4.0-7.4.9, all 7.2/7.0/6.4; FortiPAM 1.7.0 and all 1.0-1.6; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.11, all 7.2/7.0; FortiSwitchManager 7.2.0-7.2.7, 7.0.0-7.0.6. Older branches have no fix of their own.
Timeline and sources
- Fortinet published advisorySource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.16
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
Cisco Secure Email Gateway
Cisco · CVE-2026-76519
When AMP file reputation is enabled, an email with a crafted attachment can write files and run commands as root.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 9.8 (v3.1, Cisco)Abroad: CCCS, CERT-EU
Details and sources (3 updates)
Affected and fixed versions
Appliances with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525; AsyncOS 15.5 before 15.5.5-014 and 16.5 before 16.5.0-780, among others (per CCCS).
Timeline and sources
- Advisory published, noting active exploitationSource (Open external link)
- Added to KEVSource (Open external link)
- CERT-EU issued an advisorySource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
- Abroad · CERT-EUSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.14
Why it is listed
Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Juniper Junos OS and Junos OS Evolved
Juniper Networks（HPE） · CVE-2026-101954, CVE-2026-101986, CVE-2026-101983, CVE-2026-102182 and 1 more
Juniper's October bulletin fixed several CVSS 9.8 flaws, including J-Web authentication issues and an IKE buffer overflow on MX Series.
Latest announcement (Open external link)No exploitation reportFix availableNetwork appliances
CVSS 9.8 (v3.1, Juniper)No advisory
Details and sources (3 updates)
Affected and fixed versions
Multiple Junos OS and Junos OS Evolved release trains (e.g. before 24.2R2-S5.5 and 25.2R2-S2, per CCCS). Each flaw requires J-Web, IKE, BMP or similar to be enabled.
Timeline and sources
- Advisories published, including JSA112187 for J-WebSource (Open external link)
- MX Series IKE advisory published (JSA112196)Source (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Atlassian Data Center products (Confluence, Jira and others)
Atlassian · CVE-2026-21589
An unauthenticated attacker can read specific files under the web application root. All versions of the Data Center products are affected.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 9.3 (v4.0, Atlassian)Abroad: CCCS, CERT-EU
Details and sources (4 updates)
Affected and fixed versions
Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye, before the fixed versions (e.g. Confluence 9.2.26 and 10.2.19).
Timeline and sources
- Advisory publishedSource (Open external link)
- CERT-EU issued an advisorySource (Open external link)
- Added to KEVSource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
- Abroad · CERT-EUSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.15
Why it is listed
Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
NGINX (Open Source and Plus)
F5 · CVE-2026-15176
With alias combined with rewrite and a directive referencing $request_filename, crafted requests can cause a heap buffer overflow in the worker process.
Latest announcement (Open external link)No exploitation reportPartially fixedWeb platforms and languages
CVSS 9.2 (v4.0, F5)No advisory
Details and sources (3 updates)
Affected and fixed versions
NGINX Open Source 0.1.29-1.31.6 (fixed in 1.30.6 and 1.31.7), and NGINX Plus before 37.0.5.1 and 37.1.0.1, plus R33-R36.
Timeline and sources
- F5 published CVE-2026-15176 (K000162416)Source (Open external link)
- nginx.org published fixed versions and an advisorySource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Palo Alto Networks PAN-OS
Palo Alto Networks · CVE-2026-0322
A code injection flaw in the management interface lets an authenticated attacker execute arbitrary code as root on the firewall. Palo Alto Networks observed very limited exploitation.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 8.6 (v4.0, Palo Alto Networks)Abroad: CCCS
Details and sources (3 updates)
Affected and fixed versions
PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 on PA-Series and VM-Series firewalls and Panorama (fixed in 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 and other hotfixes). Cloud NGFW and Prisma Access are not affected.
Timeline and sources
- Palo Alto Networks published its advisory and fixed versionsSource (Open external link)
- Added to CISA KEVSource (Open external link)
- PAN-OS 11.2.16 releasedSource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.14
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
Ahsay AhsayCBS
Ahsay · CVE-2026-105133, CVE-2026-105134
Two flaws in the backup server: an authentication bypass in the API and an OS command injection. They can be chained. The initial patch was incomplete, and new hotfixes were issued on October 12, 2026.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 10.0 (v4.0, VulDB (CNA))No advisory
Details and sources (4 updates)
Affected and fixed versions
Up to 9.15.2.69 and 10.3.4.44 (per NVD). Fixed in 10.3.4.45 for v10 and 9.15.2.70 for v7-v9.
Timeline and sources
- CVEs publishedSource (Open external link)
- Huntress reported exploitation observed from October 7Source (Open external link)
- Ahsay released updated hotfixesSource (Open external link)
- Added to CISA KEVSource (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.14
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Amazon Pay plugin for EC-CUBE 4
EC-CUBE · CVE-2026-103671
A flaw that can redirect shoppers to arbitrary websites during checkout, which may lead to theft of account information. The developer has confirmed attacks exploiting it.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud · Made in Japan
CVSS 5.3 (v4.0, JVN (JPCERT/CC))No advisory
Details and sources
Affected and fixed versions
Amazon Pay V2 plugin for 4.0/4.1 v1.0.0 to v1.1.12, for 4.2/4.3 v4.2.0 to v4.3.1, and Amazon Pay plugin (CV1) for 4.0 v1.3.0 and earlier.
Timeline and sources
- JVN published an urgent vulnerability noteSource (Open external link)
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
SAP Security Patch Day (October 2026)
SAP · CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108
SAP released 16 new security notes and 4 GitHub advisories. Four were Critical, including an SSRF in SAP Cloud SDK for Python (CVSS 10.0).
Latest announcement (Open external link)No exploitation reportFix availableBusiness apps and cloud
CVSS 10.0 (v3.1, SAP)No advisory
Details and sources (2 updates)
Affected and fixed versions
SAP Cloud SDK for Python before 0.45.2, NetWeaver Visual Composer, S/4HANA (S4CORE 105-109), Manufacturing Integration and Intelligence 15.4 and 15.5, and others.
Timeline and sources
- Security notes released on October Patch DaySource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
SonicWall SMA1000
SonicWall · CVE-2026-102255
A pre-authentication SSRF in the Work Place interface lets a remote attacker make the appliance send requests, reach internal functions and perform unauthorized operations.
Latest announcement (Open external link)No exploitation reportFix availableNetwork appliances
CVSS 10.0 (v3.1, CISA-ADP)No advisory
Details and sources (3 updates)
Affected and fixed versions
SMA1000 models 6210, 7210 and 8200v running 12.4.3-03670 or 12.5.0-03082 (platform-hotfix) and earlier (per CCCS).
Timeline and sources
- SonicWall published advisory SNWLID-2026-0017Source (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
- Researchers reported exploitation attemptsSource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
ProFTPD“mod_copy”
The ProFTPD Project · CVE-2015-3306
A flaw disclosed in 2015 in the mod_copy module that lets unauthenticated attackers read and write arbitrary files via SITE CPFR/CPTO. A joint advisory listed it as exploited by China-linked actors.
Latest announcement (Open external link)ExploitedFix availableOpen-source libraries
CVSS 10.0 (v3.1, CISA-ADP)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)
Details and sources (5 updates)
Affected and fixed versions
ProFTPD 1.3.5 with mod_copy. Fixed in 1.3.5a and 1.3.6rc1.
Timeline and sources
- Debian published DSA-3263-1Source (Open external link)
- Fixed versions 1.3.5a and 1.3.6rc1 released (Bug 4169)Source (Open external link)
- Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
- Added to CISA KEVSource (Open external link)
- Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
Advisories
- Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
- Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
ONLYOFFICE Docs (Document Server)
Ascensio System SIA (ONLYOFFICE) · CVE-2021-3199
A flaw disclosed in 2021 that allows path traversal and remote code execution via image upload parameters when JWT is used. A joint advisory listed it as exploited by China-linked actors.
Latest announcement (Open external link)ExploitedFix availableBusiness apps and cloud
CVSS 9.8 (v3.1, NVD)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)
Details and sources (4 updates)
Affected and fixed versions
Document Server before 5.6.3 (AA26-281A lists 5.1.5 through 5.6.2). Fixed in 5.6.3.
Timeline and sources
- CVE published in NVDSource (Open external link)
- Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
- Added to CISA KEVSource (Open external link)
- Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
Advisories
- Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
- Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
Citrix NetScaler ADC and Gateway (SAML configurations)
Cloud Software Group（Citrix） · CVE-2026-107406
A memory overflow on appliances configured as a SAML SP or IdP may allow remote code execution or denial of service. September's fixed builds are also affected.
Latest announcement (Open external link)No exploitation reportFix availableNetwork appliances
CVSS 9.5 (v4.0, NetScaler (CNA))No advisory
Details and sources (2 updates)
Affected and fixed versions
Builds before 13.1-64.29 and 14.1-73.46, including FIPS variants (per CCCS).
Timeline and sources
- Citrix published bulletin CTX697191Source (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Citrix NetScaler ADC / NetScaler Gateway
Citrix (Cloud Software Group) · CVE-2026-88779
A memory overflow flaw causes denial of service on appliances configured as a SAML SP or IdP. CISA noted it could be used to force a reboot that runs code injected via CVE-2026-88771.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 8.7 (v4.0, Citrix)Abroad: CISA
Details and sources (3 updates)
Affected and fixed versions
Customer-managed ADC and Gateway 14.1 before 14.1-73.41, 13.1 before 13.1-64.28, 14.1 FIPS before 14.1-73.41 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.282.
Timeline and sources
- Citrix published bulletin CTX697174Source (Open external link)
- Added to CISA KEVSource (Open external link)
- CISA updated its September 27 alert to add this CVESource (Open external link)
Advisories
- Abroad · CISASource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.04
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
Apache Struts 2“S2-032”
Apache Software Foundation · CVE-2016-3081
A flaw disclosed in 2016 that allows remote code execution via the method: prefix when Dynamic Method Invocation is enabled. A joint advisory listed it as exploited by China-linked actors.
Latest announcement (Open external link)ExploitedFix availableWeb platforms and languages
CVSS 8.1 (v3.1, NVD)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)
Details and sources (5 updates)
Affected and fixed versions
Struts 2.3.20 through 2.3.28, except 2.3.20.3 and 2.3.24.3. Fixed in 2.3.20.3, 2.3.24.3 and 2.3.28.1.
Timeline and sources
- Fixed versions 2.3.20.3, 2.3.24.3 and 2.3.28.1 releasedSource (Open external link)
- CVE published in NVDSource (Open external link)
- Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
- Added to CISA KEVSource (Open external link)
- Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
Advisories
- Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
- Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
ISC BIND 9
Internet Systems Consortium (ISC) · CVE-2015-5477
A flaw disclosed in 2015 in which crafted TKEY queries make named exit, allowing remote denial of service. A joint advisory listed it as exploited by China-linked actors.
Latest announcement (Open external link)ExploitedPartially fixedOpen-source libraries
CVSS 7.8 (v2.0, ISC)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)
Details and sources (4 updates)
Affected and fixed versions
BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2. Fixed in 9.9.7-P2 and 9.10.2-P3; ISC's advisory lists no fix for 9.8 and earlier.
Timeline and sources
- ISC published the advisory and fixed versionsSource (Open external link)
- Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
- Added to CISA KEVSource (Open external link)
- Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
Advisories
- Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
- Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
Strapi
Strapi Solutions SAS · CVE-2023-22894
A flaw disclosed in 2023 in which filtering on private fields leaks email addresses, password hashes and reset tokens. Chained with CVE-2023-22621 it allows remote code execution.
Latest announcement (Open external link)ExploitedPartially fixedWeb platforms and languages
CVSS 7.2 (v3.1, CISA-ADP)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)
Details and sources (5 updates)
Affected and fixed versions
3.2.1 and later, before 4.8.0. Fixed in 4.8.0. v3 reached end of life on December 31, 2022 and receives no fix.
Timeline and sources
- Fixed version 4.8.0 releasedSource (Open external link)
- Strapi disclosed the vulnerability detailsSource (Open external link)
- Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
- Added to CISA KEVSource (Open external link)
- Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
Advisories
- Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
- Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08
Why it is listed
Confirmed exploitation, Government advisory
Sources checked: 2026-11-02
-
Updated
Cisco NX-OS, Nexus, License On-Prem and others (October 7 release)
Cisco · CVE-2026-76482, CVE-2026-76471, CVE-2026-76485, CVE-2026-76486 and 12 more
Cisco published advisories including unauthenticated root code execution flaws in NX-OS NX-API, NGOAM and MPLS OAM, with scores of CVSS 9.0 or higher.
Latest announcement (Open external link)No known exploitationPartially fixedNetwork appliances
CVSS 10.0 (v3.1, Cisco)No advisory
Details and sources (5 updates)
Affected and fixed versions
Nexus 3000 and 9000 Series, NX-OS, License (Smart Software Manager) On-Prem, APIC and Meraki products. Some Meraki fixes were scheduled for late October to mid-November.
Timeline and sources
- Advisories published, including the NX-API RCESource (Open external link)
- NGOAM RCE advisory publishedSource (Open external link)
- License On-Prem hardening release publishedSource (Open external link)
- Meraki hardening release publishedSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
Zammad
Zammad GmbH · CVE-2026-102489, CVE-2026-102490
Two flaws: a session hijack leading to code execution as the zammad user, and a local privilege escalation to root in DEB and RPM packages. They can be chained.
Latest announcement (Open external link)ExploitedPartially fixedBusiness apps and cloud
CVSS 9.8 (v3.1, NVD)No advisory
Details and sources (5 updates)
Affected and fixed versions
CVE-2026-102489: 6.3.0-6.5.4 (also present in 7.0.0-7.1.x but described as not exploitable; 6.5 and older are out of support). CVE-2026-102490: DEB/RPM packages 7.2.1 and earlier, fixed in 7.2.2.
Timeline and sources
- DIVD made limited disclosure and began notifying ownersSource (Open external link)
- Zammad posted a statement on its community forumSource (Open external link)
- Added to CISA KEVSource (Open external link)
- Zammad published security advisorySource (Open external link)
- Fix for CVE-2026-102490 released in 7.2.2Source (Open external link)
Advisories
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.02
Why it is listed
Confirmed exploitation
Sources checked: 2026-11-02
-
Updated
Fortinet FortiMail
Fortinet · CVE-2026-104286
A path traversal flaw lets an unauthenticated attacker write arbitrary files via crafted HTTP or HTTPS requests. Exploitation in the wild has been reported.
Latest announcement (Open external link)ExploitedPartially fixedNetwork appliances
CVSS 9.8 (v3.1, Fortinet)Abroad: CCCS, CSA Singapore
Details and sources (6 updates)
Affected and fixed versions
Versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9 and all 7.0 versions. The 7.2.10 fix has not yet been released, and there is no fix for 7.0.
Timeline and sources
- Advisory FG-IR-26-175 publishedSource (Open external link)
- Added to KEVSource (Open external link)
- Fortinet published advisorySource (Open external link)
- FortiMail Cloud fixed and advisory updatedSource (Open external link)
- Fortinet updated solution and remediated FortiMail CloudSource (Open external link)
- Fortinet clarified FortiMail Cloud fixSource (Open external link)
Advisories
- Abroad · CCCSSource (Open external link)
- Abroad · CSA SingaporeSource (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.01
Why it is listed
Confirmed exploitation, Critical severity (CVSS 9.0+), Government advisory
Sources checked: 2026-11-02
-
Updated
Movable Type
Six Apart · CVE-2026-96408, CVE-2026-103668
Flaws in the upgrade and search scripts can allow arbitrary Perl code or SQL execution. The site search flaw can expose data, including unpublished data.
Latest announcement (Open external link)No exploitation reportPartially fixedWeb platforms and languages · Made in Japan
CVSS 9.4 (v3.0, JVN (JPCERT/CC))Japan: IPA
Details and sources (3 updates)
Affected and fixed versions
Movable Type 9.2.1, 9.0.9, 8.8.5, 8.0.12 and earlier, and Movable Type Premium 9.2.1, 9.0.9, 2.17 and earlier. End-of-life versions are also affected and have no fix.
Timeline and sources
- Vendor released fixed versions (9.3.0, 9.0.10, 8.8.6, 8.0.13, Premium 2.18 and others)Source (Open external link)
- JVN published a vulnerability noteSource (Open external link)
- IPA published an alertSource (Open external link)
Advisories
- Japan · IPASource (Open external link)
Why it is listed
Government advisory, Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
VMware Workstation and Fusion
Broadcom（VMware） · CVE-2026-59346, CVE-2026-59347
Fixes include a VMXNET3 integer overflow that lets an attacker with admin rights in a VM execute code on the host.
Latest announcement (Open external link)No exploitation reportFix availableBusiness apps and cloud
CVSS 9.3 (v3.1, VMware (Broadcom))No advisory
Details and sources (2 updates)
Affected and fixed versions
Workstation and Fusion before 26H1u1 (per CCCS).
Timeline and sources
- VMSA-2026-0007 publishedSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
-
Updated
NetScaler ADC / NetScaler Gateway
Cloud Software Group（Citrix） · CVE-2026-88771, CVE-2026-88772
Two flaws that can let unauthenticated remote attackers execute arbitrary code. Exploitation has been confirmed, including post-compromise activity such as web shell installation.
Latest announcement (Open external link)ExploitedFix availableNetwork appliances
CVSS 9.5 (v4.0, Cloud Software Group (CNA))Japan: JPCERT/CC, IPAAbroad: NCSC (UK)
Details and sources (4 updates)
Affected and fixed versions
Versions before 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 (FIPS and NDcPP). CVE-2026-88772 affects configurations with DTLS enabled.
Timeline and sources
- CISA added both CVEs to the KEV catalogSource (Open external link)
- JPCERT/CC published an alertSource (Open external link)
- The UK NCSC published an alert on active exploitationSource (Open external link)
- JPCERT/CC added indicators and guidance published by Mandiant and GTIGSource (Open external link)
Advisories
- Japan · JPCERT/CCSource (Open external link)
- Japan · IPASource (Open external link)
- Abroad · NCSC (UK)Source (Open external link)
Added to the CISA Known Exploited Vulnerabilities catalog on 2026.09.27
Why it is listed
Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)
Sources checked: 2026-11-03
-
Updated
WatchGuard Endpoint Security
WatchGuard · CVE-2026-13043
Missing authentication in the kernel memory access driver lets a local authenticated attacker read kernel and process memory.
Latest announcement (Open external link)No exploitation reportFix availableBusiness apps and cloud
CVSS 9.3 (v4.0, WatchGuard)No advisory
Details and sources (2 updates)
Affected and fixed versions
Endpoint Security for Windows before 8.00.26.0012.
Timeline and sources
- Advisory publishedSource (Open external link)
- Canada's CCCS issued an advisorySource (Open external link)
Why it is listed
Critical severity (CVSS 9.0+)
Sources checked: 2026-11-02
Coverage and terms
What is listed
- Vulnerabilities in Japan or abroad that meet at least one of the following: (1) an advisory from a government agency such as JPCERT/CC, IPA, Japan's National Cybersecurity Office, CISA or CERT-EU; (2) confirmed exploitation, through addition to CISA's KEV catalog or a report by the vendor or others; (3) critical severity (CVSS 9.0 or higher) in a widely used product; (4) service suspensions or emergency maintenance attributed to the vulnerability; (5) wide discussion on X (formerly Twitter).
- Several vulnerabilities announced together for the same product are listed as one entry. Follow-ups such as fixed releases, related new vulnerabilities and confirmed exploitation are added to the same entry's timeline.
- Initial coverage includes announcements and follow-ups from October 1, 2026. This is not a complete list of every vulnerability announced.
Reading each entry
- Severity is the CVSS score published by the vendor or a government agency, shown with the scorer and the CVSS version. Scores from different versions are not comparable.
- “Exploited” means the vulnerability was added to CISA's KEV catalog, or the vendor, a government agency or a security firm reported exploitation. “Public proof of concept” means a government agency or the vendor reported published exploit code.
- “Fix available” means fixed releases exist for all supported versions. “Partially fixed” means some versions, such as end-of-life releases, have no fix. “Mitigation only” means no fix has been released and the vendor has published a workaround.
- “Discussed on X” means wide discussion on X was confirmed through news or specialist media reports, or through summaries that aggregate reactions on X (such as Yahoo! Realtime Search). Individual posts on X are not used as sources.
- Remediation steps are not described here. Please refer to the advisories and vendor announcements linked in each entry.
Corrections
If an entry is wrong, or a new announcement has changed the facts, please let us know through the contact form. We will check and correct it.