Live CISA KEV catalog, FIRST EPSS exploitation scores, plain-English remediation guides, and curated cybersecurity news. Updated automatically from official feeds.
| CVE ID | Vendor & Product | Severity | Exploitation | Recommended Fix |
|---|---|---|---|---|
| CVE-2026-124194 2026-11-10 |
Microsoft Office |
MEDIUM 6.5 | KEV EPSS 1.62% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-111793 2026-11-10 |
Openwave Messaging Limited Webtop Media Transcoder |
MEDIUM 4.3 | KEV EPSS 0.64% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-20320 2026-11-10 |
Cisco BroadWorks |
HIGH 7.5 | KEV EPSS 0.82% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-111560 2026-11-10 |
Barracuda Networks Multiple Products |
HIGH 8.6 | KEV EPSS 6.20% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-116606 2026-11-10 |
Barracuda Networks Barracuda Email Security Gateway (ESG) |
CRITICAL 9.3 | KEV EPSS 8.93% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-125350 2026-11-10 |
Google Chromium |
HIGH 8.8 | KEV EPSS 0.96% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-102895 2026-11-09 |
GPUStack GPUStack |
CRITICAL 9.8 | KEV EPSS 0.52% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-123158 2026-11-09 |
OpenBSD OpenSSH |
HIGH 8.1 | KEV EPSS 18.90% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-116779 2026-11-09 |
SignalWire FreeSwitch |
CRITICAL 9.8 | KEV EPSS 2.47% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-123218 2026-11-09 |
IBM Aspera Faspex |
CRITICAL 9.8 | KEV EPSS 0.53% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-19868 2026-11-06 |
SonicWall SonicOS SSLVPN |
HIGH 8.8 | KEV EPSS 0.53% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2024-27834 2026-11-04 |
Apple Multiple Products |
HIGH 8.8 | KEV EPSS 1.50% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-119977 2026-11-03 |
WordPress WordPress Core |
HIGH 8.8 | KEV EPSS 1.20% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-118527 2026-10-30 |
Ivanti Connect Secure |
HIGH 8.8 | KEV EPSS 0.82% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-111357 2026-10-30 |
Ivanti Connect Secure |
HIGH 8.8 | KEV EPSS 0.53% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-97229 2026-10-29 |
GitLab Community Edition and Enterprise Edition |
HIGH 8.8 | KEV EPSS 69.29% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-76418 2026-10-29 |
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software |
HIGH 8.8 | KEV EPSS 0.82% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-41709 2026-10-28 |
Broadcom VMware ESX |
HIGH 8.8 | KEV EPSS 0.69% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-46300 2026-10-28 |
Linux Kernel |
HIGH 8.8 | KEV EPSS 16.13% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-48356 2026-10-27 |
Adobe Commerce and Magento |
HIGH 8.8 | KEV EPSS 47.47% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-111497 2026-10-27 |
Google Brotli |
HIGH 8.8 | KEV EPSS 82.64% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-109618 2026-10-26 |
PHP Group PHP |
HIGH 8.8 | KEV EPSS 100.00% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-109619 2026-10-26 |
PHP Group PHP |
HIGH 8.8 | KEV EPSS 100.00% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-114625 2026-10-23 |
Arista VeloCloud Orchestrator |
HIGH 8.8 | KEV EPSS 1.03% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-110447 2026-10-23 |
Collabora Collabora Online – Built-in CODE Server |
HIGH 8.8 | KEV EPSS 73.31% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-106931 2026-10-20 |
EG Secure Solutions SiteGuard Server Edition |
HIGH 8.8 | KEV EPSS 2.53% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-96656 2026-10-20 |
Plex Media Server |
HIGH 8.8 | KEV EPSS 1.79% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-96655 2026-10-20 |
Plex Media Server |
HIGH 8.8 | KEV EPSS 10.72% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-96654 2026-10-20 |
Plex Media Server |
HIGH 8.8 | KEV EPSS 1.95% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-96652 2026-10-20 |
Plex Media Server |
HIGH 8.8 | KEV EPSS 11.89% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-110936 2026-10-20 |
Siemens Software Center |
HIGH 8.8 | KEV EPSS 0.97% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-102764 2026-10-16 |
BeyondTrust Remote Support |
HIGH 8.8 | KEV EPSS 79.48% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2025-61624 2026-10-16 |
Fortinet Multiple Products |
HIGH 8.8 | KEV EPSS 1.40% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-21589 2026-10-15 |
Atlassian Multiple Products |
HIGH 8.8 | KEV EPSS 99.66% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-105134 2026-10-14 |
Ahsay AhsayCBS |
HIGH 8.8 | KEV EPSS 81.76% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
| CVE-2026-76519 2026-10-14 |
Cisco Secure Email Gateway |
HIGH 8.8 | KEV EPSS 6.23% | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit |
A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week's trouble starts right there. Attackers are u...
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year. It...
A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs no account. When it is ...
Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass. The critical vulnerabilities that impact NetScale...
Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches. This delivery pattern ha...
The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG)...
View CSAF Summary On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-...
View CSAF Summary Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult an...
View CSAF Summary Palo Alto Networks has published information on a vulnerability in PAN-OS related to the Node2Shell vulnerability. This advisory lists the related Siemens Industrial products affected by this vulnerability. Customers are advised to consult an...
View CSAF Summary On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619)...
View CSAF Summary Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the affected Brotl...
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability CVE-2026-111560 Ba...