Week 44, 2026

26 October – 1 November 2026

New CVEs: 3,479
Critical: 327
High: 1,275
Newly exploited: 10
Advisories: 571
Malicious pkgs: 194

Newly exploited 10

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 7.0
CVE-2026-111357 KEV Oct 30, 2026 Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, …
ivanti · Connect Secure
Medium 4.3
CVE-2026-118527 KEV Oct 30, 2026 Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacke…
ivanti · Connect Secure
Critical 10.0
CVE-2026-97229 KEV Oct 29, 2026 Integer Overflow or Wraparound in GitLab
GitLab · GitLab

EPSS 65%
High 8.6
CVE-2026-76418 KEV Oct 29, 2026 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
Cisco · Cisco Secure Firewall Threat Defense (FTD) Software · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
High 7.8
CVE-2026-46300 KEV Oct 28, 2026 net: skbuff: preserve shared-frag marker during coalescing
Linux · Linux

EPSS 16%
Low 2.7
CVE-2026-41709 KEV Oct 28, 2026 ESX insufficient logging vulnerability
VMware · Telco Cloud Platform · Cloud Foundation · vSphere Foundation
Critical 9.3
CVE-2026-48356 KEV Oct 27, 2026 Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe · Adobe Commerce · Magento Open Source · Adobe Commerce B2B

EPSS 47%
Critical 9.2
CVE-2026-111497 KEV Oct 27, 2026 Out-of-Bounds Write in Google Brotli Decoder
Google · Brotli

EPSS 83%
Critical 9.2
CVE-2026-109618 KEV Oct 26, 2026 RCE via OOM corruption
PHP Group · PHP

EPSS 100%
Critical 9.2
CVE-2026-109619 KEV Oct 26, 2026 RCE via stale global state
PHP Group · PHP

EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2026-120276 WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection
WAVLINK · WN536AX6-A

EPSS 3.2%
Critical 9.1
CVE-2026-120229 WAVLINK WN553X1-B ioos sub_416B50 os command injection
WAVLINK · WN553X1-B

EPSS 2.8%
Critical 9.1
CVE-2026-116505 TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection
Totolink · A950RG

EPSS 2.7%
Critical 10.0
CVE-2026-120277 WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection
WAVLINK · WN536AX6-A

EPSS 2.5%
Critical 9.8
CVE-2026-116485 danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
huangxd- · danmu_api

EPSS 2.3%
Critical 9.9
CVE-2026-120230 WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
WAVLINK · WN701AE

EPSS 2.2%
Critical 9.9
CVE-2026-120227 WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
WAVLINK · WN701AE

EPSS 2.2%
Critical 9.8
CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities
IBM · Langflow OSS

EPSS 2.2%
Critical 10.0
CVE-2026-120198 WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
WAVLINK · WL-WN530BE1-A

EPSS 2.1%
Critical 10.0
CVE-2026-120195 WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection
WAVLINK · WL-WN579A3-A

EPSS 2.1%
Critical 9.9
CVE-2026-116506 TOTOLINK A950RG firewall.so apmib_set command injection
Totolink · A950RG

EPSS 1.9%
Critical 9.9
CVE-2026-120240 WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
WAVLINK · WN553X1-B

EPSS 1.7%
Critical 9.9
CVE-2026-120239 WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection
WAVLINK · WN553X1-B

EPSS 1.7%
Critical 9.9
CVE-2026-120238 WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection
WAVLINK · WN553X1-B

EPSS 1.7%
Critical 9.9
CVE-2026-120231 WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
WAVLINK · WN553X1-B

EPSS 1.7%

All 327 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

openSUSE-SU-2026:21624-1 Security update for chromium 438 CVEs
openSUSE-SU-2026:21799-1 Security update for chromium 365 CVEs
openSUSE-SU-2026:22185-1 Security update for chromium 353 CVEs
openSUSE-SU-2026:22124-1 Security update for chromium 293 CVEs
openSUSE-SU-2026:21921-1 Security update for chromium 288 CVEs
openSUSE-SU-2026:12339-1 MozillaThunderbird-153.6.0-1.1 on GA media 153 CVEs
openSUSE-SU-2026:22023-1 Security update for chromium 151 CVEs
SUSE-SU-2026:4928-1 Security update for MozillaFirefox 147 CVEs
openSUSE-SU-2026:12319-1 firefox-esr-153.6.0-1.1 on GA media 144 CVEs
SUSE-SU-2026:4940-1 Security update for the Linux Kernel 108 CVEs