Week 45, 2026

2–8 November 2026

New CVEs: 3,358
Critical: 310
High: 1,199
Newly exploited: 3
Advisories: 539
Malicious pkgs: 279

Newly exploited 3

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 7.5
CVE-2026-19868 KEV Nov 6, 2026 An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass …
SonicWall · SonicOS
Medium 5.5
CVE-2024-27834 KEV Nov 4, 2026 The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tv…
Apple · macOS · iOS and iPadOS · watchOS

EPSS 1.5%
High 8.1
CVE-2026-119977 KEV Nov 3, 2026 WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Foundation · WordPress

EPSS 1.2%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.1
CVE-2026-121931 Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection
Linksys · WRT54GL

EPSS 2.7%
Critical 9.1
CVE-2026-121930 Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection
Linksys · WRT54GL

EPSS 2.7%
Critical 10.0
CVE-2026-122051 Edimax BR-6208AC mp command injection
Edimax · BR-6208AC

EPSS 2.6%
Critical 10.0
CVE-2026-121932 Linksys E5350 apply.cgi system os command injection
Linksys · E5350

EPSS 2.4%
Critical 10.0
CVE-2026-121607 Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
Qihoo 360 · D600-2 · D603-2 · D606-6

EPSS 2%
Critical 10.0
CVE-2026-120345 WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
WAVLINK · WN551X3-A

EPSS 2%
Critical 10.0
CVE-2026-120344 WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
WAVLINK · WN551X3-A

EPSS 2%
Critical 10.0
CVE-2026-120280 WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection
WAVLINK · WN536AX6-A

EPSS 2%
Critical 10.0
CVE-2026-120279 WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
WAVLINK · WN536AX6-A

EPSS 2%
Critical 9.9
CVE-2026-17402 IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS co…
IBM · API Connect

EPSS 1.9%
Critical 9.8
CVE-2026-120442 ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
xianhc · ape-volo-admin

EPSS 1.7%
Critical 9.9
CVE-2026-120282 WAVLINK WN536AX6-A protocol.csp host_black os command injection
WAVLINK · WN536AX6-A

EPSS 1.7%
Critical 9.9
CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX)
AWS · trusted-remote-execution

EPSS 1.6%
Critical 9.9
CVE-2026-28336 SolarWinds Dameware Command Injection Vulnerability
SolarWinds · Dameware

EPSS 1.6%
Critical 9.8
CVE-2026-86596 s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
clavaque · s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

EPSS 1.5%

All 310 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.8
CVE-2026-77690 Command injection vulnerability
Zohocorp · ManageEngine Key Manager Plus

EPSS 16%
Medium 4.8
CVE-2026-121943 Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet
irontec · sngrep

EPSS 5.6%
High 7.2
CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php
Nagios Enterprises · Nagios XI

EPSS 4.1%
High 7.7
CVE-2026-69137 SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
SuiteCRM · SuiteCRM

EPSS 3.8%
High 8.2
CVE-2026-92198 Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability
Quest · Foglight for Databases

EPSS 2.8%
High 8.8
CVE-2026-18199 Remote Code Execution Vulnerability
Zohocorp · ManageEngine PAM360 · ManageEngine Password Manager Pro

EPSS 2.5%
High 8.8
CVE-2026-77876 Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
Control Web Panel · Control Web Panel

EPSS 2.3%
High 8.7
CVE-2026-8923 Remote Code Execution
Zohocorp · ManageEngine Log360 · ManageEngine Eventlog Analyzer

EPSS 2.2%

Advisories

USN-8959-1 linux, linux-aws, linux-gcp, linux-hwe-7.0, linux-ibm, linux-oracle vulnerabilities 2894 CVEs
USN-8960-1 linux-oem-7.0 vulnerabilities 2889 CVEs
USN-8963-1 linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx vulnerabilities 2016 CVEs
USN-9003-1 linux-nvidia-7.0, linux-nvidia-bos vulnerabilities 1150 CVEs
SUSE-SU-2026:5091-1 Security update for the Linux Kernel 1077 CVEs
USN-8961-1 linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-realtime vulnerabilities 1068 CVEs
SUSE-SU-2026:24550-1 Security update for the Linux Kernel 1056 CVEs
USN-8962-1 linux-azure-fde vulnerabilities 756 CVEs
USN-9002-1 linux-nvidia-tegra vulnerabilities 485 CVEs
openSUSE-SU-2026:12426-1 chromedriver-157.0.8103.38-1.1 on GA media 213 CVEs