Week 46, 2026

9–15 November 2026 · in progress, updated hourly

New CVEs: 3,280
Critical: 164
High: 1,549
Newly exploited: 10
Advisories: 296
Malicious pkgs: 120

Newly exploited 10

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.3
CVE-2026-116606 KEV Nov 10, 2026 Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
Barracuda Networks · Barracuda Email Security Gateway (ESG)

EPSS 1.6%
High 8.8
CVE-2026-125350 KEV Nov 10, 2026 Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (…
Google · Chrome
High 8.6
CVE-2026-111560 KEV Nov 10, 2026 OS Command Injection in Barracuda Appliances
Barracuda Networks · Barracuda Email Security Gateway (ESG) · Barracuda Web Application Firewall (WAF) · Barracuda Message Archiver (BMA)

EPSS 1.1%
High 7.5
CVE-2026-20320 KEV Nov 10, 2026 A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configurati…
Cisco · Cisco BroadWorks
Medium 6.5
CVE-2026-124194 KEV Nov 10, 2026 Microsoft Outlook Spoofing Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024
Medium 4.3
CVE-2026-111793 KEV Nov 10, 2026 Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an au…
Openwave Messaging (Ireland) · Webtop Media Transcoder
Critical 9.8
CVE-2026-123218 KEV Nov 9, 2026 IBM Aspera Faspex Authorization Bypass
IBM · Aspera Faspex
Critical 9.8
CVE-2026-102895 KEV Nov 9, 2026 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
gpustack · gpustack
Critical 9.8
CVE-2026-116779 KEV Nov 9, 2026 FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
signalwire · freeswitch

EPSS 2.2%
High 8.1
CVE-2026-123158 KEV Nov 9, 2026 sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretati…
OpenBSD · OpenSSH

EPSS 17%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

All 164 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.2
CVE-2026-125391 Webmin through 2.670 OS Command Injection via Samba User Account Options
Webmin · Webmin

EPSS 1.4%
High 8.0
CVE-2026-125399 Fluxion before 6.39 OS Command Injection via Crafted SSID
FluxionNetwork · fluxion

EPSS 1.3%
High 8.8
CVE-2026-94434 OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair
TÜBİTAK BİLGEM Software Technologies Research Institute · Pardus Boot Repair

EPSS 1.3%
High 8.7
CVE-2026-88710 Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of a…
ASUS · Router firmware

EPSS 1.2%

Advisories

USN-9021-1 linux-raspi vulnerabilities 4311 CVEs
USN-9025-1 linux-oracle-6.8, linux-raspi, linux-raspi-realtime vulnerabilities 3498 CVEs
USN-9024-1 linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8 vulnerabilities 3276 CVEs
USN-9026-1 linux-azure-6.8, linux-azure-fde-6.8 vulnerabilities 3275 CVEs
USN-9019-1 linux-azure vulnerabilities 3273 CVEs
USN-9020-1 linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime vulnerabilities 3268 CVEs
USN-9022-1 linux, linux-aws, linux-azure, linux-azure-fips, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oracle, linux-vmware vulnerabilities 2236 CVEs
USN-9023-1 linux-aws-fips, linux-gcp-fips, linux-gkeop, linux-realtime vulnerabilities 2235 CVEs
USN-9029-1 linux-raspi vulnerabilities 2020 CVEs
USN-9018-1 linux, linux-aws, linux-gcp, linux-ibm, linux-oem-7.0, linux-oracle vulnerabilities 379 CVEs