60
47
60
Yet another Chrome zero-day exploited in the wild! (CVE-2023-5217)
60
Update Chrome Browser Now to Patch New Actively Exploited Zero
60
57
Microsoft December 2021 Patch Tuesday fixes an actively exploited zero
60
SonicWall Urges Customers to Immediately Patch Critical SMA 100 Flaws
60
Critical HPE Vulnerabilities Allow Remote Attackers to Achieve Complete System Compromise
HPE patched critical EdgeConnect SD-WAN flaws, including CVSS 9.8 unauthenticated API bypass and gateway RCE, enabling full system compromise.
HPE Security Bulletin HPESBNW05135 covers critical flaws in EdgeConnect SD-WAN Orchestrator and Gateways: CVE-2026-76669 and CVE-2026-76670 (CVSS 9.9 authorization bypass/privilege escalation), CVE-2026-76672 (CVSS 9.9, leaks third-party API tokens and credentials), CVE-2026-76673 (CVSS 9.8, unauthenticated Orchestrator API authentication bypass granting administrative privileges), and CVE-2026-76674 (CVSS 9.8, unauthenticated buffer overflow enabling arbitrary code execution on gateways). Fixes are available in ECOS 9.7.1.0/9.6.4.0/9.5.9.0/9.4.9.0 and Orchestrator 9.7.1/9.6.4/9.5.9/9.4.11 or later. HPE reported no public exploit code or active exploitation at publication and recommends isolating management interfaces on a dedicated VLAN.
70
60
U.S. CISA adds DD-WRT, Langflow and WordPress flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
47
35
Multiple flaws in Fortinet FortiOS fixed
60
60
60
47
42
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities—Fortinet buffer overflow, Citrix NetScaler and Cisco auth bypasses, and a Chromium V8 write—to the KEV Catalog.
CISA added CVE-2025-25249 (Fortinet heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass), CVE-2026-87491 (Google Chromium V8 out-of-bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these high-risk vulnerabilities on exposed assets and verify whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.
75
60
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
60
47
USN-8737-2: GNU C Library vulnerabilities
Ubuntu extends glibc fixes to 24.04 LTS, patching buffer overflow in strfmon and out-of-bounds access in tdelete, both potentially leading to code execution.
USN-8737-2 provides the Ubuntu 24.04 LTS counterpart to fixes released in USN-8737-1 for GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in strfmon when handling right-justification padding, potentially allowing denial of service or arbitrary code execution on Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in tdelete that could also result in denial of service or code execution.
26
42
42
60
42
55
60
60
Unbound: 1.26.1 addresses multiple CVE items
Unbound 1.26.1 fixes critical heap buffer overflow CVE-2026-81642 in DNSKEY digesting that may allow remote code execution.
NLnet Labs released Unbound 1.26.1 on September 16 as a security release fixing several vulnerabilities, most notably CVE-2026-81642, rated CRITICAL, a heap buffer overflow during DNSKEY digesting that can possibly lead to remote code execution. Unbound is a widely deployed DNS recursive resolver and validating resolver. Administrators should upgrade promptly.
62
Google addresses Chrome zero
60
60
35
55
55