CISA adds Cisco BroadWorks XXE flaw to KEV (CVE-2026-20320)
An unauthenticated remote attacker can read sensitive configuration; the federal remediation due date is November 24.
Stories per day · 30 days
9 RSS
Relatedbod-26-048remote-code-execution7zero-day7microsoft6patch-tuesday6php6windows6php2shell5linux-kernel4vmware4authentication-bypass3barracuda3cve-2026-969513memory-corruption3rce3alpine-linux2broadcom2brotli2
64 stories, newest first · one card per story
Stories tagged #cisa-kev
Microsoft November 2026 patches fix 1235 flaws, one exploited in Outlook
CISA added Outlook spoofing flaw CVE-2026-124194 to KEV and set a November 24, 2026 patch deadline.
1
CISA lists Barracuda ESG auth bypass in KEV (CVE-2026-116606)
An unauthenticated attacker can restore a crafted backup and change global configuration; the due date is November 13.
1
CISA adds SignalWire FreeSwitch code injection to KEV (CVE-2026-116779)
The flaw can expose configuration and credentials, control calls, and execute commands; action is due November 12.
Microsoft Patch Tuesday discloses 1,093 bugs, including exploited Outlook flaw
CISA ordered agencies to patch exploited Outlook, Barracuda and other bugs, with Outlook due by month’s end.
CISA confirms active exploitation of OpenSSH SSHole bypass
Remote attackers can log into certain Linux accounts without a password when OpenSSH before 10.6p2 uses musl without PAM.
CISA adds Openwave Webtop Media Transcoder flaw to KEV (CVE-2026-111793)
An authenticated user who bypasses Webmail can process unintended document types; federal due date is November 24.
SonicWall SSL-VPN MFA bypass flaw exploited in attacks
CISA added CVE-2026-19868 to KEV after exploitation; affects SonicOS SSL-VPN with SAML MFA
1
CISA adds GPUStack improper authentication flaw to KEV (CVE-2026-102895)
Unauthenticated callers can change users and models, create admin API keys, read secrets, and execute code.
CISA lists OpenSSH auth bypass in KEV catalog (CVE-2026-123158)
Federal agencies must apply vendor mitigations or stop using the product by November 12, 2026.
WordPress update race exposes sites to exploited CVE-2026-119977
WordPress 4.7-7.1.3 vulnerable to actively exploited race condition during core updates allowing remote code execution.
Recorded Future identifies 82 high-impact CVEs in October 2026
Insikt Group notes 52 Very Critical Risk Scores and CISA KEV coverage for 36 vulnerabilities among 82 high-impact CVEs.
2
Ivanti Connect Secure zero-days CVE-2026-111357 and CVE-2026-118527 exploited in the wild
Two zero-days in Ivanti Connect Secure allow local privilege escalation and remote file upload; chained with CVE-2026-104935 for unauthenticated root access; fixed in 25.1.1.3 and 22.8R2.6
1
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Chained zero-days in Ivanti Connect Secure VPN enabled root access and data exfiltration; Volexity attributes activity to UTA0576.
2
Max-severity GitLab flaw exploited against Alpine Linux
CVE-2026-97229 allows unauthenticated code execution; Alpine rebuilt its instance, and CISA gave agencies three days to patch.
1
CISA adds VMware ESX and Linux kernel flaws to KEV
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
1
Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
1
CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
CISA lists exploited VMware ESX logging flaw CVE-2026-41709
An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.
Canada updates VMware advisory after two CVEs enter CISA KEV
CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP2Shell cleanup will lag exploitation; Token Security argues identity limits matter more than CVSS
Censys counted 32.5 million internet-facing PHP services on vulnerable versions a week after patching, and CISA added both flaws to its KEV list on October 26.
CISA adds VMware ESX and Linux kernel flaws to KEV
CVE-2026-41709 and CVE-2026-46300 are actively exploited; BOD 26-04 requires FCEB agencies to prioritize them.
CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.