CISA adds Chromium XML use-after-free CVE-2026-125350 to KEV
A crafted webpage can run code inside the Chromium sandbox; federal mitigation deadline is November 24.
Stories per day · 30 days
29 RSS
Relatedcisa76ivanti23connect-secure20zero-day19rce17authentication-bypass16pan-os15cisco13remote-code-execution12brotli11palo-alto10php2shell10command-injection9plex9cve-2026-1049358gitlab8php8sonicwall8
389 stories, newest first · one card per story
Stories tagged #kev
CISA flags Cisco BroadWorks flaw as actively exploited in attacks
Unauthenticated XXE CVE-2026-20320 lets attackers read BroadWorks files; FCEB agencies must remediate by November 24.
Microsoft patches 1,259 flaws, including exploited Outlook bug
Opening a crafted message can leak an NTLMv2 hash without Outlook’s usual warning.
Attackers exploit patched Barracuda flaws chained for root access
CISA gave federal agencies three days to patch both flaws after attacks on a small number of organizations.
1
Chrome patches exploited XML use-after-free zero-day CVE-2026-125350
The XML use-after-free is Chrome’s eighth zero-day this year; CISA wants users patched before November 24.
CISA KEV lists Outlook spoofing flaw CVE-2026-124194
An unauthorized attacker can spoof over the network without the expected user interaction; deadline is November 24.
1
Microsoft November patches list 1,094 CVEs; one Outlook flaw exploited
CISA added the exploited Outlook spoofing bug to KEV; a Windows Search flaw is called zero-click code execution.
CISA adds GPUStack, FreeSWITCH, OpenSSH, and Faspex flaws to KEV
Three flaws have confirmed exploitation; GPUStack and FreeSWITCH score 9.8 and allow admin or code execution.
CISA adds IBM Aspera Faspex flaw to KEV (CVE-2026-123218)
An authenticated user can craft a message to bypass authorization and escalate privileges; action is due November 12.
CISA BOD 26-04 tells agencies to prioritize patches by risk
Timelines depend on internet access, known exploitation, whether exploitation can be automated, and attacker control.
CISA adds six exploited vulnerabilities to its KEV catalog
Entries cover Cisco BroadWorks, Barracuda products, Outlook, and Chromium; FCEB agencies must prioritize them under BOD 26-04.
Kaspersky: Qilin led Q3 2026 ransomware leak-site victims
Opted-in detections blocked over 311 million online attacks, while 81,556 users encountered ransomware and 4,470 new variants appeared.
SonicWall patches seven SonicOS firewall flaws; CISA lists SAML bypass
Five of the Gen 7 and Gen 8 bugs allow unauthenticated remote attacks; only CVE-2026-19868 has a workaround.
Hackers use public Plex2Shell chain to hijack Plex servers and install miners
Four unauthenticated flaws, added to CISA’s KEV on October 20, run code as the Plex service; fixed in 1.43.3.10861.
1
CISA adds four exploited vulnerabilities to the KEV catalog
The additions cover GPUStack, FreeSWITCH, OpenSSH, and Aspera Faspex; federal agencies must prioritize exposed assets that yield full control.
Exploited SonicWall SSL-VPN flaw bypasses SAML-enforced MFA
Attackers with valid alternate credentials can skip SAML MFA; federal agencies must remediate by November 20, 2026.
1
Attackers probe WordPress upgrade-window RCE, CVE-2026-119977
Wordfence blocked over 240,000 attempts; CISA added the flaw to KEV on November 2.
CISA adds CVE-2026-19868 to Known Exploited Vulnerabilities Catalog
CISA has added CVE-2026-19868, affecting SonicWall SonicOS, to its KEV Catalog due to active exploitation.
CISA adds exploited Apple PAC bypass CVE-2024-27834 to KEV
Federal agencies must fix the flaw by November 18, 2026; Sekoia ties its use to APT29 with moderate to high confidence.
Zyxel GS1900 June patch missed flaw behind attacks on 996 switches
Binarly says all 10 June firmware releases still allow unauthenticated root commands; Zyxel shipped a later fix.
CISA adds WordPress flaw to KEV catalog
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog; Wordfence recorded over 18,500 exploitation attempts in 21 hours.
CISA adds WordPress Core TOCTOU flaw to KEV
CISA confirms active exploitation of CVE-2026-119977 allowing unauthenticated code execution during upgrades.
CISA adds WordPress TOCTOU vulnerability to KEV Catalog
CISA adds CVE-2026-119977, a TOCTOU race condition in WordPress Core, to KEV Catalog based on active exploitation.
CISA KEV: WordPress Core TOCTOU race condition CVE-2026-119977
WordPress Core upgrade TOCTOU vulnerability enables unauthenticated code execution during staging.