Skip to main content
cve.nowby Sazabi
This week

The cve.now Index, 2026-W44

The worst CVEs published or escalated Oct 26, 2026 to Nov 1, 2026, ranked as the week closed. Movement is against the week before. How the score works.

  1. 195GitLabCVE-2026-97229GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected. The fix is in 19.2.8, 19.3.5, and 19.4.2.KEVMetasploitEPSSFixed in 19.2.8, 19.3.5, 19.4.2Added to KEV
  2. 292Google Brotli · node +6CVE-2026-111497Affects Node.js 22.x, 24.x and 26.x applications that decompress attacker-supplied Brotli data with node:zlib. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.KEVExploit publicEPSSFixed in 1.0.10, 1.1.1, 1.2.1, 22.23.4Added to KEV
  3. 392PHP Group PHPCVE-2026-109618Affects PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, including the Apache mod_php SAPI. The fix is in the matching fixed release for each branch.KEVExploit publicEPSSNucleiFixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12Added to KEV
  4. 492PHP Group PHPCVE-2026-109619Affects PHP builds older than 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on their branches, where session upload progress is enabled by default. Fixed in those releases.KEVEPSSFixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12Added to KEV
  5. 591BerriAI litellm · litellmCVE-2026-42208LiteLLM, an open-source proxy server that routes calls to LLM APIs in OpenAI-compatible format, is affected by this vulnerability. An unauthenticated attacker could exploit it to read, and possibly modify, data in the p…KEVEPSSFixed in 1.83.7EPSS crossed 10%
  6. 691PGoogle ChromeCVE-2026-5281Google Chrome's Dawn graphics component contains a memory-safety flaw that could let an attacker who has already taken control of the browser's renderer process run arbitrary code on the affected system. The attack coul…KEVEPSSFixed in 146.0.7680.178ProvisionalEPSS crossed 10%
  7. 790PMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1CVE-2026-42897Microsoft Exchange Server is affected by this vulnerability, which stems from improper handling of input in web page generation (cross-site scripting). An unauthorized attacker over a network could exploit it to perform…KEVEPSSFixed in 15.01.2507.069, 15.02.1544.041, 15.02.1748.046, 15.02.2562.043ProvisionalEPSS crossed 10%
  8. 890PIvanti Endpoint Manager MobileCVE-2026-6973Ivanti Endpoint Manager Mobile (EPMM), a mobile device management product, is affected by this vulnerability. An attacker who already has administrative login access to the product could exploit improper input handling…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
  9. 988Ivanti Connect SecureCVE-2026-111357Affects Ivanti Connect Secure 22.8R2.4 (Build 19097) appliances, where an attacker who already has code execution as the cgi-server user can escalate to root. The checked facts name no fixed release.KEVNo patch listed yetAdded to KEV
  10. 1085Fortinet FortiNACCVE-2022-39952MetasploitEPSSNucleiNo patch listed yetEPSS crossed 10%
  11. 1185GitLabCVE-2023-2825MetasploitEPSSNucleiNo patch listed yetEPSS crossed 10%
  12. 1285Genetech Solutions WordPress Pie Register PluginCVE-2025-34077MetasploitExploit publicEPSSNucleiNo patch listed yetEPSS crossed 10%
  13. 1384LinuxCVE-2026-46300The Linux kernel's core networking packet-buffer code (sk_buff handling, specifically skb_try_coalesce() used during TCP receive coalescing) is affected. The flaw can cause packets carrying externally owned or page-cach…KEVMetasploitExploit publicEPSSFixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141Added to KEV
  14. 1481VMware Cloud Foundation · VMware vSphere Foundation +2CVE-2026-41709Affects VMware ESX 8.0, 9.0.x and 9.1.x builds before the fixed releases, and VMware Cloud Foundation 5.x before 5.2.4. Fixed in ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025 and ESXi-9.1.0.0-25370933.KEVFixed in 5.2.4, ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389Added to KEV
  15. 1581rayCVE-2023-48022MetasploitEPSSNucleiNo patch listed yetEPSS crossed 10%
  16. 1680PApache Software Foundation Apache Tomcat · org.apache.to… +1CVE-2026-34486Apache Tomcat, a widely used open-source Java web server, is affected. A flaw in a fix for an earlier issue allows the EncryptInterceptor protection to be bypassed, so sensitive data sent between clustered Tomcat nodes…KEVEPSSFixed in 11.0.21, 10.1.54, 9.0.117ProvisionalEPSS crossed 10%
  17. 1780vercel next.js · nextCVE-2025-29927MetasploitExploit publicEPSSNucleiFixed in 12.3.5, 14.2.25, 15.2.3, 13.5.9EPSS crossed 10%
  18. 1880rails · activestorageCVE-2026-66066MetasploitEPSSFixed in 7.2.3.2, 8.0.5.1, 8.1.3.1EPSS crossed 10%
  19. 1979Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…CVE-2026-76418Affects Cisco ASA and Secure Firewall Threat Defense software with SSL VPN enabled and secondary authentication set in a tunnel group. CVSS rates it 8.6 (high). Cisco has released fixes, with no fixed versions listed in…KEVNo patch listed yetAdded to KEV
  20. 2079ValvePress WordPress Automatic PluginCVE-2021-4374MetasploitEPSSNucleiFixed in 3.53.3EPSS crossed 10%
  21. 2177aquasecurity setup-trivy · aquasecurity trivy-action +6CVE-2026-33634Affects Trivy v0.69.4 (or latest during the exposure window), trivy-action tags 0.0.1 to 0.34.2, and setup-trivy used without version or SHA pinning. Fixed in Trivy 0.69.2 and 0.69.3, trivy-action 0.35.0, and setup-triv…KEVEPSSFixed in 0.2.6, 0.35.0EPSS crossed 10%
  22. 2277POracle PaymentsCVE-2026-46817The vulnerability affects the Oracle Payments module of Oracle E-Business Suite, specifically its File Transmission component. An unauthenticated remote attacker over the network can easily exploit it to take over Oracl…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
  23. 2376PostgreSQLCVE-2025-1094MetasploitEPSSFixed in 17.3, 16.7, 15.11, 14.16EPSS crossed 10%
  24. 2475OpenTSDB · net.opentsdb:opentsdbCVE-2023-25826MetasploitEPSSNucleiNo patch listed yetEPSS crossed 10%
  25. 2575pyload-ngCVE-2024-39205MetasploitEPSSNo patch listed yetEPSS crossed 10%

Is one of these in your stack? Scan your lockfile, or let Sazabi watch production for you.