cisa-kev

Patch now · Exploited · ◐Partly patched · since 13 Nov 2026 · CVE-2026-114713

UnrealIRCd contains an improper neutralization of delimiters vulnerability allowing network users to inject server-to-server commands executed with server authority. CISA added the flaw to its Known Exploited Vulnerabilities catalog following confirmation of active attacks.

Do:Apply mitigations in accordance with vendor instructions and CISA guidance.

Patch now · Exploited · ●Patched · since 13 Nov 2026 · CVE-2026-123039

Attackers exploited PHP2Shell for initial compromise alongside CVE-2026-123039 to elevate privileges to root on Check Point Gateways. The targeted attacks resulted in destructive gateway impacts.

Do:Apply the emergency hotfixes provided by the vendor immediately.

Patch now · Exploited · ◐Partly patched · since 10 Nov 2026 · updated 11 Nov 2026 · CVE-2026-111560

An OS command injection vulnerability in multiple Barracuda Networks products allows authenticated administrators to execute root commands via a crafted timezone value. CISA confirmed exploitation in the wild and added the flaw to its KEV catalog.

Do:Apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance.

Patch now · Exploited · ◐Partly patched · since 10 Nov 2026 · updated 11 Nov 2026 · CVE-2026-20320

An improper restriction of XML external entity reference vulnerability in Cisco BroadWorks allows unauthenticated attackers to read sensitive configuration information. CISA confirmed exploitation in the wild and added the flaw to its KEV catalog.

Do:Apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance.

Patch now · Exploited · ◐Partly patched · since 10 Nov 2026 · CVE-2026-111793

An incorrect resource transfer between spheres vulnerability in Openwave Messaging Limited Webtop Media Transcoder allows authenticated users to process unintended document types. CISA confirmed exploitation in the wild and added the flaw to its KEV catalog.

Do:Apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance.

Patch now · Exploited · ●Patched · since 10 Nov 2026 · updated 11 Nov 2026 · CVE-2026-124194

Microsoft addressed a heavily exploited zero-day vulnerability in Outlook during its November 2026 Patch Tuesday updates. The flaw is part of a broader batch of security fixes released by the vendor.

Do:Apply the latest security updates provided by Microsoft for Outlook.

Patch now · Exploited · ◐Partly patched · since 6 Nov 2026 · updated 11 Nov 2026 · CVE-2026-125350

An anonymous report disclosed a high-severity use-after-free flaw in Google Chrome's XML component. The vulnerability is currently being exploited in active attacks in the wild.

Do:Update Google Chrome to the latest version immediately.

Patch now · Exploited · ●Patched · since 5 Nov 2026 · updated 9 Nov 2026 · CVE-2026-123158

A critical flaw in OpenSSH allowed authentication bypass using overly long passwords on Alpine Linux servers. The vendor released OpenSSH 10.6p2 to fix the issue and Alpine published patched packages.

Do:Update OpenSSH to version 10.6p2 and ensure Alpine packages are upgraded

Patch now · Exploited · ●Patched · since 3 Nov 2026 · updated 6 Nov 2026 · CVE-2026-119977

WordPress core contains a time-of-check time-of-use race condition vulnerability allowing unauthenticated attackers to execute code via predictable staging paths during upgrades. CISA added the flaw to its known exploited vulnerabilities catalog following confirmed in-the-wild exploitation.

Do:Block web access to the staging directory while applying WordPress updates to prevent race condition exploitation during the installation phase.

Patch now · Exploited · ●Patched · since 3 Nov 2026 · updated 10 Nov 2026 · CVE-2026-116606

Barracuda disclosed two vulnerabilities, including CVE-2026-116606 with a CVSS score of 9.3, that can be chained to bypass authorization controls. Successful exploitation allows attackers to gain root access to susceptible appliances.

Do:Apply the security updates released by Barracuda to patch the vulnerabilities.

Patch now · Exploited · ●Patched · since 28 Oct 2026 · updated 2 Nov 2026 · CVE-2026-97229

An attacker attempted to exploit a CVSS 10.0 remote code execution flaw in GitLab on Alpine Linux's server. Alpine reported no evidence of successful compromise following the attack.

Do:Update GitLab to the latest patched version.

Patch now · Exploited · ◐Partly patched · since 26 Oct 2026 · updated 4 Nov 2026 · CVE-2026-111497, CVE-2026-106072, CVE-2026-106069 +3

An out-of-bounds write vulnerability in Google's Brotli decoder affects multiple runtimes including Node.js and Python packages. Vendors are issuing updates to address potential code execution risks.

Do:Update PHP Windows packages to the latest patched releases.

Patch now · Exploited · ●Patched · since 29 Oct 2026 · CVE-2026-76418

Patch now · Exploited · ●Patched · since 27 Oct 2026 · CVE-2026-48356

Patch now · Exploited · ●Patched · since 26 Oct 2026 · updated 29 Oct 2026 · CVE-2026-109619, CVE-2026-109618

Patch now · Exploited · since 17 Jul 2026 · CVE-2026-9198

Patch now · Exploited · since 23 Jun 2026 · updated 23 Jun 2026 · CVE-2026-55255

Patch now · Exploited · since 7 Apr 2025 · updated 17 Jun 2025 · CVE-2025-3248