Skip to content
CVE Tracker

Week 44, 2026

26 October to 1 November 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
3,427
Critical
300
High
1,092
Added to KEV
10

Critical 300High 1,092Medium 1,351Low 137Not scored 547All 3,427 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2026-111357

    Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…

    Ivanti · Connect Secure

    ExploitedHigh7.0
  • CVE-2026-118527

    Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…

    Ivanti · Connect Secure

    ExploitedMedium4.3
  • CVE-2026-97229

    Integer Overflow or Wraparound in GitLab

    GitLab · GitLab

    ExploitedCritical10.0
  • CVE-2026-76418

    Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

    Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

    ExploitedHigh8.6
  • CVE-2026-46300

    net: skbuff: preserve shared-frag marker during coalescing

    Linux · Linux

    ExploitedHigh7.8
  • CVE-2026-41709

    ESX insufficient logging vulnerability

    VMware · Cloud Foundation

    ExploitedLow2.7
  • CVE-2026-48356

    Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

    Adobe · Adobe Commerce

    ExploitedCritical9.3
  • CVE-2026-111497

    Out-of-Bounds Write in Google Brotli Decoder

    Google · Brotli

    ExploitedCritical9.2
  • CVE-2026-109619

    RCE via stale global state

    PHP Group · PHP

    ExploitedCritical9.2
  • CVE-2026-109618

    RCE via OOM corruption

    PHP Group · PHP

    ExploitedCritical9.2

Most severe new CVEsBy CVSS score

  • CVE-2026-120276

    WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-120277

    WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-120198

    WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection

    WAVLINK · WL-WN530BE1-A

    Critical10.0
  • CVE-2026-120195

    WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection

    WAVLINK · WL-WN579A3-A

    Critical10.0
  • CVE-2026-120189

    D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow

    D-Link · DIR-505

    Critical10.0
  • CVE-2026-120338

    Prefab UI Pyodide sandbox escape to host RCE

    PrefectHQ · prefab-ui

    Critical10.0
  • CVE-2026-61991

    WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

    Ajax Load More · AjaxLoadMore Cache

    Critical10.0
  • CVE-2026-116508

    TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

    TOTOLINK · A950RG

    Critical10.0
  • CVE-2026-61738

    SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)

    socfortress · CoPilot

    Critical10.0
  • CVE-2026-84295

    Improper Authentication in Progress WS_FTP Server

    Progress Software · WS_FTP Server

    Critical10.0

Vendors with the most CVEs

  1. Apple328
  2. Mozilla176
  3. Linux129
  4. Drupal106
  5. Google75
  6. Dell65
  7. Apache Software Foundation53
  8. Red Hat44
  9. IBM33
  10. Tanium31

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)371
  2. CWE-862 Missing authorization248
  3. CWE-125 Out-of-bounds read109
  4. CWE-787 Out-of-bounds write106
  5. CWE-863 Incorrect authorization101
  6. CWE-22 Path traversal98
  7. CWE-89 SQL injection93
  8. CWE-78 OS command injection91
  9. CWE-416 Use after free90
  10. CWE-502 Deserialization of untrusted data86