Week 44, 2026

26 October to 1 November 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 3,427
Critical: 309
High: 1,141
Added to KEV: 10

Critical 309High 1,141Medium 1,390Low 146Not scored 441All 3,427 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-111357
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…
Ivanti · Connect Secure
ExploitedHigh7.0
CVE-2026-118527
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…
Ivanti · Connect Secure
ExploitedMedium4.3
CVE-2026-97229
Integer Overflow or Wraparound in GitLab
GitLab · GitLab
ExploitedCritical10.0
CVE-2026-76418
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
ExploitedHigh8.6
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
Linux · Linux
ExploitedHigh7.8
CVE-2026-41709
ESX insufficient logging vulnerability
VMware · Cloud Foundation
ExploitedLow2.7
CVE-2026-48356
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe · Adobe Commerce
ExploitedCritical9.3
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
Google · Brotli
ExploitedCritical9.2
CVE-2026-109619
RCE via stale global state
PHP Group · PHP
ExploitedCritical9.2
CVE-2026-109618
RCE via OOM corruption
PHP Group · PHP
ExploitedCritical9.2

Most severe new CVEsBy CVSS score

CVE-2026-120276
WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection
WAVLINK · WN536AX6-A
Critical10.0
CVE-2026-120277
WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection
WAVLINK · WN536AX6-A
Critical10.0
CVE-2026-120198
WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
WAVLINK · WL-WN530BE1-A
Critical10.0
CVE-2026-120195
WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection
WAVLINK · WL-WN579A3-A
Critical10.0
CVE-2026-120189
D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow
D-Link · DIR-505
Critical10.0
CVE-2026-113897
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2.…
Apple · Safari
Critical10.0
CVE-2026-120338
Prefab UI Pyodide sandbox escape to host RCE
PrefectHQ · prefab-ui
Critical10.0
CVE-2026-61991
WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability
Ajax Load More · AjaxLoadMore Cache
Critical10.0
CVE-2026-116508
TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
TOTOLINK · A950RG
Critical10.0
CVE-2026-61738
SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)
socfortress · CoPilot
Critical10.0

Week 44, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses