Skip to content
CVE Tracker

Week 45, 2026

2 November to 8 November 2026, so far. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
1,463
Critical
110
High
518
Added to KEV
1

Critical 110High 518Medium 505Low 59Not scored 271All 1,463 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2026-119977

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    WordPress Foundation · WordPress

    ExploitedHigh8.1

Most severe new CVEsBy CVSS score

  • CVE-2026-121607

    Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection

    Qihoo 360 · D603-2

    Critical10.0
  • CVE-2026-120345

    WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection

    WAVLINK · WN551X3-A

    Critical10.0
  • CVE-2026-120344

    WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection

    WAVLINK · WN551X3-A

    Critical10.0
  • CVE-2026-120280

    WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-120279

    WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-121615

    Linksys E5600 Login mesh_login.cgi improper authentication

    Linksys · E5600

    Critical10.0
  • CVE-2026-120283

    Linksys E8450 portal.cgi strcpy stack-based overflow

    Linksys · E8450

    Critical10.0
  • CVE-2026-120281

    WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-121609

    Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials

    Qihoo 360 · Whole Home Router M5

    Critical10.0
  • CVE-2026-121606

    Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification

    Qihoo 360 · D621-2

    Critical10.0

Vendors with the most CVEs

  1. Google354
  2. MediaTek, Inc.56
  3. Hewlett Packard Enterprise (HPE)55
  4. Linux52
  5. FreeRDP42
  6. Apache Software Foundation32
  7. Dell26
  8. Tanium19
  9. Huawei17
  10. Eclipse Foundation16

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)83
  2. CWE-416 Use after free80
  3. CWE-862 Missing authorization74
  4. CWE-787 Out-of-bounds write67
  5. CWE-863 Incorrect authorization64
  6. CWE-22 Path traversal51
  7. CWE-20 Improper input validation47
  8. CWE-125 Out-of-bounds read45
  9. CWE-639 Authorization bypass through a user-controlled key (IDOR)42
  10. CWE-200 Exposure of sensitive information38