Skip to main content

Every Monday

Vulnerability brief, week 2026-W45

From 2026-11-02 to 2026-11-08 (UTC), as frozen on the Monday that followed. Each line names its sources.

First attested exploited
17
Added to CISA KEV
3
High EPSS, under 90 days old
4

Added to CISA KEV3

  1. CVE-2026-19868KEV since 2026-11-06

    SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

    Severity highEPSS low

    Sources: CISA KEV, CISA-ADP, FIRST EPSS, NVD

    Watch CVE-2026-19868 for CVE-2026-19868
  2. CVE-2024-27834KEV since 2026-11-04

    Apple Multiple Products Improper Authentication Vulnerability

    Severity mediumEPSS mediumFixed in 17.5 · 16.7.8 · 14.5 · 10.5

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2024-27834 for CVE-2024-27834
  3. CVE-2026-119977KEV since 2026-11-03

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    Severity highEPSS mediumFixed in 7.1.4 · 7.0.8 · 6.9.11 · 6.8.12

    Sources: CISA KEV, CISA-ADP, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-119977 for CVE-2026-119977

Exploitation first attested17

  1. CVE-2026-58115exploited since 2026-11-03

    Severity criticalEPSS low

    Sources: GCVE · enisa-cnw-kev, GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-58115 for CVE-2026-58115
  2. CVE-2026-123158exploited since 2026-11-06

    OpenSSH Password Authentication Bypass on Musl Linux

    Severity highEPSS medium

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-123158 for CVE-2026-123158
  3. CVE-2026-119757exploited since 2026-11-05

    BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

    Severity criticalEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-119757 for CVE-2026-119757
  4. CVE-2026-111411exploited since 2026-11-05

    WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

    Severity criticalEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-111411 for CVE-2026-111411
  5. CVE-2026-27542exploited since 2026-11-05

    Severity criticalEPSS medium

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-27542 for CVE-2026-27542
  6. CVE-2026-115732exploited since 2026-11-05

    Severity criticalEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-115732 for CVE-2026-115732
  7. CVE-2026-102895exploited since 2026-11-05

    GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

    Severity criticalEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-102895 for CVE-2026-102895
  8. CVE-2026-73996exploited since 2026-11-05

    Severity criticalEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-73996 for CVE-2026-73996
  9. CVE-2026-107441exploited since 2026-11-04

    Out-of-Bounds Write in Zyxel GS1900 Series CGI Enables Remote Command Execution

    Severity highEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-107441 for CVE-2026-107441
  10. CVE-2020-8194exploited since 2026-11-04

    Severity mediumEPSS highFixed in 13.0-58.30 · 12.1-57.18 · 12.0-63.21 · 11.1.1a

    Sources: GCVE · shadowserver, FIRST EPSS, NVD

    Watch CVE-2020-8194 for CVE-2020-8194
  11. CVE-2019-17538exploited since 2026-11-03

    Severity highEPSS high

    Sources: GCVE · shadowserver, FIRST EPSS, NVD

    Watch CVE-2019-17538 for CVE-2019-17538
  12. CVE-2026-112313exploited since 2026-11-03

    WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability

    Severity highEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-112313 for CVE-2026-112313
  13. CVE-2026-4035exploited since 2026-11-03

    Severity highEPSS lowFixed in 3.11.0

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-4035 for CVE-2026-4035
  14. CVE-2026-81648exploited since 2026-11-03

    Severity criticalEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-81648 for CVE-2026-81648
  15. CVE-2026-81799exploited since 2026-11-02

    Severity highEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-81799 for CVE-2026-81799
  16. CVE-2026-28160exploited since 2026-11-02

    WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability

    Severity highEPSS low

    Sources: GCVE · previdian, FIRST EPSS, NVD

    Watch CVE-2026-28160 for CVE-2026-28160
  17. CVE-2021-24472exploited since 2026-11-02

    Severity criticalEPSS highFixed in 3.9.9.2 · 2.0.2

    Sources: GCVE · shadowserver, FIRST EPSS, NVD

    Watch CVE-2021-24472 for CVE-2021-24472

4 more CVEs qualified this week; an issue keeps the first 20.

Get the brief every Monday

One email a week, unsubscribe in one click. We first send a link to confirm the address.