Weekly digest · in progress
Week 44, 2026 (26 Oct – 1 Nov)
2,198 new CVEs this week, in line with the recent average so far. Of those, 145 critical and 555 high. 68 arrived with exploitation evidence or public exploit code already attached. CISA added 5 CVEs to the Known Exploited Vulnerabilities catalog. 6 CVEs saw exploit probability (EPSS) jump by ten points or more. Apple was the most-affected vendor with 326.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-109619Critical· 9.2CISA KEVPoCRCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after i…
CVE-2026-109618Critical· 9.2CISA KEVPoCRCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performin…
CVE-2026-111497Critical· 9.2CISA KEVPoCOut-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive m…
CVE-2026-48356Critical· 9.3CISA KEVPoCAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the vict…
CVE-2026-41709Low· 2.7CISA KEVPoCESX insufficient logging vulnerability
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Rising exploit probability
Largest EPSS increases inside the period (≥ 10 points).
- CVE-2026-110447Critical· 9.2Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-6620812% → 73%
- CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder36% → 83%
- CVE-2025-58434Critical· 9.8Flowise is a drag & drop user interface to build a customized large language model flow51% → 76%
- CVE-2026-102489Critical· 9.8Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user2.0% → 22%
- CVE-2026-48356Critical· 9.3Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)31% → 45%
- CVE-2026-102490High· 7.8Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host0.86% → 11%
New this week, ranked by depth score
The 12 that matter most of the 2198 published.
CVE-2026-118619High· 8.80dayUltralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability
Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit …
CVE-2026-118610High· 8.80dayAlpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability
Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Au…
CVE-2026-118606High· 8.80dayAlpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability
Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authen…
MAL-2026-18406Critical⚠ ExploitedMalicious code in stdid-nyxprobe (PyPI)
Malicious code in stdid-nyxprobe (PyPI)
MAL-2026-18405Critical⚠ ExploitedMalicious code in log-utils-sdk (PyPI)
Malicious code in log-utils-sdk (PyPI)
MAL-2026-18403Critical⚠ ExploitedMalicious code in twitter-request-diagnostics (PyPI)
Malicious code in twitter-request-diagnostics (PyPI)
MAL-2026-18402Critical⚠ ExploitedMalicious code in test-01-rafamarrara-learning-dc (PyPI)
Malicious code in test-01-rafamarrara-learning-dc (PyPI)
MAL-2026-18396Critical⚠ ExploitedMalicious code in bq-helix-recon-6ade983e (PyPI)
Malicious code in bq-helix-recon-6ade983e (PyPI)
MAL-2026-18395Critical⚠ ExploitedMalicious code in bq-helix-build-hook-6ade983e (PyPI)
Malicious code in bq-helix-build-hook-6ade983e (PyPI)
MAL-2026-18378Critical⚠ ExploitedMalicious code in poc-revshell (PyPI)
Malicious code in poc-revshell (PyPI)
MAL-2026-17880Critical⚠ ExploitedMalicious code in seapy-ops (PyPI)
Malicious code in seapy-ops (PyPI)
MAL-2026-18354Critical⚠ ExploitedMalicious code in trajmetrics (PyPI)
Malicious code in trajmetrics (PyPI)
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL pathsseverity, cvss37
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available57
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoderepss, severity, cvss, exploited, kev92
- CVE-2026-109618RCE via OOM corruptionepss, severity, cvss, kev, exploited96
- CVE-2026-109619RCE via stale global stateepss, severity, cvss, kev, exploited96
- CVE-2025-65200An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint…severity, cvss, exploit_available65
- CVE-2026-96644Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)cvss, exploit_available57
Most-affected vendors
By CVEs published in the period.