This week in numbers
- New entries in the CISA KEV catalogue: 3 (previous week 10)
- New CVEs rated critical: 0; high: 0; all new CVEs: 0 (previous week 0, 4-week average 1486.5)
Part of this week's feed data was unavailable when this brief was compiled; counts may be incomplete.
Newly known exploited
| CVE | Vendor and product | Vulnerability | Federal due date |
|---|---|---|---|
| CVE-2026-119977 | WordPress WordPress Core | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | 6 Nov 2026 |
| CVE-2024-27834 | Apple Multiple Products | Apple Multiple Products Improper Authentication Vulnerability | 18 Nov 2026 |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | 20 Nov 2026 |
Critical CVEs to look at first
No new CVE reached the critical threshold this week.
Notable vendors
Counted from this week's new CVEs and KEV additions; a count says nothing about who uses a product.
- Apple: 0 new CVEs, 1 added to KEV
- SonicWall: 0 new CVEs, 1 added to KEV
- WordPress: 0 new CVEs, 1 added to KEV
KEV due dates in the next 14 days
- CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability: due 10 Nov 2026 (2 days)
- CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability: due 10 Nov 2026 (2 days)
- CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability: due 11 Nov 2026 (3 days)
- CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability: due 13 Nov 2026 (5 days)
- CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability: due 18 Nov 2026 (10 days)
- CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability: due 20 Nov 2026 (12 days)
Check your exposure
Filter this week's CVEs in Threat Intel, watch new entries arrive on Live Attacks, or run a free check:
All free tools are on the tools page.