This week in numbers
- New entries in the CISA KEV catalogue: 12 (previous week 3)
- New CVEs rated critical: 241; high: 2089; all new CVEs: 4785 (previous week 3083, 4-week average 4096.8)
Newly known exploited
| CVE | Vendor and product | Vulnerability | Federal due date |
|---|---|---|---|
| CVE-2026-102895 | GPUStack GPUStack | GPUStack Improper Authentication Vulnerability | 12 Nov 2026 |
| CVE-2026-116779 | SignalWire FreeSwitch | SignalWire FreeSwitch Code Injection Vulnerability | 12 Nov 2026 |
| CVE-2026-123158 | OpenBSD OpenSSH | OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability | 12 Nov 2026 |
| CVE-2026-123218 | IBM Aspera Faspex | IBM Aspera Faspex Incorrect Authorization Vulnerability | 12 Nov 2026 |
| CVE-2026-111560 | Barracuda Networks Multiple Products | Barracuda Networks Multiple Products OS Command Injection Vulnerability | 13 Nov 2026 |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder | Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability | 24 Nov 2026 |
| CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG) | Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability | 13 Nov 2026 |
| CVE-2026-124194 | Microsoft Office | Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | 24 Nov 2026 |
| CVE-2026-125350 | Google Chromium | Google Chromium Use-After-Free Vulnerability | 24 Nov 2026 |
| CVE-2026-20320 | Cisco BroadWorks | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | 24 Nov 2026 |
| CVE-2026-114713 | UnrealIRCd UnrealIRCd | UnrealIRCd Improper Neutralization of Delimiters Vulnerability | 16 Nov 2026 |
| CVE-2026-123039 | Check Point Multiple Products | Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability | 16 Nov 2026 |
Critical CVEs to look at first
- CVE-2026-124002, CVSS 9.8, EPSS 3.2%: . XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows...
- CVE-2026-124010, CVSS 9.8, EPSS 3.1%: . XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary...
- CVE-2026-124580, CVSS 10.0, EPSS 2.8%: . A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775
- CVE-2026-126148, CVSS 9.8, EPSS 2.4%: . A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0...
- CVE-2026-123270, CVSS 9.8, EPSS 2.4%: . Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code...
- CVE-2026-124585, CVSS 9.9, EPSS 2.2%: . A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775
- CVE-2026-124577, CVSS 9.8, EPSS 2.1%: . A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72
- CVE-2026-121653, CVSS 9.8, EPSS 2.0%: . SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote...
- CVE-2026-12591, CVSS 9.9, EPSS 1.7%: . Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient...
- CVE-2026-103813, CVSS 9.1, EPSS 1.4%: . Dell PowerStore contains an OS Command Injection vulnerability
Notable vendors
Counted from this week's new CVEs and KEV additions; a count says nothing about who uses a product.
- Google: 62 new CVEs, 1 added to KEV
- Microsoft (on our watchlist): 26 new CVEs, 1 added to KEV
- IBM: 16 new CVEs, 1 added to KEV
- Adobe: 11 new CVEs
- Open-emr: 8 new CVEs
- Barracuda Networks: 0 new CVEs, 2 added to KEV
- Check Point: 1 new CVEs, 1 added to KEV
- UnrealIRCd: 1 new CVEs, 1 added to KEV
- Cisco (on our watchlist): 0 new CVEs, 1 added to KEV
KEV due dates in the next 14 days
- CVE-2026-114713 UnrealIRCd Improper Neutralization of Delimiters Vulnerability: due 16 Nov 2026 (1 days)
- CVE-2026-123039 Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability: due 16 Nov 2026 (1 days)
- CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability: due 18 Nov 2026 (3 days)
- CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability: due 20 Nov 2026 (5 days)
- CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability: due 24 Nov 2026 (9 days)
- CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability: due 24 Nov 2026 (9 days)
- CVE-2026-125350 Google Chromium Use-After-Free Vulnerability: due 24 Nov 2026 (9 days)
- CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability: due 24 Nov 2026 (9 days)
Check your exposure
Filter this week's CVEs in Threat Intel, watch new entries arrive on Live Attacks, or run a free check:
All free tools are on the tools page.