Skip to main content

LegalAgent AI Legal Lab

Vulnerability News

Software and device vulnerabilities announced in Japan and abroad that drew a government advisory, were confirmed as exploited, were rated critical, led to service suspensions or were widely discussed on X, listed from vendor and government announcements.As of November 2, 2026

Vulnerabilities to watch

Among vulnerabilities first disclosed within the last 90 days: exploited ones fixed only in some versions, and those that recently led to service suspensions.

  1. Exploited

    PHP“php2shell”

    CVSS 9.2 (v4.0, PHP developers)

  2. Exploited

    Collabora Online - Built-in CODE Server (Nextcloud app)

    CVSS 9.2 (v4.0, Collabora)

  3. Exploited

    Zammad

    CVSS 9.8 (v3.1, NVD)

  4. Exploited

    Fortinet FortiMail

    CVSS 9.8 (v3.1, Fortinet)

  5. Exploited

    Brotli (C implementation)“Node2Shell / HTTP2Shell”

    CVSS 9.2 (v4.0, Google (CNA))

Listed vulnerabilities in numbers

Listed
48
Exploited
30
No fix or partial fix
11
Advisory in Japan
12

Coverage and terms

Monthly list · 2026

All · 48 listed

November 2026

  1. Updated

    PHP“php2shell”

    The PHP Group · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560

    Two flaws that can let unauthenticated remote attackers execute arbitrary code. CISA added them to its KEV catalog, and many Japanese services suspended operations as a precaution.

    Latest announcement (Open external link)

    ExploitedPartially fixedWeb platforms and languages

    CVSS 9.2 (v4.0, PHP developers)Japan: IPA, National Cybersecurity Office (Japan), JPCERT/CCAbroad: CERT-EU, CISA

    Details and sources (14 updates)
    Affected and fixed versions

    Versions before 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No official releases for 8.1 and earlier; minimal backports were published for 7.4 to 8.1. No fixed release yet for CVE-2026-115560.

    Main impact

    In Japan, organizations including the Ministry of Finance, au Jibun Bank, NTT Docomo, SoftBank, Kyushu Electric Power, Osaka Prefecture and futureshop suspended parts of their websites or services, or carried out emergency maintenance, around the release of the fixes. The piyolog blog counted 246 organizations whose own notices it had confirmed by midday on October 23.

    Timeline and sources
    1. PHP announced an upcoming critical security releaseSource (Open external link)
    2. CERT-EU published an advisorySource (Open external link)
    3. IPA asked operators to prepare for the releaseSource (Open external link)
    4. Japan's National Cybersecurity Office issued an alert on XSource (Open external link)
    5. Japanese services reportedly suspended operations for emergency maintenanceSource (Open external link)
    6. Fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releasedSource (Open external link)
    7. CISA published an alertSource (Open external link)
    8. JPCERT/CC published an alertSource (Open external link)
    9. IPA published an alertSource (Open external link)
    10. JVN published a vulnerability noteSource (Open external link)
    11. PHP published an informational advisory on a related third flaw (CVE-2026-115560)Source (Open external link)
    12. CISA added both CVEs to the KEV catalogSource (Open external link)
    13. JPCERT/CC added a report of an apparent successful compromise of a firewall productSource (Open external link)
    14. IPA added a note on PHP embedded in VPN and security appliancesSource (Open external link)
    Advisories
    1. Abroad · CERT-EUSource (Open external link)
    2. Japan · IPASource (Open external link)
    3. Japan · National Cybersecurity Office (Japan)Source (Open external link)
    4. Abroad · CISASource (Open external link)
    5. Japan · JPCERT/CCSource (Open external link)
    6. Japan · IPASource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.26

    Why it is listed

    Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+), Service suspensions, Widely discussed on X

    Sources checked: 2026-11-02

October 2026

  1. Updated

    Linux kernel

    Linux kernel · CVE-2026-98432

    A use-after-free in IPv4 TCP connection handling. Researchers showed unauthenticated root command execution on servers exposing an MPTCP listener.

    Latest announcement (Open external link)

    No exploitation reportFix availableOS and browsers

    CVSS 9.8 (v3.1, Linux kernel (CNA))No advisory

    Details and sources (8 updates)
    Affected and fixed versions

    Kernels before 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, among others (per CCCS).

    Timeline and sources
    1. Fix committed upstreamSource (Open external link)
    2. CVE-2026-98432 publishedSource (Open external link)
    3. Linux kernel CNA published the CVESource (Open external link)
    4. Anthropic published how it was found and exploitedSource (Open external link)
    5. Go Security Team announced impact and mitigationsSource (Open external link)
    6. Posts urging patching spread widely on social mediaSource (Open external link)
    7. Canada's CCCS issued an advisorySource (Open external link)
    8. CVE record updated (CVSS 3.1 9.8 listed)Source (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+), Widely discussed on X

    Sources checked: 2026-11-02

  2. Updated

    Brotli (C implementation)“Node2Shell / HTTP2Shell”

    Google · CVE-2026-111497

    An out-of-bounds write in the Brotli decoder. Crafted compressed data can cause crashes, memory disclosure or arbitrary code execution. Node.js and Python packages are also affected.

    Latest announcement (Open external link)

    ExploitedFix availableOpen-source libraries

    CVSS 9.2 (v4.0, Google (CNA))Japan: JPCERT/CCAbroad: CISA, CCCS, CSA (Singapore)

    Details and sources (15 updates)
    Affected and fixed versions

    v1.2.0 to before v1.2.1, v1.1.0 to before v1.1.1, and v1.0.3 to before v1.0.10. Fixed in v1.2.1, v1.1.1 and v1.0.10.

    Timeline and sources
    1. Google released fixed versions including v1.2.1Source (Open external link)
    2. Node.js shipped security releases including the fixSource (Open external link)
    3. Fixed releases including 1.2.1 publishedSource (Open external link)
    4. GitHub advisory published covering the Python packagesSource (Open external link)
    5. CVE-2026-111497 publishedSource (Open external link)
    6. OpenAI announced the finding on X and the post spread widelySource (Open external link)
    7. Microsoft released out-of-band .NET updates (8.0.33, 9.0.22, 10.0.14, 11 RC3)Source (Open external link)
    8. JPCERT/CC published an alertSource (Open external link)
    9. PHP updated its Windows buildsSource (Open external link)
    10. Canada's CCCS issued an advisorySource (Open external link)
    11. CISA added the CVE to the KEV catalogSource (Open external link)
    12. Added to KEVSource (Open external link)
    13. Canada's CCCS issued an alertSource (Open external link)
    14. Singapore's CSA published an alert on active exploitationSource (Open external link)
    15. Palo Alto Networks published the impact on its productsSource (Open external link)
    Advisories
    1. Japan · JPCERT/CCSource (Open external link)
    2. Abroad · CISASource (Open external link)
    3. Abroad · CCCSSource (Open external link)
    4. Abroad · CSA (Singapore)Source (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.27

    Why it is listed

    Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+), Widely discussed on X

    Sources checked: 2026-11-02

  3. Updated

    Ivanti Connect Secure

    Ivanti · CVE-2026-104935, CVE-2026-111357, CVE-2026-118527

    An authentication bypass leading to command execution (CVE-2026-104935) and a privilege escalation flaw were exploited before patches were available.

    Latest announcement (Open external link)

    ExploitedFix availableNetwork appliances

    CVSS 8.6 (v3.1, Ivanti (CVE-2026-104935))Abroad: CISA, CCCS, CSA Singapore

    Details and sources (9 updates)
    Affected and fixed versions

    Versions 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior (per CISA). Versions 22.7R2.14 and earlier are not affected by CVE-2026-104935.

    Timeline and sources
    1. Exploitation began (per Volexity)Source (Open external link)
    2. Fix for CVE-2026-104935 releasedSource (Open external link)
    3. CISA issued an alert and added it to KEVSource (Open external link)
    4. Volexity published its analysis of the chained exploitationSource (Open external link)
    5. Added to CISA KEV (CVE-2026-104935)Source (Open external link)
    6. Fix for the privilege escalation (CVE-2026-111357) releasedSource (Open external link)
    7. Ivanti updated the advisory to add CVE-2026-111357 and CVE-2026-118527 with fixed versionsSource (Open external link)
    8. CVE-2026-111357 and CVE-2026-118527 added to KEVSource (Open external link)
    9. CISA updated its alert to add the two CVEs and affected versionsSource (Open external link)
    Advisories
    1. Abroad · CISASource (Open external link)
    2. Abroad · CCCSSource (Open external link)
    3. Abroad · CSA SingaporeSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.13

    Why it is listed

    Government advisory, Confirmed exploitation

    Sources checked: 2026-11-02

  4. Updated

    GitLab CE/EE (critical patch 19.4.2 and others)

    GitLab · CVE-2026-97229

    An integer overflow in CI/CD regular expression handling lets an unauthenticated user execute arbitrary code on the GitLab server.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 10.0 (v3.1, GitLab)Abroad: CERT-EU

    Details and sources (6 updates)
    Affected and fixed versions

    Versions 19.2 through 19.4 before 19.2.8, 19.3.5 and 19.4.2. GitLab.com and other GitLab-managed environments are patched.

    Timeline and sources
    1. Versions 19.4.2, 19.3.5 and 19.2.8 releasedSource (Open external link)
    2. CERT-EU issued an advisorySource (Open external link)
    3. Canada's CCCS issued an advisorySource (Open external link)
    4. Ruby team explained the underlying regex fixesSource (Open external link)
    5. Added to KEVSource (Open external link)
    6. Added to CISA KEVSource (Open external link)
    Advisories
    1. Abroad · CERT-EUSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.29

    Why it is listed

    Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  5. Updated

    Cisco Secure Firewall ASA / FTD

    Cisco · CVE-2026-76418

    When secondary authentication is configured on a remote access SSL VPN tunnel group, an unauthenticated attacker can send a crafted request to reload the device, causing a denial of service. Cisco confirmed exploitation.

    Latest announcement (Open external link)

    ExploitedFix availableNetwork appliances

    CVSS 8.6 (v3.1, Cisco)Abroad: CCCS

    Details and sources (2 updates)
    Affected and fixed versions

    ASA and FTD with SSL remote access VPN enabled and secondary authentication configured on a tunnel group. Fixed in ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.

    Timeline and sources
    1. Cisco published its advisory and fixed releasesSource (Open external link)
    2. Added to CISA KEVSource (Open external link)
    Advisories
    1. Abroad · CCCSSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.29

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  6. Updated

    Yamaha NWR100 wireless LAN router

    Yamaha Corporation · CVE-2026-97854

    A crafted request can run arbitrary OS commands on the router. A separate flaw that lets exported configuration files be read without authentication was disclosed at the same time.

    Latest announcement (Open external link)

    No exploitation reportFix availableNetwork appliances · Made in Japan

    CVSS 9.3 (v4.0, JVN (JPCERT/CC))No advisory

    Details and sources (2 updates)
    Affected and fixed versions

    Firmware Rev.26.00.07 and earlier. Fixed in Rev.26.00.08.

    Timeline and sources
    1. Yamaha published fixed firmware and an advisorySource (Open external link)
    2. JVN published a vulnerability noteSource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  7. Updated

    Veeam Backup & Replication and Backup for Microsoft 365

    Veeam · CVE-2026-108142, CVE-2026-106076

    Veeam fixed an unauthenticated authorization bypass in the Backup & Replication CDP Coordinator Service (CVSS 9.1) and a SQL injection leading to code execution in Backup for Microsoft 365 (9.0).

    Latest announcement (Open external link)

    No exploitation reportFix availableBusiness apps and cloud

    CVSS 9.1 (v4.0, Veeam)No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    Backup & Replication 13.1 builds up to 13.1.1.18 and 13.0 builds up to 13.0.2.29 (fixed in 13.1.2 and 13.0.3), and Backup for Microsoft 365 version 8 up to 8.5.0.1014 (fixed in 8.6).

    Timeline and sources
    1. Fixes in Backup & Replication 13.1.2 publishedSource (Open external link)
    2. Fixes in Backup for Microsoft 365 8.6 publishedSource (Open external link)
    3. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  8. Updated

    Linux kernel“Fragnesia”

    Linux · CVE-2026-46300

    A flaw in ESP (IPsec) handling lets a local user overwrite the page cache of read-only files and gain root. CISA notes it can be chained with PHP flaws.

    Latest announcement (Open external link)

    ExploitedFix availableOS and browsers

    CVSS 7.8 (v3.1, Linux kernel (CNA))No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    Linux 3.9 and later. Fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1.

    Timeline and sources
    1. Researchers disclosed details and proof of conceptSource (Open external link)
    2. CVE publishedSource (Open external link)
    3. Added to CISA KEVSource (Open external link)
    Advisories

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.28

    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  9. Updated

    VMware ESX

    Broadcom · CVE-2026-41709

    An insufficient logging flaw that lets a malicious administrator perform certain operations without being logged. Fixes were released on July 29, 2026.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 2.7 (v3.1, Broadcom)No advisory

    Details and sources (2 updates)
    Affected and fixed versions

    VMware ESX 9.1.x (before ESXi-9.1.0.0-25370933), 9.0.x (before ESXi-9.0.2.0100-25595025), 8.0 (before ESXi80U3j-25429389), VMware Cloud Foundation 5.x (before 5.2.4), and related products.

    Timeline and sources
    1. Broadcom published VMSA-2026-0006Source (Open external link)
    2. Added to CISA KEVSource (Open external link)
    Advisories

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.28

    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  10. Updated

    Google Chrome (October 2026 stable updates)

    Google · CVE-2026-106197, CVE-2026-106358, CVE-2026-106382, CVE-2026-110136 and 6 more

    Five stable updates in October fixed 22 flaws Google rated Critical. CISA-ADP scored 10 of them at CVSS 9.6.

    Latest announcement (Open external link)

    No exploitation reportFix availableOS and browsers

    CVSS 9.6 (v3.1, CISA-ADP)No advisory

    Details and sources (5 updates)
    Affected and fixed versions

    Desktop versions before 156.0.8078.73 (Linux) and 156.0.8078.73/.74 (Windows and Mac).

    Timeline and sources
    1. 155.0.8059.39 released (4 Critical)Source (Open external link)
    2. 155.0.8059.79 released (7 Critical)Source (Open external link)
    3. 155.0.8059.84 released (1 Critical)Source (Open external link)
    4. 156.0.8078.47 released (6 Critical)Source (Open external link)
    5. 156.0.8078.73 released (4 Critical)Source (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  11. Updated

    Adobe Commerce / Magento Open Source

    Adobe · CVE-2026-48356

    An unrestricted upload of files with a dangerous type that could lead to arbitrary code execution. Fixes were released on July 14, 2026.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 9.6 (v3.1, Adobe)No advisory

    Details and sources (2 updates)
    Affected and fixed versions

    Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier; Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier; Adobe Commerce B2B; Adobe Commerce Events 1.6.0 to 1.20.0.

    Timeline and sources
    1. Adobe published APSB26-73Source (Open external link)
    2. Added to CISA KEVSource (Open external link)
    Advisories

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.27

    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  12. Updated

    Oracle Critical Patch Update (October 2026)

    Oracle · CVE-2026-91299, CVE-2026-91231, CVE-2026-91221, CVE-2026-91216 and 2 more

    Oracle released 1,295 security patches. Ninety-five unique CVEs scored CVSS 9.0 or higher, six of them 10.0.

    Latest announcement (Open external link)

    No exploitation reportFix availableBusiness apps and cloud

    CVSS 10.0 (v3.1, Oracle)No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    Many products, including SOA Suite, Access Manager, JD Edwards EnterpriseOne, WebLogic Server, MySQL and Essbase.

    Timeline and sources
    1. October 2026 CPU releasedSource (Open external link)
    2. Canada's CCCS issued an advisorySource (Open external link)
    3. Advisory revised (Rev 2)Source (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  13. Updated

    Microsoft products (October 2026 security updates)

    Microsoft · CVE-2026-96951, CVE-2026-96207, CVE-2026-94510, CVE-2026-70242 and 11 more

    October 2026 monthly updates. Microsoft disclosed that a Windows Shell security feature bypass flaw is being exploited.

    Latest announcement (Open external link)

    ExploitedFix availableOS and browsers

    CVSS 9.8 (v3.1, Microsoft, highest listed)Japan: IPA, JPCERT/CCAbroad: CCCS

    Details and sources (8 updates)
    Affected and fixed versions

    Windows (affected versions are listed in Microsoft's Security Update Guide).

    Timeline and sources
    1. Microsoft released its monthly security updatesSource (Open external link)
    2. CISA added CVE-2026-96951 to the KEV catalogSource (Open external link)
    3. Monthly security updates releasedSource (Open external link)
    4. CVE-2026-96951 added to KEVSource (Open external link)
    5. ZDI published its review of the releaseSource (Open external link)
    6. Canada's CCCS issued an advisorySource (Open external link)
    7. JPCERT/CC and IPA published alertsSource (Open external link)
    8. Microsoft added Edge to the security updates tableSource (Open external link)
    Advisories
    1. Abroad · CCCSSource (Open external link)
    2. Japan · IPASource (Open external link)
    3. Japan · JPCERT/CCSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.13

    Why it is listed

    Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  14. Updated

    Arista VeloCloud Orchestrator (on-prem)

    Arista Networks · CVE-2026-114625

    An SQL injection in the SD-WAN orchestrator lets any authenticated user reach internal functions and gain operator privileges. Arista detected the issue and said it is actively exploited.

    Latest announcement (Open external link)

    ExploitedFix availableNetwork appliances

    CVSS 9.9 (v3.1, Arista)Abroad: Canadian Centre for Cyber Security（AV26-1080）

    Details and sources (3 updates)
    Affected and fixed versions

    On-prem VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. End-of-support versions were not assessed. Hosted and Dedicated VCO are already patched.

    Timeline and sources
    1. Arista published Security Advisory 0199 and fixed versionsSource (Open external link)
    2. Added to CISA KEVSource (Open external link)
    3. Canadian Cyber Centre issued AV26-1080Source (Open external link)
    Advisories
    1. Abroad · Canadian Centre for Cyber Security（AV26-1080）Source (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.23

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  15. Updated

    Fortinet FortiSIEM and FortiSandbox

    Fortinet · CVE-2026-107656, CVE-2026-106173

    Fortinet's October 13 release fixed a FortiSandbox authentication bypass (CVSS 9.6) and a FortiSIEM path traversal leading to code execution (9.4).

    Latest announcement (Open external link)

    No exploitation reportPartially fixedNetwork appliances

    CVSS 9.6 (v3.1, Fortinet)No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    FortiSandbox 5.0.0-5.0.6 and 4.4.0-4.4.9 (no fix for 4.2 and some PaaS versions), and FortiSIEM 7.5.0.

    Timeline and sources
    1. FortiSandbox advisory publishedSource (Open external link)
    2. FortiSIEM advisory publishedSource (Open external link)
    3. Canada's CCCS noted reports of FortiSIEM exploitationSource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  16. Updated

    Collabora Online - Built-in CODE Server (Nextcloud app)

    Collabora · CVE-2026-110447

    An unauthenticated OS command injection in the Nextcloud app's built-in CODE server, reachable while the CODE server is not running. It was exploited in September and October 2026.

    Latest announcement (Open external link)

    ExploitedPartially fixedBusiness apps and cloud

    CVSS 9.2 (v4.0, Collabora)No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    The Nextcloud app richdocumentscode before 26.4.303. End-of-life Nextcloud versions up to 29 are also affected. Standalone Collabora Online servers are not affected.

    Timeline and sources
    1. Exploitation reported on Nextcloud forumSource (Open external link)
    2. Collabora published advisory (fixed in 26.4.303)Source (Open external link)
    3. Added to CISA KEVSource (Open external link)
    Advisories

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.23

    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  17. Updated

    GitLab CE/EE (critical patch 19.5.1 and others)

    GitLab · CVE-2026-110264

    An integer overflow when compiling crafted regular expressions lets an unauthenticated user execute arbitrary code. Fixes were also backported to older versions.

    Latest announcement (Open external link)

    No exploitation reportFix availableBusiness apps and cloud

    CVSS 10.0 (v3.1, GitLab)Abroad: CERT-EU

    Details and sources (3 updates)
    Affected and fixed versions

    All versions from 7.0 before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1.

    Timeline and sources
    1. Version 19.5.1 and others releasedSource (Open external link)
    2. CERT-EU issued an advisorySource (Open external link)
    3. Canada's CCCS issued an advisorySource (Open external link)
    Advisories
    1. Abroad · CERT-EUSource (Open external link)
    Why it is listed

    Government advisory, Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  18. Updated

    Siemens Software Center

    Siemens · CVE-2026-110936

    The software download and install application loads a crafted DLL from an uncontrolled search path, allowing code execution. Siemens reported exploitation in a ClickFix campaign bundling the signed binary with malicious DLLs.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 8.4 (v4.0, Siemens)Abroad: Canadian Centre for Cyber Security（AV26-1063）, CISA (ICS advisory ICSA-26-295-03)

    Details and sources (6 updates)
    Affected and fixed versions

    All versions before V4.0.9.8. Fixed in V4.0.9.8; existing installations update automatically at next startup.

    Timeline and sources
    1. Siemens published SSA-580366Source (Open external link)
    2. Fixed version V4.0.9.8 added to the advisorySource (Open external link)
    3. Siemens reported active exploitationSource (Open external link)
    4. Canadian Cyber Centre issued AV26-1063Source (Open external link)
    5. Added to CISA KEVSource (Open external link)
    6. CISA republished it as ICSA-26-295-03Source (Open external link)
    Advisories
    1. Abroad · Canadian Centre for Cyber Security（AV26-1063）Source (Open external link)
    2. Abroad · CISA (ICS advisory ICSA-26-295-03)Source (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.20

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  19. Updated

    Cisco Expressway, Unified Communications and others (October 21 release)

    Cisco · CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475 and 1 more

    Cisco disclosed an unauthenticated root command execution flaw in Expressway (CVSS 9.8) and hardening releases for Unified CM and related products and Snort 3.

    Latest announcement (Open external link)

    No known exploitationFix availableNetwork appliances

    CVSS 9.8 (v3.1, Cisco)No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    Expressway before X15.5.20 (no fix for X14 and earlier), Unified CM, Unity Connection and related products before 15SU5, and products using Snort 3.

    Timeline and sources
    1. Expressway RCE advisory publishedSource (Open external link)
    2. Unified Communications hardening release publishedSource (Open external link)
    3. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  20. Oracle Java SE (October 2026 CPU)

    Oracle · CVE-2026-91403

    Java SE flaws fixed in the October 2026 Critical Patch Update. A JSSE flaw can let unauthenticated network attackers modify or access critical data.

    Latest announcement (Open external link)

    No exploitation reportFix availableWeb platforms and languages

    CVSS 9.1 (v3.1, Oracle)Japan: IPA

    Details and sources
    Affected and fixed versions

    Oracle Java SE 27, 26.0.2, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1, 8 Update 503 and others (per IPA).

    Timeline and sources
    1. IPA published an alertSource (Open external link)
    Advisories
    1. Japan · IPASource (Open external link)
    Why it is listed

    Government advisory, Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  21. Updated

    Plex Media Server“Plex2Shell”

    Plex · CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656

    Chaining four flaws lets an unauthenticated remote attacker run code on the server. Plex says they were widely exploited after a public proof of concept, including for cryptocurrency mining.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 8.6 (v4.0, CISA (CNA))No advisory

    Details and sources (5 updates)
    Affected and fixed versions

    Plex Media Server versions before 1.43.3.10861. Fixed in 1.43.3.10861.

    Timeline and sources
    1. Plex announced security update (1.43.3)Source (Open external link)
    2. CVEs published (CISA VA-26-266-01)Source (Open external link)
    3. Researcher published details and proof of conceptSource (Open external link)
    4. Plex reported active, widespread exploitationSource (Open external link)
    5. Added to CISA KEVSource (Open external link)
    Advisories

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.20

    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  22. Updated

    SiteGuard Server Edition

    EG Secure Solutions · CVE-2026-106931

    An OS command injection flaw in the statistics feature of this host-based WAF. It can let attackers run commands as root or SYSTEM. The vendor has confirmed exploitation.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud · Made in Japan

    CVSS 8.5 (v4.0, JVN (JPCERT/CC))Japan: JPCERT/CC

    Details and sources (6 updates)
    Affected and fixed versions

    Ver2.20 and later with the statistics feature enabled (on by default): Apache, Nginx and IIS editions before Ver8.00 Update5, and FreeBSD Apache and Nginx editions before Ver7.00 Update6. IIS Ver3.10 to Ver4.00 Update4 are not affected.

    Timeline and sources
    1. Vendor notified customers with direct support contractsSource (Open external link)
    2. Vendor published fixed versions and a replacement patchSource (Open external link)
    3. JVN published a vulnerability noteSource (Open external link)
    4. JPCERT/CC published an alertSource (Open external link)
    5. CISA added the CVE to the KEV catalogSource (Open external link)
    6. Added to CISA KEVSource (Open external link)
    Advisories
    1. Japan · JPCERT/CCSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.20

    Why it is listed

    Government advisory, Confirmed exploitation

    Sources checked: 2026-11-02

  23. Updated

    BeyondTrust Remote Support

    BeyondTrust · CVE-2026-102764

    Insufficient origin validation of internal messages lets an unauthenticated attacker perform file operations on the appliance. It was exploited as a zero-day.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 9.3 (v4.0, BeyondTrust)Abroad: CISA, CCCS

    Details and sources (7 updates)
    Affected and fixed versions

    All versions up to 26.2.3. Versions 24.3.1 and later are fixed by patch BT26-05-RS; there is no patch for versions before 24.3.1. SaaS instances were patched by October 9, 2026.

    Timeline and sources
    1. Fix applied to all SaaS instancesSource (Open external link)
    2. Advisory BT26-05 publishedSource (Open external link)
    3. CVE publishedSource (Open external link)
    4. Mandiant published its analysis of the attackerSource (Open external link)
    5. CISA issued an alert and added it to KEVSource (Open external link)
    6. Canada's CCCS issued an alertSource (Open external link)
    7. Added to CISA KEVSource (Open external link)
    Advisories
    1. Abroad · CISASource (Open external link)
    2. Abroad · CCCSSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.16

    Why it is listed

    Government advisory, Confirmed exploitation

    Sources checked: 2026-11-02

  24. Updated

    Fortinet FortiOS / FortiPAM / FortiProxy / FortiSwitchManager

    Fortinet · CVE-2025-61624

    A CLI path traversal flaw disclosed in April 2026. An admin with read-write permissions can write or delete arbitrary files via specific commands.

    Latest announcement (Open external link)

    ExploitedPartially fixedNetwork appliances

    CVSS 6.0 (v3.1, Fortinet)No advisory

    Details and sources (2 updates)
    Affected and fixed versions

    FortiOS 7.6.0-7.6.4, 7.4.0-7.4.9, all 7.2/7.0/6.4; FortiPAM 1.7.0 and all 1.0-1.6; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.11, all 7.2/7.0; FortiSwitchManager 7.2.0-7.2.7, 7.0.0-7.0.6. Older branches have no fix of their own.

    Timeline and sources
    1. Fortinet published advisorySource (Open external link)
    2. Added to CISA KEVSource (Open external link)
    Advisories

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.16

    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  25. Updated

    Cisco Secure Email Gateway

    Cisco · CVE-2026-76519

    When AMP file reputation is enabled, an email with a crafted attachment can write files and run commands as root.

    Latest announcement (Open external link)

    ExploitedFix availableNetwork appliances

    CVSS 9.8 (v3.1, Cisco)Abroad: CCCS, CERT-EU

    Details and sources (3 updates)
    Affected and fixed versions

    Appliances with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525; AsyncOS 15.5 before 15.5.5-014 and 16.5 before 16.5.0-780, among others (per CCCS).

    Timeline and sources
    1. Advisory published, noting active exploitationSource (Open external link)
    2. Added to KEVSource (Open external link)
    3. CERT-EU issued an advisorySource (Open external link)
    Advisories
    1. Abroad · CCCSSource (Open external link)
    2. Abroad · CERT-EUSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.14

    Why it is listed

    Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  26. Updated

    Juniper Junos OS and Junos OS Evolved

    Juniper Networks（HPE） · CVE-2026-101954, CVE-2026-101986, CVE-2026-101983, CVE-2026-102182 and 1 more

    Juniper's October bulletin fixed several CVSS 9.8 flaws, including J-Web authentication issues and an IKE buffer overflow on MX Series.

    Latest announcement (Open external link)

    No exploitation reportFix availableNetwork appliances

    CVSS 9.8 (v3.1, Juniper)No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    Multiple Junos OS and Junos OS Evolved release trains (e.g. before 24.2R2-S5.5 and 25.2R2-S2, per CCCS). Each flaw requires J-Web, IKE, BMP or similar to be enabled.

    Timeline and sources
    1. Advisories published, including JSA112187 for J-WebSource (Open external link)
    2. MX Series IKE advisory published (JSA112196)Source (Open external link)
    3. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  27. Updated

    Atlassian Data Center products (Confluence, Jira and others)

    Atlassian · CVE-2026-21589

    An unauthenticated attacker can read specific files under the web application root. All versions of the Data Center products are affected.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 9.3 (v4.0, Atlassian)Abroad: CCCS, CERT-EU

    Details and sources (4 updates)
    Affected and fixed versions

    Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye, before the fixed versions (e.g. Confluence 9.2.26 and 10.2.19).

    Timeline and sources
    1. Advisory publishedSource (Open external link)
    2. CERT-EU issued an advisorySource (Open external link)
    3. Added to KEVSource (Open external link)
    4. Added to CISA KEVSource (Open external link)
    Advisories
    1. Abroad · CCCSSource (Open external link)
    2. Abroad · CERT-EUSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.15

    Why it is listed

    Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  28. Updated

    NGINX (Open Source and Plus)

    F5 · CVE-2026-15176

    With alias combined with rewrite and a directive referencing $request_filename, crafted requests can cause a heap buffer overflow in the worker process.

    Latest announcement (Open external link)

    No exploitation reportPartially fixedWeb platforms and languages

    CVSS 9.2 (v4.0, F5)No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    NGINX Open Source 0.1.29-1.31.6 (fixed in 1.30.6 and 1.31.7), and NGINX Plus before 37.0.5.1 and 37.1.0.1, plus R33-R36.

    Timeline and sources
    1. F5 published CVE-2026-15176 (K000162416)Source (Open external link)
    2. nginx.org published fixed versions and an advisorySource (Open external link)
    3. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  29. Updated

    Palo Alto Networks PAN-OS

    Palo Alto Networks · CVE-2026-0322

    A code injection flaw in the management interface lets an authenticated attacker execute arbitrary code as root on the firewall. Palo Alto Networks observed very limited exploitation.

    Latest announcement (Open external link)

    ExploitedFix availableNetwork appliances

    CVSS 8.6 (v4.0, Palo Alto Networks)Abroad: CCCS

    Details and sources (3 updates)
    Affected and fixed versions

    PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 on PA-Series and VM-Series firewalls and Panorama (fixed in 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 and other hotfixes). Cloud NGFW and Prisma Access are not affected.

    Timeline and sources
    1. Palo Alto Networks published its advisory and fixed versionsSource (Open external link)
    2. Added to CISA KEVSource (Open external link)
    3. PAN-OS 11.2.16 releasedSource (Open external link)
    Advisories
    1. Abroad · CCCSSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.14

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  30. Updated

    Ahsay AhsayCBS

    Ahsay · CVE-2026-105133, CVE-2026-105134

    Two flaws in the backup server: an authentication bypass in the API and an OS command injection. They can be chained. The initial patch was incomplete, and new hotfixes were issued on October 12, 2026.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 10.0 (v4.0, VulDB (CNA))No advisory

    Details and sources (4 updates)
    Affected and fixed versions

    Up to 9.15.2.69 and 10.3.4.44 (per NVD). Fixed in 10.3.4.45 for v10 and 9.15.2.70 for v7-v9.

    Timeline and sources
    1. CVEs publishedSource (Open external link)
    2. Huntress reported exploitation observed from October 7Source (Open external link)
    3. Ahsay released updated hotfixesSource (Open external link)
    4. Added to CISA KEVSource (Open external link)
    Advisories

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.14

    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  31. Amazon Pay plugin for EC-CUBE 4

    EC-CUBE · CVE-2026-103671

    A flaw that can redirect shoppers to arbitrary websites during checkout, which may lead to theft of account information. The developer has confirmed attacks exploiting it.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud · Made in Japan

    CVSS 5.3 (v4.0, JVN (JPCERT/CC))No advisory

    Details and sources
    Affected and fixed versions

    Amazon Pay V2 plugin for 4.0/4.1 v1.0.0 to v1.1.12, for 4.2/4.3 v4.2.0 to v4.3.1, and Amazon Pay plugin (CV1) for 4.0 v1.3.0 and earlier.

    Timeline and sources
    1. JVN published an urgent vulnerability noteSource (Open external link)
    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  32. Updated

    SAP Security Patch Day (October 2026)

    SAP · CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108

    SAP released 16 new security notes and 4 GitHub advisories. Four were Critical, including an SSRF in SAP Cloud SDK for Python (CVSS 10.0).

    Latest announcement (Open external link)

    No exploitation reportFix availableBusiness apps and cloud

    CVSS 10.0 (v3.1, SAP)No advisory

    Details and sources (2 updates)
    Affected and fixed versions

    SAP Cloud SDK for Python before 0.45.2, NetWeaver Visual Composer, S/4HANA (S4CORE 105-109), Manufacturing Integration and Intelligence 15.4 and 15.5, and others.

    Timeline and sources
    1. Security notes released on October Patch DaySource (Open external link)
    2. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  33. Updated

    SonicWall SMA1000

    SonicWall · CVE-2026-102255

    A pre-authentication SSRF in the Work Place interface lets a remote attacker make the appliance send requests, reach internal functions and perform unauthorized operations.

    Latest announcement (Open external link)

    No exploitation reportFix availableNetwork appliances

    CVSS 10.0 (v3.1, CISA-ADP)No advisory

    Details and sources (3 updates)
    Affected and fixed versions

    SMA1000 models 6210, 7210 and 8200v running 12.4.3-03670 or 12.5.0-03082 (platform-hotfix) and earlier (per CCCS).

    Timeline and sources
    1. SonicWall published advisory SNWLID-2026-0017Source (Open external link)
    2. Canada's CCCS issued an advisorySource (Open external link)
    3. Researchers reported exploitation attemptsSource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  34. Updated

    ProFTPD“mod_copy”

    The ProFTPD Project · CVE-2015-3306

    A flaw disclosed in 2015 in the mod_copy module that lets unauthenticated attackers read and write arbitrary files via SITE CPFR/CPTO. A joint advisory listed it as exploited by China-linked actors.

    Latest announcement (Open external link)

    ExploitedFix availableOpen-source libraries

    CVSS 10.0 (v3.1, CISA-ADP)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)

    Details and sources (5 updates)
    Affected and fixed versions

    ProFTPD 1.3.5 with mod_copy. Fixed in 1.3.5a and 1.3.6rc1.

    Timeline and sources
    1. Debian published DSA-3263-1Source (Open external link)
    2. Fixed versions 1.3.5a and 1.3.6rc1 released (Bug 4169)Source (Open external link)
    3. Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
    4. Added to CISA KEVSource (Open external link)
    5. Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
    Advisories
    1. Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
    2. Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  35. Updated

    ONLYOFFICE Docs (Document Server)

    Ascensio System SIA (ONLYOFFICE) · CVE-2021-3199

    A flaw disclosed in 2021 that allows path traversal and remote code execution via image upload parameters when JWT is used. A joint advisory listed it as exploited by China-linked actors.

    Latest announcement (Open external link)

    ExploitedFix availableBusiness apps and cloud

    CVSS 9.8 (v3.1, NVD)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)

    Details and sources (4 updates)
    Affected and fixed versions

    Document Server before 5.6.3 (AA26-281A lists 5.1.5 through 5.6.2). Fixed in 5.6.3.

    Timeline and sources
    1. CVE published in NVDSource (Open external link)
    2. Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
    3. Added to CISA KEVSource (Open external link)
    4. Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
    Advisories
    1. Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
    2. Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  36. Updated

    Citrix NetScaler ADC and Gateway (SAML configurations)

    Cloud Software Group（Citrix） · CVE-2026-107406

    A memory overflow on appliances configured as a SAML SP or IdP may allow remote code execution or denial of service. September's fixed builds are also affected.

    Latest announcement (Open external link)

    No exploitation reportFix availableNetwork appliances

    CVSS 9.5 (v4.0, NetScaler (CNA))No advisory

    Details and sources (2 updates)
    Affected and fixed versions

    Builds before 13.1-64.29 and 14.1-73.46, including FIPS variants (per CCCS).

    Timeline and sources
    1. Citrix published bulletin CTX697191Source (Open external link)
    2. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  37. Updated

    Citrix NetScaler ADC / NetScaler Gateway

    Citrix (Cloud Software Group) · CVE-2026-88779

    A memory overflow flaw causes denial of service on appliances configured as a SAML SP or IdP. CISA noted it could be used to force a reboot that runs code injected via CVE-2026-88771.

    Latest announcement (Open external link)

    ExploitedFix availableNetwork appliances

    CVSS 8.7 (v4.0, Citrix)Abroad: CISA

    Details and sources (3 updates)
    Affected and fixed versions

    Customer-managed ADC and Gateway 14.1 before 14.1-73.41, 13.1 before 13.1-64.28, 14.1 FIPS before 14.1-73.41 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.282.

    Timeline and sources
    1. Citrix published bulletin CTX697174Source (Open external link)
    2. Added to CISA KEVSource (Open external link)
    3. CISA updated its September 27 alert to add this CVESource (Open external link)
    Advisories
    1. Abroad · CISASource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.04

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  38. Updated

    Apache Struts 2“S2-032”

    Apache Software Foundation · CVE-2016-3081

    A flaw disclosed in 2016 that allows remote code execution via the method: prefix when Dynamic Method Invocation is enabled. A joint advisory listed it as exploited by China-linked actors.

    Latest announcement (Open external link)

    ExploitedFix availableWeb platforms and languages

    CVSS 8.1 (v3.1, NVD)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)

    Details and sources (5 updates)
    Affected and fixed versions

    Struts 2.3.20 through 2.3.28, except 2.3.20.3 and 2.3.24.3. Fixed in 2.3.20.3, 2.3.24.3 and 2.3.28.1.

    Timeline and sources
    1. Fixed versions 2.3.20.3, 2.3.24.3 and 2.3.28.1 releasedSource (Open external link)
    2. CVE published in NVDSource (Open external link)
    3. Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
    4. Added to CISA KEVSource (Open external link)
    5. Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
    Advisories
    1. Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
    2. Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  39. Updated

    ISC BIND 9

    Internet Systems Consortium (ISC) · CVE-2015-5477

    A flaw disclosed in 2015 in which crafted TKEY queries make named exit, allowing remote denial of service. A joint advisory listed it as exploited by China-linked actors.

    Latest announcement (Open external link)

    ExploitedPartially fixedOpen-source libraries

    CVSS 7.8 (v2.0, ISC)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)

    Details and sources (4 updates)
    Affected and fixed versions

    BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2. Fixed in 9.9.7-P2 and 9.10.2-P3; ISC's advisory lists no fix for 9.8 and earlier.

    Timeline and sources
    1. ISC published the advisory and fixed versionsSource (Open external link)
    2. Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
    3. Added to CISA KEVSource (Open external link)
    4. Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
    Advisories
    1. Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
    2. Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  40. Updated

    Strapi

    Strapi Solutions SAS · CVE-2023-22894

    A flaw disclosed in 2023 in which filtering on private fields leaks email addresses, password hashes and reset tokens. Chained with CVE-2023-22621 it allows remote code execution.

    Latest announcement (Open external link)

    ExploitedPartially fixedWeb platforms and languages

    CVSS 7.2 (v3.1, CISA-ADP)Japan: National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Abroad: CISA, FBI, NSA and partners (joint advisory AA26-281A)

    Details and sources (5 updates)
    Affected and fixed versions

    3.2.1 and later, before 4.8.0. Fixed in 4.8.0. v3 reached end of life on December 31, 2022 and receives no fix.

    Timeline and sources
    1. Fixed version 4.8.0 releasedSource (Open external link)
    2. Strapi disclosed the vulnerability detailsSource (Open external link)
    3. Listed as an exploited CVE in joint advisory AA26-281A by agencies of seven countriesSource (Open external link)
    4. Added to CISA KEVSource (Open external link)
    5. Japan's NPA and NCO announced co-signing the advisorySource (Open external link)
    Advisories
    1. Abroad · CISA, FBI, NSA and partners (joint advisory AA26-281A)Source (Open external link)
    2. Japan · National Police Agency and National Cybersecurity Office (co-signers of AA26-281A)Source (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.08

    Why it is listed

    Confirmed exploitation, Government advisory

    Sources checked: 2026-11-02

  41. Updated

    Cisco NX-OS, Nexus, License On-Prem and others (October 7 release)

    Cisco · CVE-2026-76482, CVE-2026-76471, CVE-2026-76485, CVE-2026-76486 and 12 more

    Cisco published advisories including unauthenticated root code execution flaws in NX-OS NX-API, NGOAM and MPLS OAM, with scores of CVSS 9.0 or higher.

    Latest announcement (Open external link)

    No known exploitationPartially fixedNetwork appliances

    CVSS 10.0 (v3.1, Cisco)No advisory

    Details and sources (5 updates)
    Affected and fixed versions

    Nexus 3000 and 9000 Series, NX-OS, License (Smart Software Manager) On-Prem, APIC and Meraki products. Some Meraki fixes were scheduled for late October to mid-November.

    Timeline and sources
    1. Advisories published, including the NX-API RCESource (Open external link)
    2. NGOAM RCE advisory publishedSource (Open external link)
    3. License On-Prem hardening release publishedSource (Open external link)
    4. Meraki hardening release publishedSource (Open external link)
    5. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  42. Updated

    Zammad

    Zammad GmbH · CVE-2026-102489, CVE-2026-102490

    Two flaws: a session hijack leading to code execution as the zammad user, and a local privilege escalation to root in DEB and RPM packages. They can be chained.

    Latest announcement (Open external link)

    ExploitedPartially fixedBusiness apps and cloud

    CVSS 9.8 (v3.1, NVD)No advisory

    Details and sources (5 updates)
    Affected and fixed versions

    CVE-2026-102489: 6.3.0-6.5.4 (also present in 7.0.0-7.1.x but described as not exploitable; 6.5 and older are out of support). CVE-2026-102490: DEB/RPM packages 7.2.1 and earlier, fixed in 7.2.2.

    Timeline and sources
    1. DIVD made limited disclosure and began notifying ownersSource (Open external link)
    2. Zammad posted a statement on its community forumSource (Open external link)
    3. Added to CISA KEVSource (Open external link)
    4. Zammad published security advisorySource (Open external link)
    5. Fix for CVE-2026-102490 released in 7.2.2Source (Open external link)
    Advisories

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.02

    Why it is listed

    Confirmed exploitation

    Sources checked: 2026-11-02

  43. Updated

    Fortinet FortiMail

    Fortinet · CVE-2026-104286

    A path traversal flaw lets an unauthenticated attacker write arbitrary files via crafted HTTP or HTTPS requests. Exploitation in the wild has been reported.

    Latest announcement (Open external link)

    ExploitedPartially fixedNetwork appliances

    CVSS 9.8 (v3.1, Fortinet)Abroad: CCCS, CSA Singapore

    Details and sources (6 updates)
    Affected and fixed versions

    Versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9 and all 7.0 versions. The 7.2.10 fix has not yet been released, and there is no fix for 7.0.

    Timeline and sources
    1. Advisory FG-IR-26-175 publishedSource (Open external link)
    2. Added to KEVSource (Open external link)
    3. Fortinet published advisorySource (Open external link)
    4. FortiMail Cloud fixed and advisory updatedSource (Open external link)
    5. Fortinet updated solution and remediated FortiMail CloudSource (Open external link)
    6. Fortinet clarified FortiMail Cloud fixSource (Open external link)
    Advisories
    1. Abroad · CCCSSource (Open external link)
    2. Abroad · CSA SingaporeSource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.10.01

    Why it is listed

    Confirmed exploitation, Critical severity (CVSS 9.0+), Government advisory

    Sources checked: 2026-11-02

  44. Updated

    Movable Type

    Six Apart · CVE-2026-96408, CVE-2026-103668

    Flaws in the upgrade and search scripts can allow arbitrary Perl code or SQL execution. The site search flaw can expose data, including unpublished data.

    Latest announcement (Open external link)

    No exploitation reportPartially fixedWeb platforms and languages · Made in Japan

    CVSS 9.4 (v3.0, JVN (JPCERT/CC))Japan: IPA

    Details and sources (3 updates)
    Affected and fixed versions

    Movable Type 9.2.1, 9.0.9, 8.8.5, 8.0.12 and earlier, and Movable Type Premium 9.2.1, 9.0.9, 2.17 and earlier. End-of-life versions are also affected and have no fix.

    Timeline and sources
    1. Vendor released fixed versions (9.3.0, 9.0.10, 8.8.6, 8.0.13, Premium 2.18 and others)Source (Open external link)
    2. JVN published a vulnerability noteSource (Open external link)
    3. IPA published an alertSource (Open external link)
    Advisories
    1. Japan · IPASource (Open external link)
    Why it is listed

    Government advisory, Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  45. Updated

    VMware Workstation and Fusion

    Broadcom（VMware） · CVE-2026-59346, CVE-2026-59347

    Fixes include a VMXNET3 integer overflow that lets an attacker with admin rights in a VM execute code on the host.

    Latest announcement (Open external link)

    No exploitation reportFix availableBusiness apps and cloud

    CVSS 9.3 (v3.1, VMware (Broadcom))No advisory

    Details and sources (2 updates)
    Affected and fixed versions

    Workstation and Fusion before 26H1u1 (per CCCS).

    Timeline and sources
    1. VMSA-2026-0007 publishedSource (Open external link)
    2. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  46. Updated

    NetScaler ADC / NetScaler Gateway

    Cloud Software Group（Citrix） · CVE-2026-88771, CVE-2026-88772

    Two flaws that can let unauthenticated remote attackers execute arbitrary code. Exploitation has been confirmed, including post-compromise activity such as web shell installation.

    Latest announcement (Open external link)

    ExploitedFix availableNetwork appliances

    CVSS 9.5 (v4.0, Cloud Software Group (CNA))Japan: JPCERT/CC, IPA

    Details and sources (3 updates)
    Affected and fixed versions

    Versions before 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 (FIPS and NDcPP). CVE-2026-88772 affects configurations with DTLS enabled.

    Timeline and sources
    1. CISA added both CVEs to the KEV catalogSource (Open external link)
    2. JPCERT/CC published an alertSource (Open external link)
    3. JPCERT/CC added indicators and guidance published by Mandiant and GTIGSource (Open external link)
    Advisories
    1. Japan · JPCERT/CCSource (Open external link)
    2. Japan · IPASource (Open external link)

    Added to the CISA Known Exploited Vulnerabilities catalog on 2026.09.27

    Why it is listed

    Government advisory, Confirmed exploitation, Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

  47. Updated

    WatchGuard Endpoint Security

    WatchGuard · CVE-2026-13043

    Missing authentication in the kernel memory access driver lets a local authenticated attacker read kernel and process memory.

    Latest announcement (Open external link)

    No exploitation reportFix availableBusiness apps and cloud

    CVSS 9.3 (v4.0, WatchGuard)No advisory

    Details and sources (2 updates)
    Affected and fixed versions

    Endpoint Security for Windows before 8.00.26.0012.

    Timeline and sources
    1. Advisory publishedSource (Open external link)
    2. Canada's CCCS issued an advisorySource (Open external link)
    Why it is listed

    Critical severity (CVSS 9.0+)

    Sources checked: 2026-11-02

Coverage and terms

What is listed

  • Vulnerabilities in Japan or abroad that meet at least one of the following: (1) an advisory from a government agency such as JPCERT/CC, IPA, Japan's National Cybersecurity Office, CISA or CERT-EU; (2) confirmed exploitation, through addition to CISA's KEV catalog or a report by the vendor or others; (3) critical severity (CVSS 9.0 or higher) in a widely used product; (4) service suspensions or emergency maintenance attributed to the vulnerability; (5) wide discussion on X (formerly Twitter).
  • Several vulnerabilities announced together for the same product are listed as one entry. Follow-ups such as fixed releases, related new vulnerabilities and confirmed exploitation are added to the same entry's timeline.
  • Initial coverage includes announcements and follow-ups from October 1, 2026. This is not a complete list of every vulnerability announced.

Reading each entry

  • Severity is the CVSS score published by the vendor or a government agency, shown with the scorer and the CVSS version. Scores from different versions are not comparable.
  • “Exploited” means the vulnerability was added to CISA's KEV catalog, or the vendor, a government agency or a security firm reported exploitation. “Public proof of concept” means a government agency or the vendor reported published exploit code.
  • “Fix available” means fixed releases exist for all supported versions. “Partially fixed” means some versions, such as end-of-life releases, have no fix. “Mitigation only” means no fix has been released and the vendor has published a workaround.
  • “Discussed on X” means wide discussion on X was confirmed through news or specialist media reports, or through summaries that aggregate reactions on X (such as Yahoo! Realtime Search). Individual posts on X are not used as sources.
  • Remediation steps are not described here. Please refer to the advisories and vendor announcements linked in each entry.

Corrections

If an entry is wrong, or a new announcement has changed the facts, please let us know through the contact form. We will check and correct it.

ContactData Breach & Cyberattack NewsAI Legal Lab