AX·NEWS
Sign in

CVE watch

CVE watch: the vulnerabilities that matter now

210 vulnerabilities quoted by the shared stories in the last 60 days. The ones that matter, with what is impacted and a link to each official record.

RSS feedOn your SOC screen

The 20 that mattered most — last 60 days

Ranked by exploitation in the wild (CISA KEV, ransomware), severity (CVSS), coverage and recency.

  1. CVE-2026-109618 9.2 Exploited PHP Memory Corruption Vulnerability PHP < 8.2.35 · < 8.3.36 · < 8.4.27 +1 21 outlets
  2. CVE-2026-109619 9.2 Exploited PHP Stale Internal Request-State Vulnerability PHP < 8.2.35 · < 8.3.36 · < 8.4.27 +1 20 outlets
  3. CVE-2026-111497 9.2 Exploited Google Brotli Unchecked Return Value Vulnerability Google Brotli < 1.0.10 · < 1.1.1 · < 1.2.1 6 outlets
  4. CVE-2026-35273 9.8 Exploited Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle PeopleSoft Enterprise Peop… 8.61 · 8.62 7 outlets
  5. CVE-2026-88771 9.5 Exploited Citrix NetScaler Improper Input Validation Vulnerability Citrix NetScaler ADC < 14.1-73.37 · < 13.1-64.23 7 outlets
  6. CVE-2026-88772 9.5 Exploited Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC < 14.1-73.37 · < 13.1-64.23 7 outlets
  7. CVE-2026-87902 8.1 Exploited WordPress Core Remote File Inclusion Vulnerability WordPress < 7.1.2 5 outlets
  8. CVE-2021-22205 10.0 Exploited GitLab Community and Enterprise Editions Remote Code Execution Vulnerability Gitlab < 13.8.8 · < 13.9.6 · < 13.10.3 1 outlet
  9. CVE-2026-123218 9.8 Exploited IBM Aspera Faspex Incorrect Authorization Vulnerability IBM Aspera Faspex ≤ 5.0.19 1 outlet
  10. CVE-2015-3306 10.0 Exploited ProFTPD Improper Access Control Vulnerability Fedora 20 · 21 · 22 2 outlets
  11. CVE-2026-97229 10.0 Exploited GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability GitLab < 19.2.8 · < 19.3.5 · < 19.4.2 3 outlets
  12. CVE-2026-123158 8.1 Exploited OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability OpenBSD OpenSSH < 10.6p2 3 outlets
  13. CVE-2026-21589 9.3 Exploited Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Bitbucket Data Center < 9.4.26 · < 10.2.8 · < 10.5.1 4 outlets
  14. CVE-2026-86950 8.8 Exploited Apple Multiple Products Out-of-Bounds Write Vulnerability Apple iOS and iPadOS < 18.7.11 · < 26.7.1 5 outlets
  15. CVE-2026-102764 9.3 Exploited BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust Remote Support ≤ 26.2.3 4 outlets
  16. CVE-2021-3199 9.8 Exploited ONLYOFFICE Docs Server Path Traversal Vulnerability Document Server < 5.6.3 1 outlet
  17. CVE-2026-102490 9.4 Exploited Zammad GmbH Zammad Improper Privilege Management Vulnerability Zammad < 7.2.2 1 outlet
  18. CVE-2023-20198 10.0 Exploited Cisco IOS XE Web UI Privilege Escalation Vulnerability Cisco IOS XE Software 16.1.1 → 17.11.99SW (186 versions) 1 outlet
  19. CVE-2026-0322 8.6 Exploited Palo Alto Networks PAN-OS Code Injection Vulnerability Palo Alto Networks PAN-OS < 12.2.4 · < 12.1.10-h2 · < 11.2.16 +2 3 outlets
  20. CVE-2026-102895 9.8 Exploited GPUStack Improper Authentication Vulnerability gpustack < 2.2.0 0 outlets

In the news this week

  1. CVE-2026-125350 Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 1 outlet
  2. CVE-2026-123218 9.8 CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws 1 outlet
  3. CVE-2026-113964 5.4 Apples for iOS 27.2.1 Updates, fixes 9 loopholes including Message Talk Permissions 1 outlet
  4. CVE-2026-113965 5.4 Apples for iOS 27.2.1 Updates, fixes 9 loopholes including Message Talk Permissions 1 outlet
  5. CVE-2026-113968 5.4 Apples for iOS 27.2.1 Updates, fixes 9 loopholes including Message Talk Permissions 1 outlet
  6. CVE-2026-113969 Apples for iOS 27.2.1 Updates, fixes 9 loopholes including Message Talk Permissions 1 outlet
  7. CVE-2026-113970 8.8 Apples for iOS 27.2.1 Updates, fixes 9 loopholes including Message Talk Permissions 1 outlet
  8. CVE-2026-113971 3.5 Apple iOS / iPados 18.7.12 Official release system to repair 6 security holes 1 outlet
  9. CVE-2026-111497 9.2 This week's "node2shell" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of Brotli 6 outlets
  10. CVE-2026-113960 Apples for iOS 27.2.1 Updates, fixes 9 loopholes including Message Talk Permissions 1 outlet
  11. CVE-2026-113961 7.5 Apples for iOS 27.2.1 Updates, fixes 9 loopholes including Message Talk Permissions 1 outlet
  12. CVE-2026-113963 5.5 Apples for iOS 27.2.1 Updates, fixes 9 loopholes including Message Talk Permissions 1 outlet
  13. CVE-2026-123158 8.1 Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th) 3 outlets
  14. CVE-2026-19868 7.5 SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins 2 outlets
  15. CVE-2026-98432 9.8 Protecting against CVE-2026-98432 6 outlets
  16. CVE-2025-41450 8.2 Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller 1 outlet
  17. CVE-2026-83844 7.0 MS Paint Remote Code Execution Vulnerability 3 outlets
  18. CVE-2026-116606 9.3 Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access 1 outlet
  19. CVE-2015-3306 10.0 Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies 2 outlets
  20. CVE-2015-5477 7.5 October 2026 CVE Landscape 1 outlet
  21. CVE-2016-3081 8.1 October 2026 CVE Landscape 1 outlet
  22. CVE-2021-22205 10.0 October 2026 CVE Landscape 1 outlet
  23. CVE-2021-3199 9.8 October 2026 CVE Landscape 1 outlet
  24. CVE-2021-4034 7.8 October 2026 CVE Landscape 1 outlet
  25. CVE-2023-22894 4.9 October 2026 CVE Landscape 1 outlet
  26. CVE-2023-4863 8.8 October 2026 CVE Landscape 1 outlet
  27. CVE-2025-61624 6.0 PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions 2 outlets
  28. CVE-2025-8088 8.4 October 2026 CVE Landscape 1 outlet
  29. CVE-2026-0322 8.6 Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks 3 outlets
  30. CVE-2026-102490 9.4 October 2026 CVE Landscape 1 outlet
  31. CVE-2026-109618 9.2 PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) 21 outlets
  32. CVE-2026-109619 9.2 Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) ＆#x5b;infocon yellow＆#x5d;, (Wed, Oct 21st) 20 outlets
  33. CVE-2026-86124 9.3 October 2026 CVE Landscape 1 outlet
  34. CVE-2026-87902 8.1 Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure 5 outlets
  35. CVE-2026-121728 6.9 SourceHut disabled registration bypass | CVE-2026-121728 1 outlet
  36. CVE-2023-20198 10.0 Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th) 1 outlet
  37. CVE-2026-107441 8.8 Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day 1 outlet
  38. CVE-2024-27834 5.5 Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says 1 outlet
  39. CVE-2026-91403 9.1 A 12-Year-Old Security Flaw Was Just the Beginning | Threat Wire 2 outlets
  40. CVE-2026-109593 9.1 SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records 1 outlet
  41. CVE-2000-0411 5.0 The Classics Return: Vulnerable E-Mail Scripts, (Wed, Nov 4th) 1 outlet
  42. CVE-2026-58868 Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction 1 outlet
  43. CVE-2026-119977 8.1 CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades 1 outlet