3 Nov 2026 · updated 21:30 UTC
New CVEs, and the ones attackers are using
7 flaws confirmed exploited this week and 13 critical CVEs published in the last 72 hours, from CISA, CVE.org, NVD and GitHub. Open any of them for who is affected, how to fix it, and one-click prompts for Claude Code, Codex and Cursor.
Exploited this week
7CISA has evidence attackers are using these. Patch them first, whatever their score.
- WordPress CoreCVE-2026-119977Exploited in the wild · listed 22h agoWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
- Ivanti Connect SecureCVE-2026-118527Exploited in the wild · listed 5d agoIvanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- Ivanti Connect SecureCVE-2026-111357Exploited in the wild · listed 5d agoIvanti Connect Secure Missing Authentication for Critical Function Vulnerability
- GitLab Community Edition and Enterprise EditionCVE-2026-97229Exploited in the wild · listed 6d agoGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-76418Exploited in the wild · listed 6d agoCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- Broadcom VMware ESXCVE-2026-41709Exploited in the wild · listed 7d agoBroadcom VMWare ESX Insufficient Logging Vulnerability
- Linux KernelCVE-2026-46300Exploited in the wild · listed 7d agoLinux Kernel Missing Initialization of a Variable Vulnerability
New critical, last 72 hours
13Scored 9 or more out of 10 by the vendor, the CVE assigner or NVD. Not known to be exploited yet. If you run one, patch it this week.
- Dell Wyse Management SuiteCVE-2026-82158Critical 9.0 · published 37m agoDell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-s
- npm @enspirit/eloCVE-2026-44267Critical · published 4h agoElo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access
- npm @enspirit/eloCVE-2026-44266Critical · published 4h agoElo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
- CVE-2026-120518CVE-2026-120518Critical 9.1 · published 16h agoThe BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0.78% exploit odds
- CVE-2026-86596CVE-2026-86596Critical 9.8 · published 23h agoThe s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name'1.5% exploit odds
- CVE-2026-120442CVE-2026-120442Critical 9.3 · published 30h agoape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tok0.48% exploit odds
- CVE-2026-120345CVE-2026-120345Critical 9.3 · published 39h agoA vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965.2.0% exploit odds
- CVE-2026-120281CVE-2026-120281Critical 9.3 · published 44h agoA vulnerability was found in WAVLINK WN536AX6-A V260507.0.58% exploit odds
- CVE-2026-120280CVE-2026-120280Critical 9.3 · published 44h agoA vulnerability has been found in WAVLINK WN536AX6-A V260507.2.0% exploit odds
- CVE-2026-120277CVE-2026-120277Critical 9.3 · published 45h agoA security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0.2.5% exploit odds
- CVE-2026-120276CVE-2026-120276Critical 9.3 · published 45h agoA weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0.3.2% exploit odds
- CVE-2026-120195CVE-2026-120195Critical 9.3 · published 3d agoA security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4.2.1% exploit odds
- CVE-2026-120189CVE-2026-120189Critical 9.3 · published 3d agoA vulnerability was identified in D-Link DIR-505 1.10B02.1.3% exploit odds
In the news
1Named in security reporting or already exploited, ranked by coverage and exploit odds.