Live · 98 sources · updated 20m ago

· 06:51 UTC

The Security Standard

A daily wire for defenders: vulnerabilities, advisories, research, standards.

KEV CISA KEV

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

KEV · due 13 Nov 2026 Fix available CVE-2026-118527 Ivanti Edge / VPN / firewall
Vendor
Ivanti
Product
Connect Secure
CISA KEV
added 30 Oct 2026, due 13 Nov 2026 (12d)
Exploitation
observed in the wild
Fix
available
Weakness
CWE-340
Exposure class
Edge / VPN / firewall

Read at CISA KEV Details and related coverage

Top of the wire

Ranked list →
  1. 87
    KEV NVD

    Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

    Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload…

    KEV · due 1 Nov 2026 CVSS 8.6 Fix available CVE-2026-76418 Cisco
  2. 86
    KEV CISA KEV

    Linux Kernel Missing Initialization of a Variable Vulnerability

    Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing…

    KEV · due 31 Oct 2026 (overdue) EPSS 0.16 Fix available CVE-2026-46300 Linux kernel
  3. 81
    Research Rapid7

    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

    Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x , 24.x , and 22.x…

    Exploited CVSS 9.2 EPSS 0.83 CVE-2026-111497 Google Node.js
  4. 80
    KEV CISA KEV

    Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

    Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control…

    KEV · due 10 Nov 2026 EPSS 0.45 Fix available CVE-2026-48356 Adobe
  5. 79
    Tenable research Tenable

    php2shell one week later: Why one exploit doesn’t work everywhere

    php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the…

    Exploited CVSS 9.2 EPSS 0.16 Fix available CVE-2026-109618CVE-2026-109619CVE-2021-44228+1 more PHP
  6. 77
    CISA alert CISA

    CISA Adds Two Known Exploited Vulnerabilities to Catalog

    CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound…

    Exploited EPSS 0.27 CVE-2026-97229CVE-2026-76418 Cisco GitLab
  7. 75
    KEV CISA KEV

    Broadcom VMWare ESX Insufficient Logging Vulnerability

    Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

    KEV · due 11 Nov 2026 Fix available CVE-2026-41709 VMware (Broadcom)
  8. 71
    CISA alert CISA

    CISA Adds Two Known Exploited Vulnerabilities to Catalog

    CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function…

    Exploited CVE-2026-111357CVE-2026-118527 Ivanti
  9. 69
    CISA alert CISA

    CISA Adds Two Known Exploited Vulnerabilities to Catalog

    CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type…

    Exploited EPSS 0.83 CVE-2026-48356CVE-2026-111497 Google Adobe
  10. 66
    CISA alert CISA

    CISA Adds Two Known Exploited Vulnerabilities to Catalog

    CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability CVE-2026-46300 Linux…

    Exploited EPSS 0.16 CVE-2026-41709CVE-2026-46300 VMware (Broadcom) Linux kernel
  11. 66
    Advisory Fortinet PSIRT

    Node2Shell CVEs

    CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js…

    CVSS 9.8 EPSS 0.83 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
  12. 64
    CISA alert CISA

    CISA Adds Two Known Exploited Vulnerabilities to Catalog

    CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching : CVE-2026-109618 – PHP Memory Corruption…

    Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619
  13. 61
    News The Register

    CISA confirms PHP2Shell under attack as researchers clock successful exploits

    Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells

    Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
  14. 60
    Cisco advisory Cisco PSIRT

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could…

    EPSS 0.89 Fix available CVE-2026-20127 Cisco

Advisories

All advisories →
  1. 53
    Cisco advisory Cisco PSIRT

    Vulnerabilities in Node.js Affecting Cisco Products: October 2026

    EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+1 more Cisco Node.js
  2. 51
    Advisory MSRC

    Chromium: CVE-2026-118304 Improper input validation in SVG

    Fix available CVE-2026-118304 Microsoft Google
  3. 51
    Advisory MSRC

    Chromium: CVE-2026-118316 Improper input validation in V8

    Fix available CVE-2026-118316 Microsoft Google
  4. 51
    Advisory MSRC

    Chromium: CVE-2026-118310 Improper input validation in Views

    Fix available CVE-2026-118310 Microsoft Google
  5. 51
    Advisory MSRC

    Chromium: CVE-2026-118328 Improper input validation in WebRTC

    Fix available CVE-2026-118328 Microsoft Google
  6. 51
    Advisory MSRC

    Chromium: CVE-2026-118332 Improper input validation in Compositing

    Fix available CVE-2026-118332 Microsoft Google
  7. 51
    Advisory MSRC

    Chromium: CVE-2026-118331 Improper input validation in FileAPI

    Fix available CVE-2026-118331 Microsoft Google
  8. 51
    Advisory MSRC

    Chromium: CVE-2026-118329 Improper input validation in ANGLE

    Fix available CVE-2026-118329 Microsoft Google
  9. 51
    Advisory MSRC

    Chromium: CVE-2026-118336 Improper input validation in Headless

    Fix available CVE-2026-118336 Microsoft Google
  10. 51
    Advisory MSRC

    Chromium: CVE-2026-118343 Improper input validation in ReadingList

    Fix available CVE-2026-118343 Microsoft Google

Research & threat intelligence

All research →
  1. 19
    Talos research Talos

    Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

    The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.

  2. 24
    ISC diary SANS ISC

    Wireshark 5.0.0rc1 Release

    Wireshark Release Candidate 5.0.0 was published : soon we can expect a new major version of Wireshark.

    Wireshark / tcpdump
  3. 19
    ISC diary SANS ISC

    YARA-X 1.22.1 Release

    YARA-X&#;x26;#;39;s 1.22.1 is a bugfix version, it brings 2 bugfixes.

  4. 15
    Threat intelligence Microsoft TI

    Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

    Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it. The post Inside a malicious Claude Code-branded extension and its persistent SSH backdoor…

    Microsoft Anthropic
  5. 8
    Wiz Research Wiz

    “Black October” for AI Developer Platforms

    A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale.

  6. 8
    Research Censys

    Introducing Censys Starter Subscriptions

    Your credits now go up to 4x further If you’ve used a Censys Free or Starter Plan, you know the old credit model: a basic lookup cost one credit, a standard search cost five, and an advanced regex query cost eight. You ended up…

  7. 8
    Research Eclypsium

    Cybersecurity Dive: Hackers could poison AI models by tampering with core infrastructure

    AI systems rely on a complex web of hardware. Compromising any one component could let adversaries change model weights. The post Cybersecurity Dive: Hackers could poison AI models by tampering with core infrastructure appeared…

  8. 20
    Research Cloudflare

    4 real? Tracking exploitation and patching of eMudhra’s weak keys

    Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates. Here’s how we quickly patched Cloudflare, what evidence we can see of attempted exploitation, and how much…

    No fix yet Cloudflare
  9. 28
    Threat intelligence Microsoft TI

    From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

    Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and…

    Microsoft
  10. 52
    Research Rapid7

    Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

    Overview An origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user. The entry point is the public customer…

    PoC public EPSS 0.19 CVE-2026-102764 BeyondTrust Rapid7

News

All news →
  1. 22
    News WIRED

    Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

  2. 17
    News SecurityWeek

    Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

  3. 8
    News TechCrunch

    Applebee’s exposed customers’ personal data after leaving database password in app

  4. 13
    News CyberScoop

    China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days

    CrowdStrike
  5. 19
    News Ars Technica

    Anthropic VS code extension on Cursor backdoored for nearly 12 hours

    Microsoft Anthropic
  6. 8
    News The Record

    DOJ raises privacy concerns over potential sale of Character.AI chats

  7. 13
    News WIRED

    A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

    Anthropic
  8. 13
    News Dark Reading

    Devs Hit by Trojanized Claude Code Extension for Cursor

    Anthropic
  9. 8
    News Dark Reading

    Behind the Scenes of How Operation Blackout Went Down

  10. 8
    News The Register

    Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see

  11. 8
    News The Record

    Fashion retailer Resolve says hackers stole payment card information

  12. 8
    News CyberScoop

    Apple notifications alert victims in 99 countries about mercenary spyware infections

    Apple

Keyboard

j / k
Next / previous item
o or Enter
Open the original source
i
Open the item page
s
Save or unsave for later
/
Focus search
g then f v a r n s
Go to front, vulnerabilities, advisories, research, news, standards
t
Toggle theme
?
This help