Exploited bugs, new critical vulnerabilities, and what defenders should check.
ExploitedCVE-2026-102895CVSS 9.84 min read
SignalWire says the FreeSwitch code injection flaw has been exploited in the wild; CISA's KEV listing gives federal agencies until 12 November 2026 to apply mitigations.
ExploitedCVE-2026-102895CVSS 9.84 min read
CISA added the GPUStack improper authentication flaw to its Known Exploited Vulnerabilities catalog on 9 November 2026, with a remediation due date of 12 November. The vendor says exploitation was seen against a 2.1.1 deployment.
ExploitedCVE-2026-96654CVSS 6.94 min read
QNAP says some users' Plex Media Server installs appear compromised through a four-flaw chain patched this summer. Internet-facing boxes should be treated as potentially compromised, the vendor says.
ExploitedCVE-2026-123158CVSS 8.14 min read
Attackers are using a password authentication bypass in OpenSSH on musl-based Linux to log into accounts whose password field is set to an asterisk, then hunting for keys, hashes and cloud metadata.
ExploitedCVE-2026-123158CVSS 8.12 min read
WatchTowr and Previdian say attackers are hitting the recently patched OpenSSH flaw; so far the traffic looks like botnets and crypto miners.
Brief2 min read
A jitterentropy health test run in FIPS mode during early boot intermittently fails on certain AMD EPYC processors, and the kernel panics instead of starting.
ExploitedCVE-2026-97229CVSS 10.01 min read
Rapid7's weekly wrapup lists a new module for the unauthenticated NetScaler bug that Citrix said was exploited before disclosure, alongside modules for Cisco Secure Email Gateway and GitLab.
CVE-2026-83844CVSS 7.02 min read
The patched Paint build is 11.2609.401.0, and machines that only take Windows updates won't get it.
ExploitedCVE-2026-116606CVSS 9.31 min read
Two flaws in the email-filtering appliance chain to root access with no credentials. Barracuda shipped patches on Monday; watchTowr published the chain on Thursday.
ExploitedCVE-2026-19868CVSS 7.52 min read
SonicWall says it investigated a report of potential exploitation of the authentication bypass in SonicOS SSLVPN. CISA added it to KEV the same day.
Brief2 min read
D-Link has published mitigation steps for multiple unpatched bugs in the DGS-3130 series, but no CVE IDs and no firmware fix yet.
ExploitedCVE-2026-123158CVSS 8.12 min read
Previdian says attackers went after the musl-without-PAM password bypass quickly, and one honeypot gave up root. The bug only bites a narrow set of builds.
