Patch Now
KEV additions, federal deadlines, vendor-confirmed active exploitation, a mitigation standing in for an absent patch
-
Adobe still reports no known exploits for the Magento upload flaw CISA added to KEV, and its bulletin scores it 9.6 where its own CVE record says 9.3
CVE-2026-48356 was published on July 14 and reached the federal catalog on October 27 with a November 10 deadline; the only public exploitation evidence is one vendor’s research,…
-
Brotli’s decoder flaw is on KEV with a November 10 deadline, and the build headed for Debian stable is still unpatched
CISA’s catalog names the entry after the unchecked return value rather than the out-of-bounds write that Google’s own release note leads with, and Debian’s tracker still marks the…
-
WatchGuard’s 18 new Fireware CVEs name three fixed releases that its own release notes do not list
Eighteen Fireware OS advisories went up at 10:52 a.m. Central on Tuesday, seven of them critical and six reachable before authentication, and the three releases every one of…
-
Forescout’s endpoint agent stops checking server fingerprints past the third appliance entry, and the newest build Forescout documents sits inside the affected range
Forescout published CVE-2025-13833 on Monday afternoon against its own Windows endpoint agent, said nothing about a fixed build, and pointed the only reference at a customer login page.…
-
WP Stripe Checkout accepted unverified webhooks by default; Chikkili Google Pay has no fix and was closed October 14
Two WordPress payment plugins disclosed in the same batch let unauthenticated callers mark a store’s orders paid — one shipped with signature verification off by default, the other…
-
Arista’s second exploited VeloCloud Orchestrator flaw in a month needs only a read-only account, and its whole federal clock is a weekend
CISA gave CVE-2026-114625 a federal remediation deadline of Monday, October 26, 2026 on Friday evening — and Arista’s own advisory says the minimum role an attacker needs is…
-
Collabora’s exploited Nextcloud app can only be attacked while it is not running, and disabling the app does not stop it
CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities catalog on Friday, October 23, 2026, with a federal deadline of Monday, October 26 — and the vulnerable window in…
-
The only fix on record for the 8.8 in Hugging Face Datasets is an unmerged pull request from the person who found it
Every released version is in the affected range, no vendor advisory exists, and the GitHub advisory entry that dependency scanners read names no package and no versions. What…
-
EDK2’s 9.5 pre-boot RCE is fixed in master, carried by no stable tag, and its own advisory says not patched
TianoCore published a 9.5 Critical overflow in EDK II’s PXE boot driver on October 22, and its advisory’s patched-versions field reads “Not patched currently” — a week after…
-
Joomla scores the YOOtheme Pro image handler a perfect 10.0 and marks it attacked, and CISA’s own block in the record says exploitation none
Joomla’s CVE record for the YOOtheme Pro image handler scores it a perfect 10.0, marks exploitation as ATTACKED, and cites one URL: the vendor’s homepage. What happened NVD…
-
CISA gives SiteGuard’s exploited WAF flaw three days and a forensic triage, and the record still says local access only
CISA added CVE-2026-106931 to its catalog on October 20 with a deadline of Friday, October 23, while the record’s only scores still describe an attacker who is already…