Weekly Vulnerability Report: Oct 26 – Nov 1, 2026
26 new CVEs were published, 15 of them rated critical or high. 10 were added to CISA's exploited list.
Between October 26, 2026 and November 1, 2026, 26 new vulnerabilities were published, 64% fewer than the previous week (73). 15 of them, or 58%, were rated high or critical. The busiest day was October 30, 2026, with 8 CVEs.
CISA confirmed active exploitation of 10 vulnerabilities during the week. These are listed first below because attackers are already using them. ARKETEAM had the most new CVEs (5), and improper neutralization of special elements used in an SQL command was the most common weakness type (3).
Confirmed exploited this week
- 9.8 Critical severity
PHP Memory Corruption Exploited
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The su
- 8.1 High severity
PHP Stale Internal Request-State Exploited
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subse
- 9.8 Critical severity
Google Brotli Unchecked Return Value Exploited
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a
- 9.3 Critical severity
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Exploited
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session
- 2.7 Low severity
Broadcom VMWare ESX Insufficient Logging Exploited
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
- 7.8 High severity
Linux Kernel Missing Initialization of a Variable Exploited
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain th
- 8.6 High severity
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Exploited
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexp
- 10.0 Critical severity
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Exploited
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server
- 7.0 High severity
Ivanti Connect Secure Missing Authentication for Critical Function Exploited
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
- 4.3 Medium severity
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
The 14 most important new vulnerabilities
- 8.6 High severity
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Exploited
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexp
- 8.1 High severity
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Exploited
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the se
- 9.3 Critical severity
Management Pack for Microsoft System Center: Deserialization of Untrusted Data
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
- 8.7 High severity
HBS 3 Hybrid Backup Sync: Use of Hard-coded Cryptographic Key
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the v
- 8.7 High severity
HBS 3 Hybrid Backup Sync: Use of Hard-coded Cryptographic Key
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the v
- 9.8 Critical severity
Intelligent Connection Center: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.
- 8.2 High severity
llama.cpp: Improper Validation of Array Index
llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to t
- 8.7 High severity
Database Cleaner: Cleanup, Optimization & Repair: Improper Access Control
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, wi
- 8.3 High severity
WSO2 API Manager: Server-Side Request Forgery
Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resour
- 8.6 High severity
FlexNet Publisher: Inclusion of Functionality from Untrusted Control Sphere
A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release.
- 8.4 High severity
PROTECTELMAJ: Improper Neutralization of Special Elements used in an SQL Command
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTE
- 8.4 High severity
PROTECTELMAJ: Improper Neutralization of Special Elements used in an SQL Command
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTE
- 7.7 High severity
SecureConnector: Improper Certificate Validation
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allow
- 7.1 High severity
Acronis Cyber Protect Cloud Agent: Weak Authentication
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 3 | 12% |
| High | 12 | 46% |
| Medium | 10 | 38% |
| Low | 1 | 4% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.