AX·NEWS
Sign in

CVE watch

CVE watch: the vulnerabilities that matter now

218 vulnerabilities quoted by the shared stories in the last 60 days. The ones that matter, with what is impacted and a link to each official record.

RSS feedOn your SOC screen

The 20 that mattered most — last 60 days

Ranked by exploitation in the wild (CISA KEV, ransomware), severity (CVSS), coverage and recency.

  1. CVE-2026-109618 9.2 AWS Weekly Roundup: Amazon Polly Generative engine, TorchNeuron for Trainium, and more (October 26, 2026) PHP < 8.2.35 · < 8.3.36 · < 8.4.27 +1 21 outlets
  2. CVE-2026-109619 9.2 AWS Weekly Roundup: Amazon Polly Generative engine, TorchNeuron for Trainium, and more (October 26, 2026) PHP < 8.2.35 · < 8.3.36 · < 8.4.27 +1 20 outlets
  3. CVE-2026-35273 9.8 Exploited Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle PeopleSoft Enterprise Peop… 8.61 · 8.62 7 outlets
  4. CVE-2026-88771 9.5 Exploited Citrix NetScaler Improper Input Validation Vulnerability Citrix NetScaler ADC < 14.1-73.37 · < 13.1-64.23 7 outlets
  5. CVE-2026-88772 9.5 Exploited Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix NetScaler ADC < 14.1-73.37 · < 13.1-64.23 7 outlets
  6. CVE-2026-21589 9.3 Exploited Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Bitbucket Data Center < 9.4.26 · < 10.2.8 · < 10.5.1 4 outlets
  7. CVE-2026-102764 9.3 Exploited BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust Remote Support ≤ 26.2.3 4 outlets
  8. CVE-2026-20079 10.0 Exploited Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Cisco Secure Firewall Management… 7.0.0 → 7.4.7 (72 versions) 4 outlets
  9. CVE-2026-110447 9.2 Exploited Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora Online - Built-in CODE… < 26.4.303 2 outlets
  10. CVE-2026-87902 8.1 Exploited WordPress Core Remote File Inclusion Vulnerability WordPress < 7.1.2 4 outlets
  11. CVE-2026-96951 8.8 Exploited Microsoft Windows Command Injection Vulnerability Outlook WEB all versions 5 outlets
  12. CVE-2026-19490 9.3 Exploited Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability NetScaler ADC ≤ 73.32 · ≤ 63.21 3 outlets
  13. CVE-2019-0708 9.8 Exploited Microsoft Remote Desktop Services Remote Code Execution Vulnerability Windows 7 all versions 1 outlet
  14. CVE-2021-44228 10.0 Exploited Apache Log4j2 Remote Code Execution Vulnerability Log4j < 2.3.1 · < 2.12.2 · < 2.15.0 +1 1 outlet
  15. CVE-2026-86950 8.8 Exploited Apple Multiple Products Out-of-Bounds Write Vulnerability Apple iOS and iPadOS < 26.7.1 5 outlets
  16. CVE-2026-105134 9.3 Exploited Ahsay AhsayCBS Command Injection Vulnerability AhsayCBS 9.15.2.0 → 10.3.4.44 (115 versions) 2 outlets
  17. CVE-2026-104286 9.8 Exploited Fortinet FortiMail Path Traversal Vulnerability Fortinet FortiMail 8.0.0 · ≤ 7.6.5 · ≤ 7.4.6 +2 3 outlets
  18. CVE-2026-85046 8.8 Exploited Google Chromium V8 Type Confusion Vulnerability Google Chrome < 152.0.7977.82 5 outlets
  19. CVE-2026-5430 10.0 Exploited WSO2 Multiple Products Path Traversal Vulnerability API Control Plane < 4.5.0.58 · < 4.6.0.22 3 outlets
  20. CVE-2025-39682 9.8 Exploited Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability Linux 6.0 2 outlets

In the news this week

  1. CVE-2026-111497 PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw 4 outlets
  2. CVE-2026-109618 9.2 AWS Weekly Roundup: Amazon Polly Generative engine, TorchNeuron for Trainium, and more (October 26, 2026) 21 outlets
  3. CVE-2026-109619 9.2 AWS Weekly Roundup: Amazon Polly Generative engine, TorchNeuron for Trainium, and more (October 26, 2026) 20 outlets
  4. CVE-2026-30612 Popcorn Time’s forgotten updater left millions of devices exposed to hijacking 1 outlet
  5. CVE-2026-110447 9.2 CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud 2 outlets
  6. CVE-2026-99999 Did Ukraine's Drone Strikes Really Take Down Russian Bots? | Threat Wire 4 outlets
  7. CVE-2026-115560 URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches 2 outlets
  8. CVE-2026-112900 Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image 1 outlet
  9. CVE-2026-87902 8.1 AI found a critical PHP flaw. The bigger failure began in 2024. 4 outlets
  10. CVE-2026-91403 Oracle releases Java SE security alerts for high-risk leaks. Users should upgrade as soon as possible. 1 outlet
  11. CVE-2026-111943 CVE-2026-111943: Compromised Intermediate Certificate Authority 1 outlet
  12. CVE-2026-107891 CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes 1 outlet
  13. CVE-2026-105481 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  14. CVE-2026-105482 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  15. CVE-2026-105483 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  16. CVE-2026-106069 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  17. CVE-2026-106070 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  18. CVE-2026-106071 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  19. CVE-2026-106072 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  20. CVE-2026-106073 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  21. CVE-2026-106074 Please update immediately: Node.js release high-risk security updates at the highest level 1 outlet
  22. CVE-2026-113380 Signal bug could let someone keep listening after you hang up 1 outlet
  23. CVE-2026-96652 5.3 CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws 1 outlet
  24. CVE-2026-106173 Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution 2 outlets
  25. CVE-2026-0257 7.8 Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA 1 outlet
  26. CVE-2026-110936 8.4 ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan 1 outlet