The 4 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 4 are confirmed or reported exploited in the wild.
-
CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. (CISA)
- Exploited in the wild: listed by CISA on Nov 9; US federal agencies must fix it by Nov 12.
- VulnCheck KEV: reported exploited (listed Nov 6), 5 reports. 3 days before CISA. First report: previdian.com.
- Public exploit code: 12 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 1.0% chance of exploitation activity in the next 30 days, higher than 63% of all CVEs.
- CISA assessment (SSVC): proof-of-concept public; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-102895 GPUStack Improper Authentication Vulnerability
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. (CISA)
- Exploited in the wild: listed by CISA on Nov 9; US federal agencies must fix it by Nov 12.
- VulnCheck KEV: reported exploited (listed Jul 31), 2 reports. 101 days before CISA. First report: github.com.
- Likelihood (EPSS): 0.33% chance of exploitation activity in the next 30 days, higher than 26% of all CVEs.
- CISA assessment (SSVC): no exploitation known; attacks can be automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability
SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution. (CISA)
- Exploited in the wild: listed by CISA on Nov 9; US federal agencies must fix it by Nov 12.
- VulnCheck KEV: reported exploited (listed Nov 9), 1 report. First report: www.cisa.gov.
- Public exploit code: 1 known exploit (VulnCheck KEV).
- Likelihood (EPSS): 1.3% chance of exploitation activity in the next 30 days, higher than 71% of all CVEs.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability
IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. (CISA)
- Exploited in the wild: listed by CISA on Nov 9; US federal agencies must fix it by Nov 12.
- VulnCheck KEV: reported exploited (listed Nov 9), 1 report. First report: www.cisa.gov.
- Likelihood (EPSS): 0.40% chance of exploitation activity in the next 30 days, higher than 34% of all CVEs.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
