The 7 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 7 are confirmed or reported exploited in the wild.
-
CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability… (CISA)
- Exploited in the wild: listed by CISA on Nov 10; US federal agencies must fix it by Nov 13.
- VulnCheck KEV: reported exploited (listed Nov 9), 3 reports. 1 day before CISA. First report: previdian.com.
- Public exploit code: 1 known exploit (VulnCheck KEV).
- Likelihood (EPSS): 1.6% chance of exploitation activity in the next 30 days, higher than 76% of all CVEs.
- CISA assessment (SSVC): no exploitation known; attacks can be automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute… (CISA)
- Exploited in the wild: listed by CISA on Nov 10; US federal agencies must fix it by Nov 13.
- VulnCheck KEV: reported exploited (listed Nov 9), 2 reports. 1 day before CISA. First report: trust.barracuda.com.
- Public exploit code: 1 known exploit (VulnCheck KEV).
- Likelihood (EPSS): 1.1% chance of exploitation activity in the next 30 days, higher than 65% of all CVEs.
- CISA assessment (SSVC): no exploitation known; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. (CISA)
- Exploited in the wild: listed by CISA on Nov 10; US federal agencies must fix it by Nov 24.
- VulnCheck KEV: reported exploited (listed Nov 8), 2 reports. 2 days before CISA. First report: malbearlabs.com.
- Likelihood (EPSS): 0.39% chance of exploitation activity in the next 30 days, higher than 33% of all CVEs.
- CISA assessment (SSVC): no exploitation known; attacks can be automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. (CISA)
- Exploited in the wild: listed by CISA on Nov 10; US federal agencies must fix it by Nov 24.
- VulnCheck KEV: reported exploited (listed Nov 9), 2 reports. 1 day before CISA. First report: jvn.jp.
- Likelihood (EPSS): 0.27% chance of exploitation activity in the next 30 days, higher than 20% of all CVEs.
- CISA assessment (SSVC): no exploitation known; not easily automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-125350 Google Chromium Use-After-Free Vulnerability
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. (CISA)
- Exploited in the wild: listed by CISA on Nov 10; US federal agencies must fix it by Nov 24.
- VulnCheck KEV: reported exploited (listed Nov 9), 3 reports. 1 day before CISA. First report: chromereleases.googleblog.com.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. (CISA)
- Exploited in the wild: listed by CISA on Nov 10; US federal agencies must fix it by Nov 24.
- VulnCheck KEV: reported exploited (listed Nov 10), 3 reports. First report: api.msrc.microsoft.com.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-124450
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution. (NVD, CVSS 9.9)
- VulnCheck KEV: reported exploited (listed Nov 10), 2 reports. Not yet in CISA’s catalog.
- Public exploit code: 1 known exploit (VulnCheck KEV).
- Likelihood (EPSS): 0.49% chance of exploitation activity in the next 30 days, higher than 42% of all CVEs.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
