The 4 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 2 are confirmed or reported exploited in the wild.
-
CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. (CISA)
- Exploited in the wild: listed by CISA on Oct 27; US federal agencies must fix it by Nov 10.
- VulnCheck KEV: reported exploited (listed Oct 26), 4 reports. 1 day before CISA. First report: ellio.tech.
- Public exploit code: 18 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 82.6% chance of exploitation activity in the next 30 days, in the top 1% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. (CISA)
- Exploited in the wild: listed by CISA on Oct 27; US federal agencies must fix it by Nov 10.
- VulnCheck KEV: reported exploited (listed Oct 24), 2 reports. 3 days before CISA. First report: sansec.io.
- Public exploit code: 1 known exploit (VulnCheck KEV).
- Likelihood (EPSS): 44.6% chance of exploitation activity in the next 30 days, higher than 99% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-120198
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early … (NVD, CVSS 10.0)
- Likelihood (EPSS): 2.1% chance of exploitation activity in the next 30 days, higher than 81% of all CVEs.
- CISA assessment (SSVC): proof-of-concept public; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-120279
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early… (NVD, CVSS 10.0)
- CISA assessment (SSVC): proof-of-concept public; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
