The 5 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 4 are confirmed or reported exploited in the wild.
-
CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE… (CISA)
- Exploited in the wild: listed by CISA on Oct 28; US federal agencies must fix it by Oct 31.
- VulnCheck KEV: reported exploited (listed Aug 3), 5 reports. 86 days before CISA. First report: go.crowdstrike.com.
- Public exploit code: 4 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 16.1% chance of exploitation activity in the next 30 days, higher than 97% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-119977 WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. (CISA)
- Exploited in the wild: listed by CISA on Nov 3; US federal agencies must fix it by Nov 6.
- VulnCheck KEV: reported exploited (listed Oct 30), 2 reports. 4 days before CISA. First report: www.wordfence.com.
- Likelihood (EPSS): 0.60% chance of exploitation activity in the next 30 days, higher than 49% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. (CISA)
- Exploited in the wild: listed by CISA on Oct 28; US federal agencies must fix it by Nov 11.
- VulnCheck KEV: reported exploited (listed Oct 27), 2 reports. 1 day before CISA. First report: www.crowdstrike.com.
- Likelihood (EPSS): 0.69% chance of exploitation activity in the next 30 days, higher than 53% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-86596 CLavaque s2Member Improper Control of Generation of Code
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' … (NVD, CVSS 9.8)
- VulnCheck KEV: reported exploited (listed Nov 2), 1 report. First report: patchstack.com. Not yet in CISA’s catalog.
- Public exploit code: 1 known exploit (VulnCheck KEV).
- Likelihood (EPSS): 1.5% chance of exploitation activity in the next 30 days, higher than 74% of all CVEs.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-120344
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. T… (NVD, CVSS 10.0)
- Likelihood (EPSS): 2.0% chance of exploitation activity in the next 30 days, higher than 81% of all CVEs.
- CISA assessment (SSVC): proof-of-concept public; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
