The 5 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 5 are confirmed or reported exploited in the wild.
-
CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. (CISA)
- Exploited in the wild: listed by CISA on Oct 29; US federal agencies must fix it by Nov 1.
- VulnCheck KEV: reported exploited (listed Oct 28), 3 reports. 1 day before CISA. First report: alpinelinux.org.
- Public exploit code: 6 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 65.2% chance of exploitation activity in the next 30 days, in the top 1% of all CVEs.
- CISA assessment (SSVC): exploitation seen; attacks can be automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. (CISA)
- Exploited in the wild: listed by CISA on Oct 29; US federal agencies must fix it by Nov 1.
- VulnCheck KEV: reported exploited (listed Oct 28), 2 reports. 1 day before CISA. First report: sec.cloudapps.cisco.com.
- Likelihood (EPSS): 0.82% chance of exploitation activity in the next 30 days, higher than 57% of all CVEs.
- CISA assessment (SSVC): exploitation seen; attacks can be automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. (CISA)
- Exploited in the wild: listed by CISA on Nov 4; US federal agencies must fix it by Nov 18.
- VulnCheck KEV: reported exploited (listed Nov 4), 2 reports. First report: www.cisa.gov.
- Likelihood (EPSS): 0.60% chance of exploitation activity in the next 30 days, higher than 49% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-102435
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when … (NVD, CVSS 9.8)
- VulnCheck KEV: reported exploited (listed Nov 4), 1 report. First report: patchstack.com. Not yet in CISA’s catalog.
- Likelihood (EPSS): 0.59% chance of exploitation activity in the next 30 days, higher than 48% of all CVEs.
- CISA assessment (SSVC): no exploitation known; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-120534
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This make… (NVD, CVSS 9.8)
- VulnCheck KEV: reported exploited (listed Nov 3), 1 report. First report: patchstack.com. Not yet in CISA’s catalog.
- Likelihood (EPSS): 0.31% chance of exploitation activity in the next 30 days, higher than 24% of all CVEs.
- CISA assessment (SSVC): no exploitation known; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
