The 5 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 2 are confirmed or reported exploited in the wild.
-
CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). (CISA)
- Exploited in the wild: listed by CISA on Nov 6; US federal agencies must fix it by Nov 20.
- VulnCheck KEV: reported exploited (listed Nov 6), 2 reports. First report: psirt.global.sonicwall.com.
- CISA assessment (SSVC): exploitation seen; not easily automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-119757
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in thef… (NVD, CVSS 9.8)
- VulnCheck KEV: reported exploited (listed Nov 5), 2 reports. First report: www.binance.com. Not yet in CISA’s catalog.
- Likelihood (EPSS): 0.54% chance of exploitation activity in the next 30 days, higher than 45% of all CVEs.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-122051
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (NVD, CVSS 10.0)
- Likelihood (EPSS): 2.6% chance of exploitation activity in the next 30 days, higher than 85% of all CVEs.
- CISA assessment (SSVC): proof-of-concept public; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-123198
LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands … (NVD, CVSS 9.8)
- Likelihood (EPSS): 0.85% chance of exploitation activity in the next 30 days, higher than 58% of all CVEs.
- CISA assessment (SSVC): proof-of-concept public; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2025-71457
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication. (NVD, CVSS 9.8)
- Likelihood (EPSS): 0.44% chance of exploitation activity in the next 30 days, higher than 39% of all CVEs.
- CISA assessment (SSVC): proof-of-concept public; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
