The 3 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 3 are confirmed or reported exploited in the wild.
-
CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. (CISA)
- Exploited in the wild: listed by CISA on Oct 27; US federal agencies must fix it by Nov 10.
- VulnCheck KEV: reported exploited (listed Oct 26), 3 public reports. First report: ellio.tech.
- Public exploit code: 11 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 55.5% chance of exploitation activity in the next 30 days, in the top 1% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. (CISA)
- Exploited in the wild: listed by CISA on Oct 27; US federal agencies must fix it by Nov 10.
- VulnCheck KEV: reported exploited (listed Oct 24), 2 public reports. First report: sansec.io.
- Public exploit code: 1 known exploit (VulnCheck KEV).
- Likelihood (EPSS): 30.6% chance of exploitation activity in the next 30 days, higher than 98% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. (CISA)
- Exploited in the wild: listed by CISA on Oct 23; US federal agencies must fix it by Oct 26.
- VulnCheck KEV: reported exploited (listed Oct 22), 2 public reports. First report: www.arista.com.
- Likelihood (EPSS): 1.0% chance of exploitation activity in the next 30 days, higher than 63% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
