The 3 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 3 are confirmed or reported exploited in the wild.
-
CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE… (CISA)
- Exploited in the wild: listed by CISA on Oct 28; US federal agencies must fix it by Oct 31.
- VulnCheck KEV: reported exploited (listed Aug 3), 5 reports. 86 days before CISA. First report: go.crowdstrike.com.
- Public exploit code: 4 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 10.2% chance of exploitation activity in the next 30 days, higher than 96% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. (CISA)
- Exploited in the wild: listed by CISA on Oct 28; US federal agencies must fix it by Nov 11.
- VulnCheck KEV: reported exploited (listed Oct 27), 2 reports. 1 day before CISA. First report: www.crowdstrike.com.
- Likelihood (EPSS): 0.30% chance of exploitation activity in the next 30 days, higher than 22% of all CVEs.
- CISA assessment (SSVC): exploitation seen; not easily automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-84999 Unrestricted Upload of File with Dangerous Type
The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before … (NVD, CVSS 9.8)
- VulnCheck KEV: reported exploited (listed Oct 27), 1 report. First report: patchstack.com. Not yet in CISA’s catalog.
- Likelihood (EPSS): 0.48% chance of exploitation activity in the next 30 days, higher than 42% of all CVEs.
- CISA assessment (SSVC): no exploitation known; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
