The 3 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 2 are confirmed or reported exploited in the wild.
-
CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. (CISA)
- Exploited in the wild: listed by CISA on Oct 29; US federal agencies must fix it by Nov 1.
- VulnCheck KEV: reported exploited (listed Oct 28), 2 reports. 1 day before CISA. First report: alpinelinux.org.
- Public exploit code: 4 known exploits (VulnCheck KEV).
- Likelihood (EPSS): 18.4% chance of exploitation activity in the next 30 days, higher than 97% of all CVEs.
- CISA assessment (SSVC): exploitation seen; attacks can be automated; total control of the affected system.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. (CISA)
- Exploited in the wild: listed by CISA on Oct 29; US federal agencies must fix it by Nov 1.
- VulnCheck KEV: reported exploited (listed Oct 28), 2 reports. 1 day before CISA. First report: sec.cloudapps.cisco.com.
- Likelihood (EPSS): 0.57% chance of exploitation activity in the next 30 days, higher than 47% of all CVEs.
- CISA assessment (SSVC): exploitation seen; attacks can be automated; partial impact.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-118579
A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be use… (NVD, CVSS 9.8)
- Likelihood (EPSS): 0.79% chance of exploitation activity in the next 30 days, higher than 56% of all CVEs.
- CISA assessment (SSVC): proof-of-concept public; attacks can be automated; total control of the affected system.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.
