The 10 vulnerabilities from the past seven days that most need attention, ranked by a fixed rule: flaws CISA confirmed as actively exploited come first (those used in ransomware at the top, then newest first), followed by the highest-scoring Critical CVEs published by NIST’s National Vulnerability Database.
| # | CVE | What it affects | Why it ranks | Date |
|---|---|---|---|---|
| 1 | CVE-2026-19868 | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | Actively exploited (CISA KEV) | November 6, 2026 |
| 2 | CVE-2024-27834 | Apple Multiple Products Improper Authentication Vulnerability | Actively exploited (CISA KEV) | November 4, 2026 |
| 3 | CVE-2026-119977 | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | Actively exploited (CISA KEV) | November 3, 2026 |
| 4 | CVE-2026-124580 | A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpo… | CVSS 10 Critical (NVD) | November 9, 2026 |
| 5 | CVE-2026-123551 | OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only ch… | CVSS 10 Critical (NVD) | November 7, 2026 |
| 6 | CVE-2026-123966 | A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-ba… | CVSS 10 Critical (NVD) | November 7, 2026 |
| 7 | CVE-2026-109469 | Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network. | CVSS 10 Critical (NVD) | November 6, 2026 |
| 8 | CVE-2026-122051 | A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remot… | CVSS 10 Critical (NVD) | November 4, 2026 |
| 9 | CVE-2026-122013 | A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the arg… | CVSS 10 Critical (NVD) | November 4, 2026 |
| 10 | CVE-2026-121933 | A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead… | CVSS 10 Critical (NVD) | November 4, 2026 |
Descriptions are quoted from CISA and NVD. Always confirm fixed versions in the vendor’s own advisory before prioritizing.
