The 10 vulnerabilities from the past seven days that most need attention, ranked by a fixed rule: flaws CISA confirmed as actively exploited come first (those used in ransomware at the top, then newest first), followed by the highest-scoring Critical CVEs published by NIST’s National Vulnerability Database.
| # | CVE | What it affects | Why it ranks | Date |
|---|---|---|---|---|
| 1 | CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Actively exploited (CISA KEV) | October 30, 2026 |
| 2 | CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | Actively exploited (CISA KEV) | October 30, 2026 |
| 3 | CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | Actively exploited (CISA KEV) | October 29, 2026 |
| 4 | CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | Actively exploited (CISA KEV) | October 29, 2026 |
| 5 | CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging Vulnerability | Actively exploited (CISA KEV) | October 28, 2026 |
| 6 | CVE-2026-46300 | Linux Kernel Missing Initialization of a Variable Vulnerability | Actively exploited (CISA KEV) | October 28, 2026 |
| 7 | CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Actively exploited (CISA KEV) | October 27, 2026 |
| 8 | CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability | Actively exploited (CISA KEV) | October 27, 2026 |
| 9 | CVE-2026-109618 | PHP Group PHP: PHP Memory Corruption Vulnerability | Actively exploited (CISA KEV) | October 26, 2026 |
| 10 | CVE-2026-109619 | PHP Group PHP: PHP Stale Internal Request-State Vulnerability | Actively exploited (CISA KEV) | October 26, 2026 |
Descriptions are quoted from CISA and NVD. Always confirm fixed versions in the vendor’s own advisory before prioritizing.
