PatchNow
Content last updated: Less than a minute ago
10
Critical Vulnerabilities
1
Days Since Newest Entry

☕ Support This Service

+

These automated vulnerability intelligence briefings are provided free of charge to help security teams stay ahead of critical threats. The service monitors CISA KEV additions, performs AI-powered risk analysis, and generates actionable alerts 24/7.

Monthly Running Costs: ~£14 Claude AI (Risk Analysis): £7 • Kagi Search (Threat Intel): £7
🎁 Buy me a coffee

🧠 Vulnerability Classification Logic

+

🔴 HIGH RISK vulnerabilities are those that meet all of the following criteria:

  • MITRE ATT&CK T1190 Classification: The vulnerability enables "Exploit Public-Facing Application" attacks, meaning it can be directly exploited over the internet without user interaction
  • Network Attack Vector: CVSS analysis confirms the vulnerability has a NETWORK attack vector (not LOCAL, ADJACENT, or PHYSICAL)
  • Internet-Facing Deployment Analysis: Claude AI assesses that the vulnerable software is commonly deployed as an internet-facing service with HIGH or VERY_HIGH likelihood
  • Added to CISA KEV quickly: The CVE was issued less than 30 days prior to it being added to the KEV list. Otherwise you would have already patched it, right?
  • Added to KEV recently: The CVE was added to the KEV list in the last 14 days. Because you've patched it by the time it has been in active exploitation for 14 days, haven't you?

Each vulnerability undergoes deployment pattern analysis where Claude AI evaluates the typical deployment scenarios, and internet-facing likelihood.

CVE-2026-102895 - GPUStack <

Internet Exposure Likelihood: MEDIUM CVSS: 9.8
GPUStack versions prior to 2.2.0 contain a critical authentication bypass vulnerability where the application incorrectly grants built-in administrator privileges to any request that appears to originate from the loopback address (127.0.0.1), which can be spoofed remotely via a client-controlled X-GPUStack-Real-IP header or same-host reverse proxy. This allows unauthenticated remote attackers to gain full administrative access including arbitrary code execution via the inference backend YAML endpoint, with exploitation confirmed in the wild against production deployments.
CVE ADDED: 2026-11-04 5 DAYS BETWEEN CVE AND KEV 1 DAY SINCE KEV
View Details →

CVE-2026-116779 - FreeSWITCH <

Internet Exposure Likelihood: HIGH CVSS: 9.8
FreeSWITCH versions prior to 1.11.3 contain a critical command injection vulnerability (CWE-77/CWE-78) in the SIP MESSAGE handler. An unauthenticated remote attacker can send a crafted inbound SIP MESSAGE with a specially formatted 'To' header to trigger FreeSWITCH API command execution, including OS-level commands, with daemon privileges. Exploitation has been confirmed in the wild, PoC code is publicly available, and the attack requires no authentication or user interaction.
CVE ADDED: 2026-11-05 4 DAYS BETWEEN CVE AND KEV 1 DAY SINCE KEV
View Details →

CVE-2026-123158 - OpenSSH < 10.6p2 on Alpine Linux, OpenSSH < 10.6p2 on any Linux using musl libc without PAM, Docker/containerised sshd images based on Alpine Linux (+1 more)

Internet Exposure Likelihood: HIGH CVSS: 8.1
CVE-2026-123158 ('SSHole') is a critical authentication bypass vulnerability in OpenSSH sshd prior to 10.6p2 on Linux systems using musl libc without PAM. An unauthenticated remote attacker can bypass password authentication by supplying any password between 256 and 1024 characters, due to misinterpretation of a string as a valid password hash. Active exploitation has been confirmed in the wild, with attackers gaining root access on exposed systems within hours of public disclosure.
CVE ADDED: 2026-11-05 4 DAYS BETWEEN CVE AND KEV 1 DAY SINCE KEV
View Details →

CVE-2026-123218 - IBM Aspera Faspex 5.0.0 –

Internet Exposure Likelihood: HIGH CVSS: 9.8
CVE-2026-123218 is a critical authorization bypass vulnerability (CWE-863) in IBM Aspera Faspex 5.0.0 through 5.0.19 that allows an authenticated user to craft a specially designed message to circumvent authorization controls and gain full administrative privileges. With a CVSS score of 9.8 and a network attack vector requiring no user interaction, this is directly exploitable over the internet against any internet-facing Aspera Faspex deployment. IBM Aspera Faspex is a file transfer portal product that is commonly deployed as an internet-accessible web application, making this a high-risk internet-exploitable vulnerability under T1190.
CVE ADDED: 2026-11-07 2 DAYS BETWEEN CVE AND KEV 1 DAY SINCE KEV
View Details →

CVE-2026-19868 - SonicWall SonicOS

Internet Exposure Likelihood: VERY_HIGH CVSS: N/A
CVE-2026-19868 is an authentication enforcement vulnerability (CWE-308: Use of Single-Factor Authentication) in the SonicWall SonicOS SSLVPN service affecting Gen7 and Gen8 appliances running versions 7.3.3-7015 and older, or 8.2.2-8015 and older. An attacker with valid credentials for an alternate authentication method (e.g., local or LDAP) can bypass SAML authentication controls and circumvent SAML-enforced MFA, gaining unauthorized VPN access. The SSLVPN portal is a canonical internet-facing service by design, making this a direct T1190-applicable vulnerability with high internet exposure likelihood.
CVE ADDED: 2026-11-06 0 DAY BETWEEN CVE AND KEV 4 DAYS SINCE KEV
View Details →

CVE-2026-119977 - WordPress

Internet Exposure Likelihood: VERY_HIGH CVSS: 8.1
CVE-2026-119977 is an unauthenticated Remote Code Execution vulnerability in WordPress Core (versions 4.7 through 7.1.3) arising from a TOCTOU race condition during core upgrade procedures. WordPress uses predictable, web-accessible staging/temporary directories during full-package upgrades, allowing an unauthenticated attacker to plant malicious files in those directories and trigger their execution during the update window. Successful exploitation grants the attacker RCE with the privileges of the web server process, directly compromising the server.
CVE ADDED: 2026-10-31 3 DAYS BETWEEN CVE AND KEV 7 DAYS SINCE KEV
View Details →

CVE-2026-118527 - Ivanti Connect Secure

Internet Exposure Likelihood: VERY_HIGH CVSS: 4.3
CVE-2026-118527 is a predictable filename vulnerability (CWE-340) in Ivanti Connect Secure VPN appliances that allows a remote authenticated attacker to upload files with attacker-controlled content to known disk locations. Although the formal CVSS base score is 4.3 (Medium), this vulnerability is confirmed in CISA's KEV catalog and is actively being chained with other Ivanti Connect Secure flaws to achieve elevated or unauthenticated root access in real-world attacks. Ivanti Connect Secure is an internet-facing VPN gateway by design, making virtually all deployments directly reachable from the internet and elevating the practical risk far beyond the base score.
CVE ADDED: 2026-11-03 0 DAY BETWEEN CVE AND KEV 11 DAYS SINCE KEV
View Details →

CVE-2026-76418 - Cisco ASA - multiple versions from 9.16.x through 9.24.x, Cisco FTD - multiple versions from 7.0.x through 10.1.x

Internet Exposure Likelihood: VERY_HIGH CVSS: 8.6
CVE-2026-76418 is an unauthenticated, network-exploitable denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco ASA and FTD software. A logic error triggered when secondary authentication is configured on a tunnel group allows a remote attacker to crash the device by sending a single crafted SSL VPN connection request. The vulnerability is confirmed as actively exploited in the wild, requiring no authentication or user interaction.
CVE ADDED: 2026-10-28 1 DAY BETWEEN CVE AND KEV 12 DAYS SINCE KEV
View Details →

CVE-2026-97229 - GitLab CE 19.2.x <, GitLab EE 19.2.x <, GitLab CE 19.3.x < (+3 more)

Internet Exposure Likelihood: VERY_HIGH CVSS: 10.0
CVE-2026-97229 is a critical (CVSS 10.0) integer overflow vulnerability in GitLab CE/EE's CI/CD regular expression compiler, affecting versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. An unauthenticated remote attacker can achieve arbitrary code execution on the GitLab server by submitting a specially crafted regular expression in a CI/CD configuration, with no authentication or user interaction required. Active exploitation has been observed in the wild including a confirmed attack against the Alpine Linux GitLab instance, making this an urgent patching priority.
CVE ADDED: 2026-10-13 16 DAYS BETWEEN CVE AND KEV 12 DAYS SINCE KEV
View Details →

CVE-2026-111497 - Node.js, Bun runtime, .NET / ASP.NET Core (+5 more)

Internet Exposure Likelihood: VERY_HIGH CVSS: 9.2
CVE-2026-111497 ('Node2Shell'/'HTTP2Shell') is a critical heap out-of-bounds write in the Google Brotli decoder (CWE-787) affecting versions 1.0.3 through 1.2.0, including bundled versions in Node.js, Bun, and .NET runtimes. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to any internet-facing service that decompresses Brotli content — such as Express.js APIs, web servers, or API gateways — triggering memory corruption that can lead to RCE, memory disclosure, or DoS. Because Brotli is deeply embedded in widely deployed internet-facing runtimes and HTTP stacks, the blast radius of this vulnerability is extremely large.
CVE ADDED: 2026-10-22 5 DAYS BETWEEN CVE AND KEV 14 DAYS SINCE KEV
View Details →

Generated by PatchNow Intelligence System | Data Source: CISA KEV + CIRCL.LU + Claude Analysis

📄 Download JSON Data | 📡 RSS Feed