Upstream fix confirmed, vendors patching, credible PoC claims, but KEV unlisted and EPSS minimal; patch rollout lag drives triage chatter.
What: Linux kernel TCP IPv4 use-after-free in socket option handling during SYN-received state (CVE-2026-98432, CVSS 9.8 CRITICAL). Affects Ubuntu, RHEL, Debian.
Why it matters: High-severity race condition in connection setup freed upstream 15 Oct 2026. Distros patching at different rates (Debian done, Ubuntu/RHEL lag reported). Chatter mentions remote root PoC on MPTCP listeners; no KEV listing yet. Low EPSS (0.32%) suggests limited wild exploitation so far, but critical score and active patch waves indicate defenders triaging.
Where it's seen: Mixed signal—vendor advisories, distribution patch tracking, mitigation workarounds (disable MPTCP), researcher write-ups claiming remote root, but no confirmed mass exploitation or scanning reports yet.
KEV-listed with confirmed exploitation; urgent patching guidance; no speculation, direct threat intel.
What: Ivanti Connect Secure predictable number/identifier generation vulnerability affecting authentication or cryptographic operations; KEV-listed same-day with active exploitation confirmed.
Why it matters: CISA added this to the Known Exploited Vulnerabilities catalog on 2026-10-30, indicating confirmed in-the-wild exploitation. Multiple threat intelligence sources report active abuse; patch deadline set for 2026-11-13. Ivanti Connect Secure is a critical VPN/gateway product, making compromise high-impact for enterprises.
Where it's seen: Social chatter dominated by CISA KEV listing alerts, threat intel summaries, and patching guidance across multiple languages. Posts cite active exploitation and urge immediate remediation. No public PoC details shared, but KEV status confirms weaponization.
Working PoC, vendors patching, scanners deployed, no KEV yet but imminent exploitation signal.
What: Buffer overflow in Google Brotli decoder (versions 1.0.3–1.2.0) affecting all platforms; remote attacker can corrupt memory, disclose secrets, DoS, or achieve RCE via crafted compressed streams. CVSS 9.2 Critical.
Why it matters: Four days post-disclosure, active chatter from practitioners discussing real-world exposure in git-remote-https, NGINX, Node.js, Bun, Python, and Envoy. Vendors patching urgently; RCE demonstrated on Node.js build. Multiple free scanning tools deployed to assess exposure. High EPSS (0.98) signals imminent weaponization despite no KEV listing yet.
Where it's seen: Bluesky dominance (49 people discussing top trend); vendor advisories and patches available; vulnerability scanner rollouts (NodeGuard, 37audits) within days; engineers confirming attack vectors in curl/git toolchain; researcher PoC on Node.js.
Also trending
- 4 CVE-2026-76418 HIGH · 8.6 KEV score 2 · 2 postshype ACTIVE HACK · 92 hack
What: Denial of service flaw in Cisco ASA and FTD Remote Access SSL VPN service (CVSS 8.6). Unauthenticated remote attacker can force device reload when secondary authentication is configured on tunnel group.
Why it matters: KEV-listed 2026-10-29. Actively exploited in the wild. Cisco patched same day as NVD publish. No authentication required. High impact on firewall availability across affected deployments.
Where it's seen: Widespread security news coverage (Bleeping Computer, The Circuitry), CISA advisory confirmation, analyst discussion ranking it top-5 most-discussed CVEs in 24h. Defender triage ongoing.
- 5 CVE-2026-90960 score 2 · 1 posthype unscored hack
- 6 CVE-2026-11587 score 2 · 1 posthype unscored hack
- 7 CVE-2026-108097 score 2 · 1 posthype LIKELY HACK · 78 hack
What: Critical unauthenticated remote code execution in Drupal core's Field UI module (CVE-2026-108097), exploitable via contributed modules; affects all supported Drupal versions.
Why it matters: Drupal issued emergency patches (10.6.19, 11.3.19, 11.4.10) on 2026-10-14. Public PoC code and exploit details are circulating. Post 7 explicitly confirms "Details and PoC code are public." Vendors (Drupal) patching urgently; defenders actively triaging and updating. Not yet KEV-listed, but vendor advisory is authoritative and exploitation window is live.
Where it's seen: Drupal security advisories, threat intelligence feeds (threatintel.cc), security bulletin aggregators, and multilingual security communities discussing patch urgency and mitigation (uninstalling field_ui). High engagement on practitioner channels; chatter emphasizes "within hours/days" exploit emergence.
- 8 CVE-2026-84295 CRITICAL · 10.0 score 2 · 1 posthype LIKELY HACK · 72 hack
What: Improper authentication in Progress Software WS_FTP Server (versions <2024.0.6, <2025.0.3 on Windows) allows unauthenticated remote access to sensitive data including admin credentials. CVSS 10.0 CRITICAL.
Why it matters: Published yesterday; CVSS 10.0 severity and direct credential exposure make this high-priority for patching. No KEV listing yet, no confirmed PoC in posts, but Progress has issued patches (2024.0.6, 2025.0.3). Chatter emphasizes urgent patching need across multiple vendors.
Where it's seen: Cybersecurity news aggregators and social platforms amplifying NVD publication; posts link to vulnerability databases and patch guidance. Tone is alert-driven, not speculative—vendors already released fixes.
- 9 CVE-2023-22793 score 2 · 1 posthype LIKELY HACK · 72 hack
What: Unauthenticated remote code execution in Veeam Management Pack for Microsoft System Center's Virtualization Extensions service; affects backup and System Center deployments.
Why it matters: Published just yesterday (Oct 29, 2026), this Veeam advisory addresses multiple RCE flaws including CVE-2023-22793 with CVSS 9.3 CRITICAL severity. Social posts cite vendor patches and urgent mitigation. Not yet KEV-listed, but rapid vendor response and high CVSS indicate active patch readiness by defenders.
Where it's seen: Veeam security advisory, aggregated across Bluesky with "#PatchNow" urgency; CVSS score circulating; defenders scanning for affected deployments.
- 10 CVE-2026-118633 HIGH · 8.1 score 2 · 1 posthype unscored hack
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
- 11 CVE-2026-118539 score 2 · 1 posthype MIXED · 62 hack
What: Missing authorization vulnerability in Drupal Commerce Core (versions 0.0–2.41, 3.0–3.3.13) allowing unauthenticated forceful browsing and configuration exposure. CVSS not yet assigned.
Why it matters: Social chatter claims active in-the-wild exploitation and urgent patching, but CVE is not yet KEV-listed. Post #6 conflates this with other KEV entries; post #7 cites SA-CONTRIB-2026-254 as "highly critical" (21/25) with no login required. NVD metadata remains sparse (no CVSS/EPSS), and advisories lack confirmed PoC links. Signal is muddled—claims of active exploitation lack independent corroboration.
Where it's seen: Bluesky posts urging immediate patches to 3.3.13/2.41, trending CVE lists, security aggregators republishing advisory text without new attack data.
- 12 CVE-2026-111357 HIGH · 7.0 KEV score 2 · 1 posthype ACTIVE HACK · 92 hack
What: Privilege escalation to root in Ivanti Connect Secure 22.8R2.4 via DSCache configuration mishandling; CVSS 7.0, KEV-listed, actively exploited October 2026.
Why it matters: CISA added this to Known Exploited Vulnerabilities on 2026-10-30; vendor patch released 2026-10-29. Chatter confirms in-the-wild exploitation as part of a zero-day chain (linked with CVE-2026-104935 authentication bypass). Deadline for patching is 2026-11-02. Multiple defenders and threat intel sources urging immediate remediation.
Where it's seen: CISA advisory, Ivanti patch announcement, Bluesky posts across Japanese and English security communities, threat intel platforms flagging IOCs, defender guidance on patching priority.
- 13 CVE-2026-97631 score 2 · 1 posthype LIKELY HACK · 72 hack
What: Out-of-bounds write in TianoCore EDK2 UEFI firmware PXE driver enabling pre-boot arbitrary code execution on network-booting servers; affects BIOS/firmware layer across most enterprise infrastructure.
Why it matters: Premature public disclosure (6 days post-NVD) combined with vendor patches already shipped (AMI, others) signals active mitigation but wide exposure window. Pre-boot RCE allows bootkit-level persistence before OS loads. EPSS 0.37% is low, but attack surface (network boot in data centers) and impact (firmware compromise) are severe. Not yet KEV-listed, but chatter reflects urgency.
Where it's seen: Ars Technica coverage, multi-vendor firmware advisories, Bluesky security community debating patch status and PXE-boot prevalence. Posts emphasize scope (most servers), persistence risk, and need for firmware updates. Discussions center on disclosure timing, not PoC availability.
- 14 CVE-2026-87067 HIGH · 8.5 score 2 · 1 posthype unscored hack
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
- 15 CVE-2026-76029 HIGH · 8.8 score 2 · 1 posthype unscored hack
Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 16 CVE-2026-119977 HIGH · 8.1 score 2 · 1 posthype unscored hack
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
- 17 CVE-2026-109220 CRITICAL · 9.8 score 2 · 1 posthype unscored hack
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.
- 18 CVE-2026-116557 CRITICAL · 9.1 score 2 · 1 posthype unscored hack
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.
- 19 CVE-2026-119163 HIGH · 7.5 score 2 · 1 posthype unscored hack
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step persisted attack: an unauthenticated attacker submits a crafted bwfan_cart_id value during a guest Store API checkout (requiring only a publicly obtainable WooCommerce cart nonce), and the injection fires when a scheduled Action Scheduler job later reloads the stored meta upon order status transition out of pending, failed, or cancelled.
- 20 CVE-2026-89270 CRITICAL · 9.1 score 2 · 1 posthype unscored hack
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.
- 21 CVE-2026-120040 HIGH · 7.5 score 2 · 1 posthype unscored hack
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only.
- 22 CVE-2026-109618 KEV EPSS 100% score 1 · 1 posthype LIKELY HACK · 82 hack
What: PHP out-of-memory handling via longjmp() leaves request memory uninitialized, enabling remote code execution through OOM-triggered pathways (multipart/form-data processing identified as vector); affects PHP 5.0–8.5 with incomplete patching across versions.
Why it matters: Exploit requests observed 5.5 hours before official patch; Mirai-style scanning/loader activity confirmed; production systems (Instructure/Parchment, PAN-OS management interfaces) already flagged; backports circulating for unpatched EOL branches. No KEV listing yet but in-the-wild exploitation signal is strong.
Where it's seen: Technical deep-dives on OOM vectors, PoC releases, multi-vendor triage (Cisco, Palo Alto, Instructure), security blogs, backport repositories, active scanner payloads.
- 23 CVE-2026-76028 HIGH · 8.8 score 1 · 1 posthype unscored hack
Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 24 CVE-2026-46300 HIGH · 7.8 KEV score 1 · 1 posthype LIKELY HACK · 78 hack
What: Linux kernel privilege escalation in XFRM ESP-in-TCP subsystem (CVE-2026-46300, "Fragnesia") allowing unprivileged attackers to gain root via AES-GCM keystream manipulation.
Why it matters: Multiple major Linux distros have issued advisories; public PoC exists; described as third LPE in ~2 weeks. High-confidence technical signal: arbitrary byte writes into page cache of privileged binaries (e.g., /usr/bin/su). Defenders are actively recommending module blacklisting as immediate mitigation.
Where it's seen: Security media (HackersNews, Borncity), DFIR/defender accounts triaging, distro advisory circulation. Posts cite concrete attack surface (XFRM, IPsec) and exploitation mechanics.