Trending vulnerabilities

What: Denial of service flaw in Cisco ASA and FTD Remote Access SSL VPN service (CVSS 8.6). Unauthenticated remote attacker can force device reload when secondary authentication is configured on tunnel group.

Why it matters: KEV-listed 2026-10-29. Actively exploited in the wild. Cisco patched same day as NVD publish. No authentication required. High impact on firewall availability across affected deployments.

Where it's seen: Widespread security news coverage (Bleeping Computer, The Circuitry), CISA advisory confirmation, analyst discussion ranking it top-5 most-discussed CVEs in 24h. Defender triage ongoing.

What: Integer overflow in TeamViewer remote-control screen processing (Full Client, Portable, Remote Control App < v15.83) enabling DoS or arbitrary code execution; CVSS 8.8.

Why it matters: Researcher (Remedio) demonstrated working code execution on Windows with host-side exploitation; no user interaction beyond accepting session needed. Not KEV-listed yet, but vendor patched urgently (v15.83 released). No confirmed in-the-wild exploitation reported, but attack surface is broad—any technician connecting to untrusted host is at risk.

Where it's seen: Multi-language technical blogs and news sites (Hacker News, CyberSec Guru) amplifying researcher PoC; vendor advisory linking patch; security feeds aggregating. Chatter emphasizes role reversal: attacker as the "help-seeker."

What: Buffer overflow in Google Brotli decoder (versions 1.0.3–1.2.0) affecting all platforms; remote attacker can corrupt memory, disclose secrets, DoS, or achieve RCE via crafted compressed streams. CVSS 9.2 Critical.

Why it matters: Four days post-disclosure, active chatter from practitioners discussing real-world exposure in git-remote-https, NGINX, Node.js, Bun, Python, and Envoy. Vendors patching urgently; RCE demonstrated on Node.js build. Multiple free scanning tools deployed to assess exposure. High EPSS (0.98) signals imminent weaponization despite no KEV listing yet.

Where it's seen: Bluesky dominance (49 people discussing top trend); vendor advisories and patches available; vulnerability scanner rollouts (NodeGuard, 37audits) within days; engineers confirming attack vectors in curl/git toolchain; researcher PoC on Node.js.

What: Unauthenticated remote authentication bypass in Cisco Catalyst SD-WAN Manager API via improper URI encoding; CVSS 9.8 CRITICAL; admin access achievable without credentials.

Why it matters: KEV-listed as of 2026-09-30 with confirmed in-the-wild exploitation. CISA mandated federal patching by Oct 3. Cisco issued emergency fixes across release trains. SD-WAN managers are critical infrastructure chokepoints; admin compromise enables lateral movement and ransomware deployment.

Where it's seen: CISA KEV notice, Cisco advisories, urgent defender chatter across social platforms, threat advisories citing active zero-day attacks, IoCs circulating, PoC discussions referencing URI encoding bypass technique.

What: Improper certificate validation in Canonical LXD HTTPS listener (versions 4.0.14, 5.0.10, 5.21.8, 6.9 and earlier) allows unauthenticated attackers to forge client certificates and gain full cluster/VM access.

Why it matters: Published 2026-10-30; affects widely-deployed container/VM orchestration tool. Social chatter claims CVSS 10.0 (NVD lists n/a). Not yet KEV-listed. Canonical has issued patched versions (4.0.15, 5.0.11, 5.21.9, 6.10.1). No public PoC or in-the-wild reports confirmed in posts; chatter is primarily vendor advisory amplification and CVE database replication.

Where it's seen: Social media repeating NVD description and patch guidance same-day; no defender triage reports, no technical deep-dives, no exploitation signals—typical early-stage coordinated disclosure pattern.

What: PHP out-of-memory handling via longjmp() leaves request memory uninitialized, enabling remote code execution through OOM-triggered pathways (multipart/form-data processing identified as vector); affects PHP 5.0–8.5 with incomplete patching across versions.

Why it matters: Exploit requests observed 5.5 hours before official patch; Mirai-style scanning/loader activity confirmed; production systems (Instructure/Parchment, PAN-OS management interfaces) already flagged; backports circulating for unpatched EOL branches. No KEV listing yet but in-the-wild exploitation signal is strong.

Where it's seen: Technical deep-dives on OOM vectors, PoC releases, multi-vendor triage (Cisco, Palo Alto, Instructure), security blogs, backport repositories, active scanner payloads.

What: Privilege escalation to root in Ivanti Connect Secure 22.8R2.4 via DSCache configuration mishandling; CVSS 7.0, KEV-listed, actively exploited October 2026.

Why it matters: CISA added this to Known Exploited Vulnerabilities on 2026-10-30; vendor patch released 2026-10-29. Chatter confirms in-the-wild exploitation as part of a zero-day chain (linked with CVE-2026-104935 authentication bypass). Deadline for patching is 2026-11-02. Multiple defenders and threat intel sources urging immediate remediation.

Where it's seen: CISA advisory, Ivanti patch announcement, Bluesky posts across Japanese and English security communities, threat intel platforms flagging IOCs, defender guidance on patching priority.

What: Ivanti Connect Secure predictable number/identifier generation vulnerability affecting authentication or cryptographic operations; KEV-listed same-day with active exploitation confirmed.

Why it matters: CISA added this to the Known Exploited Vulnerabilities catalog on 2026-10-30, indicating confirmed in-the-wild exploitation. Multiple threat intelligence sources report active abuse; patch deadline set for 2026-11-13. Ivanti Connect Secure is a critical VPN/gateway product, making compromise high-impact for enterprises.

Where it's seen: Social chatter dominated by CISA KEV listing alerts, threat intel summaries, and patching guidance across multiple languages. Posts cite active exploitation and urge immediate remediation. No public PoC details shared, but KEV status confirms weaponization.

What: Template escaping flaw in Apigee hybrid affecting 'yield' keyword handling; affects trusted template authors and downstream API gateway deployments.

Why it matters: Vendor (Google/Apigee) released v1.15.9 on October 21, 2026 with urgent patching across multiple components (watcher, runtime, redis, fluent-bit, istiod, cassandra-client). Social chatter is entirely vendor advisory noise—no PoC, no KEV listing, no defender triage reports or exploitation claims. EPSS 0.09 reflects low base exploitability, but patch urgency signals internal concern.

Where it's seen: Repetitive vendor security bulletins bundled with other CVEs across Apigee subcomponents; no independent researcher PoC or in-the-wild exploitation coverage.

What: JavaScript template-literal expression parser context-tracking flaw in Apigee hybrid v1.15.8 and earlier; improper regex literal escape handling; no published CVSS/EPSS severity data.

Why it matters: Google released Apigee hybrid v1.15.9 on 2026-10-21 addressing this CVE alongside eight others. Not KEV-listed; no public PoC or in-the-wild exploitation reported. Vendor patching is routine and timely, but the low EPSS (0.002) and absence of exploitation chatter suggest limited real-world risk surface.

Where it's seen: Repetitive Bluesky posts listing CVE-2026-94448 bundled across multiple Apigee components (watcher, runtime, redis, prometheus, cassandra, fluent-bit, istiod) in vendor security advisories. No independent researcher PoC or defender triage questions visible.

What: Go toolchain checksum bypass in GOMODPROXY scenario—attacker can supply malicious golang.org/toolchain go.sum entry and intercept canonical checksum validation (CVSS 7.8 HIGH).

Why it matters: NVD describes a real supply-chain attack vector patched in Go, but social chatter conflates CVE-2026-94447 with unrelated Apigee hybrid security fixes released October 21. The CVE appears bundled in vendor patch lists but lacks dedicated PoC, KEV listing, or active exploitation signal. Noise drowns substantive Go community discussion.

Where it's seen: Apigee component release notes recycling CVE identifiers in bulk patches; no focused Go security advisory, researcher PoC, or defender triage visible in top posts.

What: HTTP/1 CONNECT request handling flaw in HTTP servers that fail to hijack connections, allowing improper continuation of HTTP reads and potential request smuggling attacks.

Why it matters: Google patched this across multiple Apigee hybrid components (v1.15.9, October 21, 2026). No public PoC, no KEV listing, EPSS 0.23% (negligible). Chatter is purely vendor release notes bundling CVE-2026-94439 with dozens of others; no active exploitation signal or defender triage visible.

Where it's seen: Vendor security advisories for Apigee sub-components (redis, Cassandra client, Prometheus adapter, Istiod). Repetitive social media posts listing patched CVEs with no context or urgency language.

What: Go module proxy validation bypass allowing malicious golang.org/fips140 module substitution via spoofed GOMODPROXY; affects Go toolchain users (CVSS 7.8 HIGH).

Why it matters: Google patched this in Go v1.15.9 (Oct 21, 2026) by hardening ziphash verification for bundled modules. Not KEV-listed yet; no public PoC or in-the-wild exploitation reported. Social chatter is vendor security advisory noise—Google and Apigee released coordinated patch notices bundling this with many other CVEs.

Where it's seen: Apigee hybrid component security advisories (Oct 2026) listing CVE-2026-94444 among batches of fixes; no independent researcher discussion, no threat intelligence signals, no defender triage questions.

What: Multipart form parsing memory-limit bypass in Google Apigee hybrid v1.15.8 and earlier; allows reading arbitrarily long lines into memory when remaining limit <400 bytes. CVSS and EPSS unavailable.

Why it matters: Google released Apigee hybrid v1.15.9 on October 21, 2026 addressing this vulnerability across multiple components (runtime, udca, prometheus-adapter, fluent-bit, cassandra-client). Vendor patching confirms real issue, but no KEV listing, public PoC, or in-the-wild exploitation reports in social chatter.

Where it's seen: Bulk vendor advisory posts on Bluesky listing CVE-2026-94440 alongside patch releases; no independent researcher commentary, exploit discussion, or defender triage activity observed.

What: HTTP/2 server crash via concurrent HPACK encoder modification when clients repeatedly send requests with SETTINGS_HEADER_TABLE_SIZE changes (Go net/http and derivatives; CVSS unavailable, EPSS 0.0042).

Why it matters: Denial-of-service vector affecting HTTP/2 implementations. Google patched Apigee hybrid v1.15.9 on October 21, 2026. No KEV listing, no public PoC observed. Vendor actively patching across multiple Apigee components suggests real but low-severity impact.

Where it's seen: Apigee security advisories bundling CVE-2026-97032 alongside other fixes in hybrid, runtime, watcher, redis, prometheus, rbac-proxy, fluent-bit, and istiod releases. No standalone researcher PoC or high-profile chatter; appears as part of routine vendor patch coordination.

What: TLS Encrypted Client Hello (ECH) memory exhaustion in RFC 9849 implementations; multiple outer extension references trigger DoS via memory amplification.

Why it matters: Low EPSS (0.32%) and no KEV listing suggest limited real-world traction. Chatter is exclusively vendor patch announcements (Google Apigee v1.15.9, Oct 21) bundling CVE-2026-97031 with 30+ other CVEs in routine security updates. No PoC, exploitation reports, or defender triage visible.

Where it's seen: Bulk vendor advisory cross-posting on Bluesky listing CVE-2026-97031 alongside unrelated vulnerabilities across Apigee components (runtime, Redis, watcher, kube-rbac-proxy, fluent-bit). Pattern indicates automated security digest, not focused incident response.

What: HTTP/2 implementation flaw allowing excessive CPU consumption via malicious SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values; affects HTTP/2 clients and servers. CVSS unknown, EPSS 0.57%.

Why it matters: Google Apigee patching across multiple components (watcher, udca, redis, prometheus-adapter, cassandra-client, istiod) indicates vendor response. No KEV listing, no public PoC reported, no active exploitation signal. Low severity EPSS score suggests limited real-world threat.

Where it's seen: Bulk security advisory announcements on Bluesky listing CVE-2026-78669 alongside ~20 other CVEs across Apigee product line; appears to be routine patching communication rather than targeted security incident response.

What: Denial-of-service vulnerability in Go's FileServer, ServeContent, and ServeFile functions when parsing Range headers with many small ranges, causing excessive CPU consumption. CVSS and EPSS both minimal (0.00379 pct).

Why it matters: Not KEV-listed; extremely low EPSS score (0.30734th percentile) suggests minimal real-world exploitation risk. Chatter is entirely vendor patching notices across Google Apigee components—no PoC, no active exploitation reports, no defender triage signals.

Where it's seen: Bulk security advisory posts on Bluesky listing CVE-2026-78667 alongside dozens of other CVEs in Apigee modules (watcher, udca, redis, prometheus, cassandra, istiod). Pure vendor release noise; no independent analysis or threat hunting.

What: Go's built-in HTTP/2 server allows a malicious client to bypass connection-level flow control limits by exploiting double refunds when streams are reset, enabling excess data transmission beyond MaxReceiveBufferPerConnection.

Why it matters: CVSS unavailable and EPSS extremely low (0.46%). Not KEV-listed. No public PoC or in-the-wild exploitation reported. Social chatter is primarily Google Apigee security advisory boilerplate bundling CVE-2026-78663 with dozens of other fixes across multiple components—no focused defender triage or urgent patching signals.

Where it's seen: Repetitive Apigee product release notes listing bulk CVE IDs without technical detail or exploitation context. One brief stdlib reference but no follow-up discussion, PoC links, or active remediation threads.

What: HTTP/2 to HTTP/1 response smuggling in reverse proxy implementations via malformed framing headers (CVSS n/a, EPSS 0.21%).

Why it matters: Not KEV-listed; EPSS extremely low (0.21st percentile). Chatter is vendor security advisories for Google Apigee components patching the flaw, but no public PoC, no confirmed in-the-wild exploitation, and no urgent defender activity beyond routine patching cycles.

Where it's seen: Six Bluesky posts listing CVE-2026-78660 alongside dozens of other CVEs in boilerplate Apigee security fix announcements across multiple modules (watcher, udca, redis, prometheus-adapter, operators, cassandra-client, istiod). No technical discussion, PoC, or exploitation signals.

What: HTTP/2 server memory exhaustion via malicious "Trailer" headers declaring large field counts, bypassing MaxHeaderValueCount and MaxHeaderBytes limits. Affects Go's net/http and downstream HTTP/2 implementations.

Why it matters: CVE-2026-78659 is bundled across multiple Google Apigee component security advisories (watcher, udca, redis, prometheus-adapter, operators, cassandra-client, asm-istiod). Vendor patching urgently across platform stack signals real remediation activity. EPSS is minimal (0.46th percentile), KEV not listed, no public PoC or in-the-wild exploitation reported yet.

Where it's seen: Repeated boilerplate security advisory posts on Bluesky listing this CVE alongside dozens of others in Apigee module patches. No dedicated researcher analysis, PoC, or defender triage chatter visible; CVE appears as line item in bulk vendor releases.

What: Windows path traversal via junction symlink in Go's Root.Mkdir/MkdirAll functions, allowing directory creation outside intended root scope (CVSS/EPSS not yet assigned).

Why it matters: Go standard library flaw affecting Windows deployments. Social chatter shows rapid vendor patching (Google Apigee suite across watcher, udca, redis, prometheus-adapter, operators, cassandra-client, istiod). However, no KEV listing, no public PoC reported, no active exploitation signal. Chatter is purely vendor advisory boilerplate—bulk CVE lists in security release notes lack tactical detail or defender triage urgency.

Where it's seen: Bluesky vendor release announcements bundling CVE-2026-56857 with 10+ other CVEs per product. No independent security research, journalist coverage, or proof-of-concept discussion detected.