Skip to content
Security

Daily threat watch, 3 November 2026: 6 exploited CVEs added this week, 4 to act on now

·4 min read

The bottom line

CISA added 6 vulnerabilities to its exploited list from 28 October 2026 to 3 November 2026. 4 have a deadline within three days or already past, 4 of them past. Read the exploited list first. It is the work list. Everything else is a reading list.

Separately, 492 new CVE records were published in the last 30 hours, 76 of them scored 8.5 or higher. They are in the day's CVE highlight, not on this list, because nothing says yet that anyone is using them.

Cover page of Daily threat watch, 3 November 2026: 6 exploited CVEs added this week, 4 to act on nowFree analysis report · 6 pagesDaily threat watch, 3 November 2026: 6 exploited CVEs added this week, 4 to act on nowThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

What changed since the last watch

At a glance

EntryActCISA dateFixed inEPSS
Linux Kernel (CVE-2026-46300)Today3 days past CISA's deadlineNot stated; see the note0.16
GitLab Community Edition and Enterprise Edition (CVE-2026-97229)Today2 days past CISA's deadlineGitLab CE/EE 19.2.8, 19.3.5, and 19.4.2, per the vendor's advisory.0.27
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software (CVE-2026-76418)Today2 days past CISA's deadlineNot stated; see the note0.01
Ivanti Connect Secure (CVE-2026-111357)Today1 day past CISA's deadlineNot stated; see the note0.01
Broadcom VMware ESX (CVE-2026-41709)Next patch cycleDue in 8 daysNot stated; see the note0.01
Ivanti Connect Secure (CVE-2026-118527)Next patch cycleDue in 10 daysNot stated; see the noten/a

Do this today, in this order

  • Linux Kernel, CVE-2026-46300, 3 days past CISA's deadline.
  • GitLab Community Edition and Enterprise Edition, CVE-2026-97229, 2 days past CISA's deadline.
  • Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, CVE-2026-76418, 2 days past CISA's deadline.
  • Ivanti Connect Secure, CVE-2026-111357, 1 day past CISA's deadline.

In the next patch cycle

Check it yourself in two minutes

Everything above comes from public sources. This command prints CISA's additions in the same period with their due dates:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-28" and .dateAdded <= "2026-11-03")
    | [.cveID,.dateAdded,.dueDate,.vendorProject,.product] | @tsv' | sort -k2

Run on 3 November 2026 it printed 6 rows, the ones above. A later run may show more.

Check your own project

If you build software, you can compare what a project declares with these CVEs from a terminal. The tool reads requirements files, package.json, Maven, Gradle, Cargo, CMake and Dockerfile files, runs nothing, and only the CVE ids leave your machine. Naming the CVEs needs no key.

lattice-scan project . --cve CVE-2026-46300,CVE-2026-97229,CVE-2026-76418,CVE-2026-111357,CVE-2026-41709,CVE-2026-118527

Each row says in-range, outside-range, undetermined or lead, with the file and line. That is evidence about what a manifest declares, not about what runs, and a person decides. The verdicts, the CSV columns and a pipeline recipe are in the guide.

Check the servers you run

The same ids can be checked against a host. Run this on the machine itself, not on the laptop that deploys to it: it reads installed packages (dpkg, rpm or apk), snaps, the names of running container images and the kernel version, compares them on the spot, and only the CVE ids leave the machine; the inventory stays on it, in ~/.lattice-scan. Naming the CVEs needs no key. Do it on each server after a deployment, and again when a new entry lands.

lattice-scan --cve CVE-2026-46300 --cve CVE-2026-97229 --cve CVE-2026-76418 --cve CVE-2026-111357 --cve CVE-2026-41709 --cve CVE-2026-118527

A match is a candidate for a person to confirm, not a finding. A distribution can fix a CVE under an unchanged version number, so a match is a candidate; on Debian-family hosts the report also shows whether the package's own changelog names the CVE. It reads the names of the running images, not what is inside them; for what an image declares, use the project check on its Dockerfile.

Guide: namiq.io/lattice/guides/choose-your-channel. MCP server (io.namiq/lattice in the MCP registry): namiq.io/lattice. Package: pypi.org/project/lattice-scan, or namiq.io/apt.

What we do not know yet

  • Who is using these flaws, and how often. CISA names no attacker and we do not guess one. Ransomware use is as CISA records it; "unknown" means not recorded.
  • EPSS is recalculated daily; the figures are as at 3 November 2026 and will have moved. The order is a rule on CISA's dates and EPSS, not a verdict on your estate: check what you run first.

Sources

  1. CISA Known Exploited Vulnerabilities catalogue
  2. FIRST: Exploit Prediction Scoring System
  3. CVE record service

Does this touch your business?

A new vulnerability is a question about what you run, who can reach it and what it would cost you. If you want a person to answer it for your own systems, start with your IT setup.

Review your IT setupDiscuss a security exposure →
Also worth reading
Security · 5 min

Daily CVE highlight, 3 November 2026: 3 new critical CVEs worth reading

74 new records scored 8.5 or higher in the last 30 hours. 3 to read first, and the conditions each score leaves out.

Security · 8 min

themefic Ultra Addons for Contact Form 7, CVE-2026-102435: a new CVE scored 9.8

Anyone running Ultra Addons for Contact Form 7 at version 3.5.54 or below with the PDF Generator add-on active must act now; no login is needed to exploit this. Disable the PDF Generator feature …

Start with one piece of work.

Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.

Talk to us