Triage desk
Look up a CVE, then decide what to do.
Search every note by CVE, product, weakness or ATT&CK technique, then open the note or its analysis report.
Read 2026-11-06. CISA data is as at the last knowledge-graph update. Not being listed here says nothing about safety. What CISA added in the last seven days · 21 weakness pages · CVE Triage Handbook
- Daily CVE highlight, 6 November 2026: 3 new critical CVEs worth reading
- Daily threat watch, 6 November 2026: 2 exploited CVEs added this week, 1 to act on now
- TPC Software Matchpoint, CVE-2026-111489: a new CVE scored 9.9
- Unknown WP Libre Form, CVE-2026-118423: a new CVE scored 10
- Apache Juneau CVE-2026-121489: a file-system resource that does not stay in its folder, and what the default setting does not protect
- Comfast CF-WR632AX, CVE-2026-122013: a new CVE scored 10
- Daily CVE highlight, 5 November 2026: 3 new critical CVEs worth reading
- Daily threat watch, 5 November 2026: 2 exploited CVEs added this week, 1 to act on now
- Linksys E5350, CVE-2026-121932: a new CVE scored 10
- OpenBSD OpenSSH, CVE-2026-123158: a new CVE scored 8.1
- WordPress CVE-2026-119977: exploited remote code execution in the core upgrade, what it puts at risk, and the order to act in
- Apple Multiple Products, CVE-2024-27834: on CISA's exploited list
- Daily CVE highlight, 4 November 2026: 3 new critical CVEs worth reading
- Daily threat watch, 4 November 2026: 4 exploited CVEs added this week, 2 to act on now
- Qihoo 360 D603-2, CVE-2026-121607: a new CVE scored 10
- Qihoo 360 D621-2, CVE-2026-121606: a new CVE scored 10
- Qihoo 360 Whole Home Router M5, CVE-2026-121609: a new CVE scored 10
- Daily CVE highlight, 3 November 2026: 3 new critical CVEs worth reading
- Daily threat watch, 3 November 2026: 5 exploited CVEs added this week, 4 to act on now
- Emerson Ovation, CVE-2022-29966: a new CVE scored 9.8
- SolarWinds Dameware, CVE-2026-28336: a new CVE scored 9.9
- themefic Ultra Addons for Contact Form 7, CVE-2026-102435: a new CVE scored 9.8
- TOTOLINK A950RG, CVE-2026-121597: a new CVE scored 9.9
- WSO2 API Manager, CVE-2026-4052: a new CVE scored 9.8
- xianhc ape-volo-admin, CVE-2026-120442: a new CVE scored 9.8
- Daily CVE highlight, 2 November 2026: 3 new critical CVEs worth reading
- Daily threat watch, 2 November 2026: 6 exploited CVEs added this week, 4 to act on now
- Linksys E8450, CVE-2026-120283: a new CVE scored 10
- PrefectHQ prefab-ui, CVE-2026-120338: a new CVE scored 10
- WAVLINK WN536AX6-A, CVE-2026-120276: a new CVE scored 10
- WAVLINK WN551X3-A, CVE-2026-120344: a new CVE scored 10
- D-Link DIR-505, CVE-2026-120189: a new CVE scored 10
- Daily CVE highlight, 1 November 2026: 3 new critical CVEs worth reading
- Daily threat watch, 1 November 2026: 8 exploited CVEs added this week, 4 to act on now
- WAVLINK WL-WN530BE1-A, CVE-2026-120198: a new CVE scored 10
- WAVLINK WL-WN579A3-A, CVE-2026-120195: a new CVE scored 10
- Weekly highlight and guideline, 1 November 2026: 8 exploited CVEs, 6 new critical records, and your week in order
- addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder, CVE-2026-109220: a new CVE scored 9.8
- Canonical LXD, CVE-2026-112816: a new CVE scored 10
- Daily CVE highlight, 31 October 2026: 3 new critical CVEs worth reading
- Daily threat watch, 31 October 2026: 10 exploited CVEs added this week, 6 to act on now
- morpheus65535 bazarr, CVE-2026-61826: a new CVE scored 10
- mqttsnet thinglinks, CVE-2026-62853: a new CVE scored 9.9
- pgadmin.org pgAdmin 4, CVE-2026-116241: a new CVE scored 9.9
- socfortress CoPilot, CVE-2026-61738: a new CVE scored 10
- We checked one host against this week's exploited CVEs with Lattice: two to verify, one exposure to fix, one patch to apply
- Daily CVE highlight, 30 October 2026: 3 new critical CVEs worth reading
- Daily threat watch, 30 October 2026: 10 exploited CVEs added this week, 6 to act on now
- Ivanti Connect Secure, CVE-2026-111357: on CISA's exploited list
- Ivanti Connect Secure, CVE-2026-118527: on CISA's exploited list
- Daily threat watch, 29 October 2026: eight exploited CVEs in seven days, five that need action today
- Nextcloud's built-in Collabora server, CVE-2026-110447: exploited since 10 September, fixed in 26.4.303, and why updating is not the last step
- Arista VeloCloud Orchestrator, CVE-2026-114625: a 9.9 that needs only the lowest account, on CISA's list with a deadline already past
- Case study: IT for a growing Austin architecture firm, from a faster network to an alarm on its backup
- Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, CVE-2026-76418: on CISA's exploited list
- GitLab Community Edition and Enterprise Edition, CVE-2026-97229: on CISA's exploited list
- Daily CVE highlight, 28 October 2026: four 9.8s, and each one turns on a different question
- Dell Data Domain DSA-2026-416: four 9.8s that need no login, on the appliance you restore from
- Juniper Session Smart Router CVE-2026-103409: a 9.8 that is only open until the device is onboarded
- jackson-databind CVE-2026-110879: the fix you applied in June did not close it
- Jenkins advisory 2026-10-28: fifteen fixes, and read-only access is not harmless
- Linux kernel CVE-2026-46300 (Fragnesia) is now on CISA's list, and CISA ties it to PHP2Shell
- Brotli CVE-2026-111497: a decompression bug in a library you did not know you shipped
- Adobe Commerce CVE-2026-48356: patched in July, on CISA's exploited list in October
- VMware ESX CVE-2026-41709: a 2.7 on CISA's exploited list, and why the score is the wrong thing to read
- MLflow CVE-2026-116692: an AI platform where "no login" is the default, and "can upload" means "can run code"
- Apache Kafka Connect CVE-2026-115644: the setting that isolates the admin API left it with no login
- How we check, analyse and triage a CVE, and the 63-page handbook behind it
- Daily CVE highlight, 26 October 2026: patch the agent sandbox today, check one ArcGIS setting, audit your namespaces
- CVE-2026-112346: your AI agent's sandbox is a network service, and it shipped with no login
- CVE-2026-110720: a Kubernetes namespace is not an identity boundary
- CVE-2026-10757: ArcGIS Server SQL injection, and what the word "public" changes
- Wasmtime sandbox escapes: CVE-2026-115889 and CVE-2026-115893, and the fixed version that depends on your release line
- PHP2Shell: what to do this week about the two PHP flaws patched on 21 October
- Pillow CVE-2026-112393: who the TIFF heap overflow actually affects, and the two CVEs that came with it
- EG Secure Solutions SiteGuard Server Edition, CVE-2026-106931: on CISA's exploited list
- Plex Media Server, CVE-2026-96652: on CISA's exploited list
- Plex Media Server, CVE-2026-96654: on CISA's exploited list
- Plex Media Server, CVE-2026-96655: on CISA's exploited list
- Plex Media Server, CVE-2026-96656: on CISA's exploited list
- Siemens Software Center, CVE-2026-110936: on CISA's exploited list
- BeyondTrust Remote Support, CVE-2026-102764: on CISA's exploited list
- Fortinet Multiple Products, CVE-2025-61624: on CISA's exploited list
- Atlassian Multiple Products, CVE-2026-21589: on CISA's exploited list
- AhsayCBS, CVE-2026-105133: on CISA's exploited list
- AhsayCBS, CVE-2026-105134: on CISA's exploited list
- Cisco Secure Email Gateway, CVE-2026-76519: on CISA's exploited list
- Palo Alto Networks PAN-OS, CVE-2026-0322: on CISA's exploited list
- Ivanti Connect Secure, CVE-2026-104935: on CISA's exploited list
- Microsoft Windows, CVE-2026-96951: on CISA's exploited list
- Apache Struts, CVE-2016-3081: on CISA's exploited list
- ISC BIND, CVE-2015-5477: on CISA's exploited list
- ONLYOFFICE Docs, CVE-2021-3199: on CISA's exploited list
- ProFTPD, CVE-2015-3306: on CISA's exploited list
- Strapi, CVE-2023-22894: on CISA's exploited list
- Citrix NetScaler, CVE-2026-88779: on CISA's exploited list
- Zammad GmbH Zammad, CVE-2026-102489: on CISA's exploited list
- Zammad GmbH Zammad, CVE-2026-102490: on CISA's exploited list
- Fortinet FortiMail, CVE-2026-104286: on CISA's exploited list