Set of Wed 28 Oct 2026

Set of Wed 28 Oct 2026

01 · Exploited CVE of the day

PHP Group · PHP

CVE-2026-109618

PHP Memory Corruption Vulnerability

In CISA KEV since
Ransomware use
Unknown
EPSS
1.000 · top 0.1%scored 27 Oct 2026
CVSS
9.2v4.0 · CNA

CISA remediation due

Picked: highest EPSS among KEV additions of the last 7 days, ransomware use as tie-break.

02 · Top 10 this week

Exploited this week

  1. CVE-2026-109618 PHP Group · PHP

    PHP Memory Corruption Vulnerability

    KEV 26 Oct 2026 · EPSS 1.000 · CVSS 9.2

    EPSS 30-day trendAdvisory ↗

  2. CVE-2026-109619 PHP Group · PHP

    PHP Stale Internal Request-State Vulnerability

    KEV 26 Oct 2026 · EPSS 1.000 · CVSS 9.2

    EPSS 30-day trendAdvisory ↗

  3. CVE-2026-111497 Google · Brotli

    Google Brotli Unchecked Return Value Vulnerability

    KEV 27 Oct 2026 · EPSS 0.555 · CVSS 9.2

    EPSS 30-day trendAdvisory ↗

  4. CVE-2026-48356 Adobe · Commerce and Magento

    Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

    KEV 27 Oct 2026 · EPSS 0.306 · CVSS 9.3

    EPSS 30-day trendAdvisory ↗

  5. CVE-2026-110447 Collabora · Collabora Online – Built-in CODE Server

    Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

    KEV 23 Oct 2026 · EPSS 0.116 · CVSS 9.2

    EPSS 30-day trendAdvisory ↗

Critical in widely used software

  1. CVE-2026-107656 Fortinet · FortiSandbox

    An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0…

    published 26 Oct 2026 · CVSS 9.8 v3.1 · CNA · not known exploited

    CISA SSVC: exploitation none, automatable yes, technical impact total

    Score it in CVSS →NVD entry ↗

  2. CVE-2026-98959 Linux · Linux

    btrfs: fix xattr replace when multiple xattrs are packed in the same item

    published 23 Oct 2026 · CVSS 9.8 v3.1 · CNA · not known exploited

    Score it in CVSS →NVD entry ↗

  3. CVE-2026-99078 Linux · Linux

    net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

    published 23 Oct 2026 · CVSS 9.8 v3.1 · CNA · not known exploited

    Score it in CVSS →NVD entry ↗

  4. CVE-2026-114820 Oracle Corporation · Oracle Java SE

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).…

    published 24 Oct 2026 · CVSS 9.1 v3.1 · CNA · not known exploited

    CISA SSVC: exploitation none, automatable yes, technical impact total

    Score it in CVSS →NVD entry ↗

How these are picked

Exploited this week: CVEs added to the CISA KEV catalog (exploitation confirmed by CISA) in the last 7 days, highest EPSS score first; known ransomware use, then the newest addition, break ties.

Critical in widely used software: CVEs published in the last 7 days with a CVSS base score of 9.0 or more (the highest score published by NVD or the CNA, v3.x or v4.0), in software on the watchlist below or named in a Debian security advisory. Ranked by CVSS score, then CISA’s SSVC ratings (exploitation, automatable, technical impact), then a Debian advisory, newest first, with at most two CVEs per watchlist product so one vendor’s patch day cannot fill the list. A CVE on this list is not known to be exploited unless it says “in KEV”.

Watchlist: PHP, OpenSSL, OpenSSH, Linux kernel, glibc, sudo, Apache HTTP Server, Apache Tomcat, nginx, Microsoft Windows, Microsoft Exchange, Google Chrome, Mozilla Firefox, Java, Node.js, Cisco, Fortinet, Ivanti, Citrix, VMware, Palo Alto PAN-OS.

NVD, CVE.org and Debian fetched 28 Oct, 03:30 UTC

03 · Featured tool

Text Toolkit IN-BROWSER

Case convert, clean & normalize, and analyze text in one.

KEV this week: 6 additions · dashboard →

PRICE Free

No account · no tracking · 82% of tools run in your browser

KEV + EPSS fetched 03:30 UTC · hosted in Germany