Set of Mon 2 Nov 2026

Set of Mon 2 Nov 2026

01 · Exploited CVE of the day

Google · Brotli

CVE-2026-111497

Google Brotli Unchecked Return Value Vulnerability

In CISA KEV since
Ransomware use
Unknown
EPSS
0.826 · top 0.3%scored 01 Nov 2026
CVSS
9.2v4.0 · CNA

CISA remediation due

Picked: highest EPSS among KEV additions of the last 7 days, ransomware use as tie-break.

02 · Top 10 this week

Exploited this week

  1. CVE-2026-111497 Google · Brotli

    Google Brotli Unchecked Return Value Vulnerability

    KEV 27 Oct 2026 · EPSS 0.826 · CVSS 9.2

    EPSS 30-day trendAdvisory ↗

  2. CVE-2026-48356 Adobe · Commerce and Magento

    Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

    KEV 27 Oct 2026 · EPSS 0.446 · CVSS 9.3

    EPSS 30-day trendAdvisory ↗

  3. CVE-2026-97229 GitLab · Community Edition and Enterprise Edition

    GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

    KEV 29 Oct 2026 · EPSS 0.273 · CVSS 10.0

    EPSS 30-day trendAdvisory ↗

  4. CVE-2026-46300 Linux · Kernel

    Linux Kernel Missing Initialization of a Variable Vulnerability

    KEV 28 Oct 2026 · EPSS 0.161 · CVSS 7.8

    EPSS 30-day trendAdvisory ↗

  5. CVE-2026-76418 Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software

    Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

    KEV 29 Oct 2026 · EPSS 0.008 · CVSS 8.6

    EPSS 30-day trendAdvisory ↗

Critical in widely used software

  1. CVE-2026-118305 Google · Chrome

    Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outsi…

    published 27 Oct 2026 · CVSS 9.6 v3.1 · ADP · not known exploited · Debian DSA-6592-1

    CISA SSVC: exploitation none, automatable no, technical impact total

    Score it in CVSS →Advisory ↗Debian advisory ↗

  2. CVE-2026-118306 Google · Chrome

    Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code out…

    published 27 Oct 2026 · CVSS 9.6 v3.1 · ADP · not known exploited · Debian DSA-6592-1

    CISA SSVC: exploitation none, automatable no, technical impact total

    Score it in CVSS →Advisory ↗Debian advisory ↗

How these are picked

Exploited this week: CVEs added to the CISA KEV catalog (exploitation confirmed by CISA) in the last 7 days, highest EPSS score first; known ransomware use, then the newest addition, break ties.

Critical in widely used software: CVEs published in the last 7 days with a CVSS base score of 9.0 or more (the highest score published by NVD or the CNA, v3.x or v4.0), in software on the watchlist below or named in a Debian security advisory. Ranked by CVSS score, then CISA’s SSVC ratings (exploitation, automatable, technical impact), then a Debian advisory, newest first, with at most two CVEs per watchlist product so one vendor’s patch day cannot fill the list. A CVE on this list is not known to be exploited unless it says “in KEV”.

Watchlist: PHP, OpenSSL, OpenSSH, Linux kernel, glibc, sudo, Apache HTTP Server, Apache Tomcat, nginx, Microsoft Windows, Microsoft Exchange, Google Chrome, Mozilla Firefox, Java, Node.js, Cisco, Fortinet, Ivanti, Citrix, VMware, Palo Alto PAN-OS.

NVD, CVE.org and Debian fetched 02 Nov, 03:30 UTC

03 · Featured tool

NIST CSF 2.0 Tier Assessment IN-BROWSER

Self-assess your CSF 2.0 Implementation Tier.

KEV this week: 8 additions · dashboard →

PRICE Free

No account · no tracking · 82% of tools run in your browser

KEV + EPSS fetched 03:30 UTC · hosted in Germany