Set of Tue 3 Nov 2026
Set of Tue 3 Nov 2026
01 · Exploited CVE of the day
GitLab · Community Edition and Enterprise Edition
CVE-2026-97229
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- In CISA KEV since
- Ransomware use
- Unknown
- EPSS
- 0.273 · top 2%scored 02 Nov 2026
- CVSS
- 10.0v3.1 · CNA
CISA remediation due
Picked: highest EPSS among KEV additions of the last 7 days, ransomware use as tie-break.
02 · Top 10 this week
Exploited this week
CVE-2026-97229 GitLab · Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
KEV 29 Oct 2026 · EPSS 0.273 · CVSS 10.0
CVE-2026-46300 Linux · Kernel
Linux Kernel Missing Initialization of a Variable Vulnerability
KEV 28 Oct 2026 · EPSS 0.161 · CVSS 7.8
CVE-2026-76418 Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
KEV 29 Oct 2026 · EPSS 0.008 · CVSS 8.6
CVE-2026-41709 Broadcom · VMware ESX
Broadcom VMWare ESX Insufficient Logging Vulnerability
KEV 28 Oct 2026 · EPSS 0.007 · CVSS 2.7
CVE-2026-111357 Ivanti · Connect Secure
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
KEV 30 Oct 2026 · EPSS 0.005 · CVSS 7.0
Critical in widely used software
CVE-2026-119261 Google · Chrome
Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code o…
published 30 Oct 2026 · CVSS 9.6 v3.1 · ADP · not known exploited · Debian DSA-6605-1
CISA SSVC: exploitation none, automatable no, technical impact total
CVE-2026-119263 Google · Chrome
Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary c…
published 30 Oct 2026 · CVSS 9.6 v3.1 · ADP · not known exploited · Debian DSA-6605-1
CISA SSVC: exploitation none, automatable no, technical impact total
How these are picked
Exploited this week: CVEs added to the CISA KEV catalog (exploitation confirmed by CISA) in the last 7 days, highest EPSS score first; known ransomware use, then the newest addition, break ties.
Critical in widely used software: CVEs published in the last 7 days with a CVSS base score of 9.0 or more (the highest score published by NVD or the CNA, v3.x or v4.0), in software on the watchlist below or named in a Debian security advisory. Ranked by CVSS score, then CISA’s SSVC ratings (exploitation, automatable, technical impact), then a Debian advisory, newest first, with at most two CVEs per watchlist product so one vendor’s patch day cannot fill the list. A CVE on this list is not known to be exploited unless it says “in KEV”.
Watchlist: PHP, OpenSSL, OpenSSH, Linux kernel, glibc, sudo, Apache HTTP Server, Apache Tomcat, nginx, Microsoft Windows, Microsoft Exchange, Google Chrome, Mozilla Firefox, Java, Node.js, Cisco, Fortinet, Ivanti, Citrix, VMware, Palo Alto PAN-OS.
NVD, CVE.org and Debian fetched 03 Nov, 03:30 UTC
03 · Featured tool
Page Content Audit & Link Extractor SERVER-ASSISTED
Content, links, social profiles, media, design and hidden-text detection for any page, plus a filterable, exportable list of every link.
KEV this week: 6 additions · dashboard →
PRICE Free
No account · no tracking · 82% of tools run in your browser
KEV + EPSS fetched 03:30 UTC · hosted in Germany