Set of Wed 4 Nov 2026

Set of Wed 4 Nov 2026

01 · Exploited CVE of the day

GitLab · Community Edition and Enterprise Edition

CVE-2026-97229

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

In CISA KEV since
Ransomware use
Unknown
EPSS
0.277 · top 2%scored 03 Nov 2026
CVSS
10.0v3.1 · CNA

CISA remediation due

Picked: highest EPSS among KEV additions of the last 7 days, ransomware use as tie-break.

02 · Top 10 this week

Exploited this week

  1. CVE-2026-97229 GitLab · Community Edition and Enterprise Edition

    GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

    KEV 29 Oct 2026 · EPSS 0.277 · CVSS 10.0

    EPSS 30-day trendAdvisory ↗

  2. CVE-2026-76418 Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software

    Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

    KEV 29 Oct 2026 · EPSS 0.008 · CVSS 8.6

    EPSS 30-day trendAdvisory ↗

  3. CVE-2026-119977 WordPress · WordPress Core

    WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

    KEV 03 Nov 2026 · EPSS 0.006 · CVSS 8.1

    EPSS 30-day trendAdvisory ↗

  4. CVE-2026-111357 Ivanti · Connect Secure

    Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

    KEV 30 Oct 2026 · EPSS 0.005 · CVSS 7.0

    EPSS 30-day trendAdvisory ↗

Critical in widely used software

  1. CVE-2026-119261 Google · Chrome

    Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code o…

    published 30 Oct 2026 · CVSS 9.6 v3.1 · ADP · not known exploited · Debian DSA-6605-1

    CISA SSVC: exploitation none, automatable no, technical impact total

    Score it in CVSS →Advisory ↗Debian advisory ↗

  2. CVE-2026-119263 Google · Chrome

    Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary c…

    published 30 Oct 2026 · CVSS 9.6 v3.1 · ADP · not known exploited · Debian DSA-6605-1

    CISA SSVC: exploitation none, automatable no, technical impact total

    Score it in CVSS →Advisory ↗Debian advisory ↗

How these are picked

Exploited this week: CVEs added to the CISA KEV catalog (exploitation confirmed by CISA) in the last 7 days, highest EPSS score first; known ransomware use, then the newest addition, break ties.

Critical in widely used software: CVEs published in the last 7 days with a CVSS base score of 9.0 or more (the highest score published by NVD or the CNA, v3.x or v4.0), in software on the watchlist below or named in a Debian security advisory. Ranked by CVSS score, then CISA’s SSVC ratings (exploitation, automatable, technical impact), then a Debian advisory, newest first, with at most two CVEs per watchlist product so one vendor’s patch day cannot fill the list. A CVE on this list is not known to be exploited unless it says “in KEV”.

Watchlist: PHP, OpenSSL, OpenSSH, Linux kernel, glibc, sudo, Apache HTTP Server, Apache Tomcat, nginx, Microsoft Windows, Microsoft Exchange, Google Chrome, Mozilla Firefox, Java, Node.js, Cisco, Fortinet, Ivanti, Citrix, VMware, Palo Alto PAN-OS.

NVD, CVE.org and Debian fetched 04 Nov, 03:30 UTC

03 · Featured tool

RACI Matrix Builder IN-BROWSER

RACI / RASCI matrix with one-Accountable validation, MD/CSV/JSON export.

KEV this week: 5 additions · dashboard →

PRICE Free

No account · no tracking · 82% of tools run in your browser

KEV + EPSS fetched 03:30 UTC · hosted in Germany