Set of Thu 5 Nov 2026
Set of Thu 5 Nov 2026
01 · Exploited CVE of the day
WordPress · WordPress Core
CVE-2026-119977
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
- In CISA KEV since
- Ransomware use
- Unknown
- EPSS
- 0.010 · top 36%scored 04 Nov 2026
- CVSS
- 8.1v3.1 · CNA
CISA remediation due
Picked: highest EPSS among KEV additions of the last 7 days, ransomware use as tie-break.
02 · Top 10 this week
Exploited this week
CVE-2026-119977 WordPress · WordPress Core
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
KEV 03 Nov 2026 · EPSS 0.010 · CVSS 8.1
CVE-2026-118527 Ivanti · Connect Secure
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
KEV 30 Oct 2026 · EPSS 0.008 · CVSS 4.3
CVE-2024-27834 Apple · Multiple Products
Apple Multiple Products Improper Authentication Vulnerability
KEV 04 Nov 2026 · EPSS 0.006 · CVSS 5.5
CVE-2026-111357 Ivanti · Connect Secure
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
KEV 30 Oct 2026 · EPSS 0.005 · CVSS 7.0
Critical in widely used software
CVE-2026-119261 Google · Chrome
Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code o…
published 30 Oct 2026 · CVSS 9.6 v3.1 · ADP · not known exploited · Debian DSA-6605-1
CISA SSVC: exploitation none, automatable no, technical impact total
CVE-2026-119263 Google · Chrome
Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary c…
published 30 Oct 2026 · CVSS 9.6 v3.1 · ADP · not known exploited · Debian DSA-6605-1
CISA SSVC: exploitation none, automatable no, technical impact total
How these are picked
Exploited this week: CVEs added to the CISA KEV catalog (exploitation confirmed by CISA) in the last 7 days, highest EPSS score first; known ransomware use, then the newest addition, break ties.
Critical in widely used software: CVEs published in the last 7 days with a CVSS base score of 9.0 or more (the highest score published by NVD or the CNA, v3.x or v4.0), in software on the watchlist below or named in a Debian security advisory. Ranked by CVSS score, then CISA’s SSVC ratings (exploitation, automatable, technical impact), then a Debian advisory, newest first, with at most two CVEs per watchlist product so one vendor’s patch day cannot fill the list. A CVE on this list is not known to be exploited unless it says “in KEV”.
Watchlist: PHP, OpenSSL, OpenSSH, Linux kernel, glibc, sudo, Apache HTTP Server, Apache Tomcat, nginx, Microsoft Windows, Microsoft Exchange, Google Chrome, Mozilla Firefox, Java, Node.js, Cisco, Fortinet, Ivanti, Citrix, VMware, Palo Alto PAN-OS.
NVD, CVE.org and Debian fetched 05 Nov, 03:30 UTC
03 · Featured tool
PGP Key Lookup & Inspector SERVER-ASSISTED
Find PGP keys by email/fingerprint, or decode a pasted key.
KEV this week: 4 additions · dashboard →
PRICE Free
No account · no tracking · 82% of tools run in your browser
KEV + EPSS fetched 03:30 UTC · hosted in Germany