Set of Fri 6 Nov 2026

Set of Fri 6 Nov 2026

01 · Exploited CVE of the day

Apple · Multiple Products

CVE-2024-27834

Apple Multiple Products Improper Authentication Vulnerability

In CISA KEV since
Ransomware use
Unknown
EPSS
0.014 · top 27%scored 05 Nov 2026
CVSS
5.5v3.1 · ADP

CISA remediation due

Picked: highest EPSS among KEV additions of the last 7 days, ransomware use as tie-break.

02 · Top 10 this week

Exploited this week

  1. CVE-2024-27834 Apple · Multiple Products

    Apple Multiple Products Improper Authentication Vulnerability

    KEV 04 Nov 2026 · EPSS 0.014 · CVSS 5.5

    EPSS 30-day trendAdvisory ↗

  2. CVE-2026-119977 WordPress · WordPress Core

    WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

    KEV 03 Nov 2026 · EPSS 0.012 · CVSS 8.1

    EPSS 30-day trendAdvisory ↗

Critical in widely used software

  1. CVE-2026-120931 Google · Chrome

    Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outs…

    published 03 Nov 2026 · CVSS 9.6 v3.1 · ADP · not known exploited

    CISA SSVC: exploitation none, automatable no, technical impact total

    Score it in CVSS →Advisory ↗

  2. CVE-2026-121030 Google · Chrome

    Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to pote…

    published 03 Nov 2026 · CVSS 9.6 v3.1 · ADP · not known exploited

    CISA SSVC: exploitation none, automatable no, technical impact total

    Score it in CVSS →Advisory ↗

How these are picked

Exploited this week: CVEs added to the CISA KEV catalog (exploitation confirmed by CISA) in the last 7 days, highest EPSS score first; known ransomware use, then the newest addition, break ties.

Critical in widely used software: CVEs published in the last 7 days with a CVSS base score of 9.0 or more (the highest score published by NVD or the CNA, v3.x or v4.0), in software on the watchlist below or named in a Debian security advisory. Ranked by CVSS score, then CISA’s SSVC ratings (exploitation, automatable, technical impact), then a Debian advisory, newest first, with at most two CVEs per watchlist product so one vendor’s patch day cannot fill the list. A CVE on this list is not known to be exploited unless it says “in KEV”.

Watchlist: PHP, OpenSSL, OpenSSH, Linux kernel, glibc, sudo, Apache HTTP Server, Apache Tomcat, nginx, Microsoft Windows, Microsoft Exchange, Google Chrome, Mozilla Firefox, Java, Node.js, Cisco, Fortinet, Ivanti, Citrix, VMware, Palo Alto PAN-OS.

NVD, CVE.org and Debian fetched 06 Nov, 03:30 UTC

03 · Featured tool

SRI Hash Generator SERVER-ASSISTED

Generate Subresource Integrity hashes for assets.

KEV this week: 2 additions · dashboard →

PRICE Free

No account · no tracking · 82% of tools run in your browser

KEV + EPSS fetched 05 Nov, 16:30 UTC · hosted in Germany