Set of Fri 13 Nov 2026
Set of Fri 13 Nov 2026
01 · Exploited CVE of the day
OpenBSD · OpenSSH
CVE-2026-123158
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
- In CISA KEV since
- Ransomware use
- Unknown
- EPSS
- 0.189 · top 3%scored 12 Nov 2026
- CVSS
- 8.1v3.1 · CNA
CISA remediation due
Picked: highest EPSS among KEV additions of the last 7 days, ransomware use as tie-break.
02 · Top 10 this week
Exploited this week
CVE-2026-123158 OpenBSD · OpenSSH
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
KEV 09 Nov 2026 · EPSS 0.189 · CVSS 8.1
CVE-2026-116606 Barracuda Networks · Barracuda Email Security Gateway (ESG)
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
KEV 10 Nov 2026 · EPSS 0.089 · CVSS 9.3
CVE-2026-111560 Barracuda Networks · Multiple Products
Barracuda Networks Multiple Products OS Command Injection Vulnerability
KEV 10 Nov 2026 · EPSS 0.062 · CVSS 8.6
CVE-2026-116779 SignalWire · FreeSwitch
SignalWire FreeSwitch Code Injection Vulnerability
KEV 09 Nov 2026 · EPSS 0.025 · CVSS 9.8
CVE-2026-124194 Microsoft · Office
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
KEV 10 Nov 2026 · EPSS 0.016 · CVSS 6.5
Critical in widely used software
CVE-2026-126259 Fortinet · FortiOS
A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through…
published 11 Nov 2026 · CVSS 9.8 v3.1 · CNA · not known exploited
CISA SSVC: exploitation none, automatable yes, technical impact total
CVE-2026-126262 Fortinet · FortiAnalyzer
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 throug…
published 11 Nov 2026 · CVSS 9.8 v3.1 · CNA · not known exploited
CISA SSVC: exploitation none, automatable yes, technical impact total
CVE-2026-112967 Microsoft · Windows 10 Version 1809
Windows Xbox Live Networking Service Remote Code Execution Vulnerability
published 10 Nov 2026 · CVSS 9.8 v3.1 · CNA · not known exploited
CISA SSVC: exploitation none, automatable yes, technical impact total
CVE-2026-116928 Microsoft · Windows 10 Version 1607
Windows Search Remote Code Execution Vulnerability
published 10 Nov 2026 · CVSS 9.8 v3.1 · CNA · not known exploited
CISA SSVC: exploitation none, automatable yes, technical impact total
CVE-2026-121653 ivanti · Endpoint Manager
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote cod…
published 10 Nov 2026 · CVSS 9.8 v3.1 · CNA · not known exploited
CISA SSVC: exploitation none, automatable yes, technical impact total
How these are picked
Exploited this week: CVEs added to the CISA KEV catalog (exploitation confirmed by CISA) in the last 7 days, highest EPSS score first; known ransomware use, then the newest addition, break ties.
Critical in widely used software: CVEs published in the last 7 days with a CVSS base score of 9.0 or more (the highest score published by NVD or the CNA, v3.x or v4.0), in software on the watchlist below or named in a Debian security advisory. Ranked by CVSS score, then CISA’s SSVC ratings (exploitation, automatable, technical impact), then a Debian advisory, newest first, with at most two CVEs per watchlist product so one vendor’s patch day cannot fill the list. A CVE on this list is not known to be exploited unless it says “in KEV”.
Watchlist: PHP, OpenSSL, OpenSSH, Linux kernel, glibc, sudo, Apache HTTP Server, Apache Tomcat, nginx, Microsoft Windows, Microsoft Exchange, Google Chrome, Mozilla Firefox, Java, Node.js, Cisco, Fortinet, Ivanti, Citrix, VMware, Palo Alto PAN-OS.
NVD, CVE.org and Debian fetched 13 Nov, 03:30 UTC
KEV this week: 10 additions · dashboard →
PRICE Free
No account · no tracking · 82% of tools run in your browser
KEV + EPSS fetched 03:30 UTC · hosted in Germany