Security flaw tracker: new CVEs today
From NVD and CISA, updated hourly · 09:34 UTC
Yesterday
112
11 critical · 26 today
Last 7 days
3,461
▼23% vs 7 before
Last 30 days
16,669
▲12% vs 30 before
Exploited, 30 days
35
CISA list: 1,766
Nov 1, 2026 (so far) · 26 new5 critical1 high12 medium2 low6 unscored· 7-day avg 555
CriticalHighMediumLowNot scored yet7-day average
What they hit · 30d
- Operating systems17%
- Dev tools & libraries13%
- WordPress & CMS10%
- Business software7%
- Browsers6%
- Web apps5%
- Other44%
Kind of flaw · 30d
- Auth bypass & access23%
- Memory corruption18%
- Cross-site scripting8%
- Remote code execution6%
- Denial of service5%
- Path traversal & file upload4%
- Other37%
Vendors · 30d
- Microsoft9%
- Oracle Corporation6%
- Linux6%
- Google5%
- Apple2%
- Apache Software Foundation2%
- Other70%
exploited in the wild: patch firstCISA KEV · 45 days
Oct 30Ivanti Connect Secure · Uploads attacker‑controlled files to a known disk location3 flaws
- CVE-2026-118527 · Uploads attacker‑controlled files to a known disk location
- CVE-2026-111357 · Escalates local user privileges by bypassing authentication
- CVE-2026-104935 · Executes arbitrary commands without authentication
- Oct 29Cisco Secure Firewall ASA Software · Triggers null pointer dereference causing device reload and DoS
- Oct 29GitLab Community Edition · Runs arbitrary code via crafted regex in CI/CD config without auth
Oct 28Linux Kernel · Processes malformed TLS records causing potential data leakage or crash4 flaws
- CVE-2025-39682 · Processes malformed TLS records causing potential data leakage or crash
- CVE-2026-46300 · Modifies page‑cache data leading to decryption of shared fragments
- CVE-2025-39964 · Corrupts socket state by interleaving concurrent writes
- CVE-2026-53266 · Writes out‑of‑bounds into socket buffer via ebtables SNAT
- Oct 28Broadcom VMware ESX · Performs admin actions without logging, hiding malicious activity
Oct 27Adobe Commerce · Uploads dangerous files to run code as the current user2 flaws
- CVE-2026-48356 · Uploads dangerous files to run code as the current user
- CVE-2026-71362 · Escalates to sensitive resources without user interaction
- Oct 27Google Brotli · Corrupts memory via crafted Brotli stream, leading to crash or code exec
Oct 26PHP · Exploits OOM handling to read uninitialized memory, leaking data2 flaws
- CVE-2026-109618 · Exploits OOM handling to read uninitialized memory, leaking data
- CVE-2026-109619 · Executes remote code without authentication
Oct 23Arista VeloCloud Orchestrator · Accesses privileged functions, compromising orchestrator confidentiality2 flaws
- CVE-2026-93952 · Accesses privileged functions, compromising orchestrator confidentiality
- CVE-2026-114625 · Gains privileged internal functions, compromising orchestrator data
- Oct 23Collabora Online · Injects OS commands through proxy when CODE server is down, executing code
Oct 20Plex Media Server · Forces Plex server to POST arbitrary URLs via SSRF4 flaws
- CVE-2026-96652 · Forces Plex server to POST arbitrary URLs via SSRF
- CVE-2026-96656 · Writes arbitrary files as admin, enabling code execution chain
- CVE-2026-96655 · Requests internal or external addresses via SSRF endpoint
- CVE-2026-96654 · Calls other plugins’ functions with attacker‑supplied parameters
- Oct 20Siemens Software Center · Executes arbitrary code by placing a crafted DLL in search path
- Oct 20EG Secure Solutions SiteGuard Server Edition · Runs OS commands with root/System privileges via injection
- Oct 16Fortinet Multiple Products · Writes or deletes arbitrary files via path traversal in CLI
- Oct 16BeyondTrust Remote Support · Performs unauthorized file operations on the appliance
latest criticalCVSS 9+ · 48 hours
Oct 30CoPilot · Writes arbitrary files by uploading unvalidated filenames4 flaws10.0
- CVE-2026-6173810.0 · Writes arbitrary files by uploading unvalidated filenames
- CVE-2026-617289.9 · Injects stored HTML markup into incident comments
- CVE-2026-617299.4 · Bypasses webhook authentication using shared secret values
- CVE-2026-617309.3 · Exposes scout report files to anyone without authentication
Oct 30Thinglinks · Runs arbitrary server‑side code via unsandboxed Groovy scripts2 flaws9.9
- CVE-2026-628539.9 · Runs arbitrary server‑side code via unsandboxed Groovy scripts
- CVE-2026-628499.1 · Injects SQL to tamper or overwrite time‑series data
Oct 30Vvveb · Bypasses password reset to forge authentication tokens2 flaws9.8
- CVE-2026-1107999.8 · Bypasses password reset to forge authentication tokens
- CVE-2026-1129059.0 · Reads or overwrites other admins’ API tokens via IDOR
- Nov 1WAVLINK WL-WN530BE1-A · Executes arbitrary commands on the router via crafted group_name/IP-FROM10.0
- Nov 1WAVLINK WL-WN579A3-A · Executes OS commands on router via set_wzdgwMesh wlan_ssid argument10.0
- Nov 1D-Link DIR-505 · Lets attackers cause remote code execution via TFTP upload filename overflow10.0
- Oct 30Bazarr · Logs out Plex integration and disables it without authentication10.0
- Oct 30Canonical LXD · Authenticates as any client using crafted certificate chain10.0
- Nov 1WAVLINK WL-WN530HG4B · Executes OS commands on router via port_forward Name argument9.9
- Nov 1WAVLINK WN579X3-D · Executes OS commands on router via port_forward Name argument9.9
- Oct 30PgAdmin 4 · Escapes query wrapper to run arbitrary commands via psql copy9.9
- Oct 31Apache Software Foundation Apache MINA · Lets attackers run arbitrary code by sending crafted objects to the decoder9.8
- Oct 31AJ-Report · Lets attackers forge share tokens to run arbitrary Groovy code via testTransform9.8
- Oct 31Jpom · Lets attackers bypass auth, gain admin and execute scripts9.8
- Oct 31SimpleForm · Uploads malicious files to gain code execution on the site9.8
FAQ
Where do these numbers come from?+
From the U.S. National Vulnerability Database (NVD), which publishes every new CVE, and from CISA’s Known Exploited Vulnerabilities catalog, the official list of flaws attackers are using in the wild. DevHunt reads both every hour and only counts and sorts what they publish.
What is a CVE?+
A CVE (Common Vulnerabilities and Exposures) is a public ID for one security flaw in one product, like CVE-2026-12345. Each gets a description and usually a CVSS severity score from 0 to 10: critical is 9 and up, high 7 to 8.9, medium 4 to 6.9, low below 4.
Which day does a CVE count on?+
The UTC day NVD published it. Today’s bar fills up during the day, so it is lighter in the chart until the day is over. Rejected CVEs are not counted.
Why are some CVEs not scored yet?+
A CVE is published as soon as it is reserved and described; the CVSS score comes from the reporting organization or from NVD’s own analysis, which can take days or weeks. Those CVEs show as “not scored yet”.
How is a flaw sorted into a kind and an area?+
The kind comes from its CWE (the weakness type the CVE lists, e.g. CWE-79 is cross-site scripting). The area comes from keywords in the vendor, product and description: cars and vehicles, medical devices, industrial and energy, AI tools, WordPress, phones, browsers, routers and IoT, and so on. It is a plain rule, the same for every CVE, so it is good for trends but can misfile a single flaw.
Which flaws should I patch first?+
The ones in the “exploited in the wild” list that you run: attackers are already using them. After that, critical flaws in internet-facing software. Most CVEs are never exploited, so the daily total says more about how much is being found than about how much danger you are in.
Why are there so many more CVEs than a few years ago?+
More organizations can now hand out CVE IDs, open-source and WordPress plugin flaws are reported in bulk, and AI tools find bugs faster. The yearly count has risen every year: about 29,000 in 2023, 40,000 in 2024 and far more since.