Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Week 45, 2026

2 November to 8 November 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
3,307
Critical
310
High
1,226
Added to KEV
3

Critical 310High 1,226Medium 1,380Low 163Not scored 228All 3,307 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2026-19868

    An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass…

    SonicWall · SonicOS

    ExploitedHigh7.5
  • CVE-2024-27834

    The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5,…

    Apple · Safari

    ExploitedMedium5.5
  • CVE-2026-119977

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    WordPress Foundation · WordPress

    ExploitedHigh8.1

Most severe new CVEsBy CVSS score

  • CVE-2026-122051

    Edimax BR-6208AC mp command injection

    Edimax · BR-6208AC

    Critical10.0
  • CVE-2026-121932

    Linksys E5350 apply.cgi system os command injection

    Linksys · E5350

    Critical10.0
  • CVE-2026-121607

    Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection

    Qihoo 360 · D603-2

    Critical10.0
  • CVE-2026-120345

    WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection

    WAVLINK · WN551X3-A

    Critical10.0
  • CVE-2026-120344

    WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection

    WAVLINK · WN551X3-A

    Critical10.0
  • CVE-2026-120280

    WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-120279

    WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection

    WAVLINK · WN536AX6-A

    Critical10.0
  • CVE-2026-123966

    Tenda AC19 saveParentControlInfo heap-based overflow

    Tenda · AC19

    Critical10.0
  • CVE-2026-121933

    Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication

    Linksys · E5350

    Critical10.0
  • CVE-2026-122013

    Comfast CF-WR632AX Multipart webmgnt path traversal

    Comfast · CF-WR632AX

    Critical10.0

Vendors with the most CVEs

  1. Google354
  2. IBM322
  3. Apache Software Foundation98
  4. JetBrains89
  5. Linux61
  6. openemr60
  7. Hewlett Packard Enterprise (HPE)56
  8. MediaTek, Inc.56
  9. Red Hat51
  10. FreeRDP42

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)286
  2. CWE-862 Missing authorization249
  3. CWE-639 Authorization bypass through a user-controlled key (IDOR)160
  4. CWE-918 Server-side request forgery (SSRF)133
  5. CWE-863 Incorrect authorization127
  6. CWE-22 Path traversal125
  7. CWE-89 SQL injection103
  8. CWE-787 Out-of-bounds write97
  9. CWE-416 Use after free91
  10. CWE-200 Exposure of sensitive information89