CVE Security Watch

Vulnerability advisories

Public summaries of newly disclosed and actively exploited vulnerabilities, with CVE IDs, severity, exploitation status, and fixed versions checked against official sources. Published up to twice a day, Monday to Saturday. RSS feed.

October 30, 2026 at 8:55 PM EDT
node-forge 1.4.1 fixes five high-severity flaws; follow-redirects CVE-2026-116689
GitHub published five high-severity node-forge advisories (TLS and PEM denial of service, X.509 basicConstraints bypass, PKCS#12 MAC forgery), all fixed in 1.4.1, plus a follow-redirects credential-leak fix in 1.16.2. None are known to be exploited.
high
October 30, 2026 at 8:55 AM EDT
Attackers target the WordPress core update race condition fixed in 7.1.4
Wordfence logged over 18,500 attempts in 21 hours against the temporary installer files WordPress unpacks during core updates. Update to 7.1.4 and deny web access to /wp-content/upgrade/.
highactively-targeted
October 29, 2026 at 8:55 PM EDT
decode-uri-component can stall Node.js servers (CVE-2026-118664)
A single request of about 224 KB with malformed URL encoding can freeze a Node.js server for around 20 seconds through the decode-uri-component npm package. Fixed in 0.5.1.
high
October 29, 2026 at 8:55 AM EDT
Linux kernel IPv4 TCP use-after-free (CVE-2026-98432)
A Linux kernel IPv4 TCP use-after-free carries a 9.8 network score from a secondary scorer while NVD analysis is pending. It is not known to be exploited; patched kernels are available for Amazon Linux 2023 and Debian 12.
criticalpending-analysis
October 28, 2026 at 8:55 PM EDT
Linux kernel "Fragnesia" exploited alongside PHP2Shell; WordPress 7.1.4 security release
CISA added the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to its exploited list; attackers are chaining it with PHP2Shell web shells to get root. WordPress 7.1.4 fixes an upgrade-time RCE and several XSS bugs.
highkev
October 27, 2026 at 8:55 PM EDT
Brotli bug now exploited in the wild; new undici and pymongo fixes
CISA added the critical Brotli flaw CVE-2026-111497 to its exploited list with a November 10 deadline. undici also shipped fixes for four high-severity bugs, and pymongo fixed a buffer over-read.
criticalkevhigh
October 26, 2026 at 8:55 PM EDT
PHP2Shell added to CISA's Known Exploited Vulnerabilities catalog
CISA confirmed in-the-wild exploitation of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a critical unauthenticated remote code execution flaw in PHP. Patch, then check for signs of compromise.
criticalkev
October 26, 2026 at 8:55 AM EDT
eMudhra CA keys removed from AWS trust bundles (CVE-2026-111943)
Private keys for some eMudhra/emSign intermediate certificates could be recovered, so AWS is removing those roots from its trust stores. Customers should update ca-certificates and bundled boto3/botocore.
important
October 24, 2026 at 8:55 AM EDT
"Node2Shell" is a Brotli library bug: CVE-2026-111497 reaches beyond Node.js
The critical Node2Shell bug is in Google's Brotli compression library itself (1.0.3 to 1.2.0), so any software that decompresses untrusted Brotli data with a vulnerable copy is exposed, including Python.
critical
October 23, 2026 at 8:55 PM EDT
Denial-of-service fixes in body-parser and undici
Two high-severity Node.js package bugs can crash a process: body-parser with a single compressed request under default settings, and undici when fetching from a malicious server.
high
October 23, 2026 at 8:55 AM EDT
PHP session upload progress RCE path, Sentry Next.js SDK bypass, Amazon Linux 2 log4j hotpatch
An informational PHP advisory describes a narrow remote code execution path through session upload progress; Sentry's Next.js SDK has a critical middleware bypass; and a local root bug affects Amazon Linux 2's log4j hotpatch package.
criticalunscored
October 22, 2026 at 8:55 PM EDT
MariaDB privilege escalation (CVE-2026-107823)
A high-severity MariaDB flaw lets an account that can already create users and views grant itself more privileges. Fixed releases are available on every supported branch.
high

These advisories are general information, not a substitute for your vendors’ guidance. Always confirm fixed versions in the linked official advisory before patching.