Log in Start free

Today's exploited vulnerabilities · Saturday, November 7, 2026 · Updated continuously from CISA, the CVE Program, OSV and EPSS

Current threat level

Elevated

In the last 7 days, 3 vulnerabilities were confirmed as actively exploited, and 0 new critical flaws already show high exploit odds. 2276 new CVEs were published.

See which of these affect your machines →

Newly exploited this week

  1. CVE-2026-19868 SonicWall SonicOS SSLVPN SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability Nov 6, 2026 High 7.5
  2. CVE-2024-27834 Apple Multiple Products Apple Multiple Products Improper Authentication Vulnerability Nov 4, 2026 Medium 5.5
  3. CVE-2026-119977 WordPress WordPress Core WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability Nov 3, 2026 High 8.1
Full exploited tracker (1769) →

Trending by exploit odds

Largest rises in the EPSS 30-day exploitation probability over the past week.

  • Trend data appears after a few daily updates.

Recent critical CVEs

Published in the last 7 days, ordered by exploit odds.

  • CVE-2026-120276 Critical 10.0 WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection 3.2%
  • CVE-2026-120229 Critical 9.1 WAVLINK WN553X1-B ioos sub_416B50 os command injection 2.8%
  • CVE-2026-121931 Critical 9.1 Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection 2.7%
  • CVE-2026-121930 Critical 9.1 Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection 2.7%
  • CVE-2026-122051 Critical 10.0 Edimax BR-6208AC mp command injection 2.6%
  • CVE-2026-120277 Critical 10.0 WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection 2.5%
  • CVE-2026-121932 Critical 10.0 Linksys E5350 apply.cgi system os command injection 2.4%
  • CVE-2026-120201 Critical 9.8 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header 2.2%
1769vulnerabilities known to be exploited
35added in the last 30 days
361used by ransomware gangs
285added this year

Weekly brief · 2026-W45

iPatch weekly threat brief - 2026-W45

Threat level this week: Elevated. 5 vulnerabilities were added to CISA's exploited list in the last 7 days (0 linked to ransomware).

Exploited this week

  • CVE-2026-19868: SonicWall SonicOS SSLVPN - SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
  • CVE-2024-27834: Apple Multiple Products - Apple Multiple Products Improper Authentication Vulnerability
  • CVE-2026-119977: WordPress WordPress Core - WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
  • CVE-2026-118527: Ivanti Connect Secure - Ivanti Connect Secure Generation of
Read the brief →

Don't read every advisory. Know which ones hit you.

iPatch's read-only agent inventories your servers and laptops, matches every package against these feeds within the hour, and ranks what to fix first.

Start free How it works