KEV digest · 27–29 Oct 2026
In the window 27–29 Oct 2026, CISA added 6 vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog — each one has reliable evidence of exploitation in the wild. The additions span 6 different vendors. US federal agencies must remediate them by 31 Oct 2026 – 11 Nov 2026; treat that as the ceiling, not the target.
CISA required action (every entry): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Google · Brotli
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
added 2026-10-27 · federal due date 2026-11-10
Adobe · Commerce and Magento
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
added 2026-10-27 · federal due date 2026-11-10
GitLab · Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
added 2026-10-29 · federal due date 2026-11-01
Linux · Kernel
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
added 2026-10-28 · federal due date 2026-10-31
Broadcom · VMware ESX
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
added 2026-10-28 · federal due date 2026-11-11
Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
added 2026-10-29 · federal due date 2026-11-01
The catalog now holds 1,764 entries. 35 were added in the last 30 days, down from 44 in the 30 days before. Year to date, 280 additions in 2026 against 212 by the same date in 2025. For scale: 1,780 new CVEs were published in the same window. 6 confirmed-exploited additions is about 1 in 297 — which is why patching by severity alone does not scale.
Run your own vendors and products through stack check — it is pre-filled with this digest's vendors and also gives you an RSS feed for future additions. The long-run picture is on CVE Trends.
How this is made: generated automatically every few days from the CISA KEV catalog and FIRST EPSS scores (probability of exploitation in the next 30 days, as of publication). Descriptions and required actions are CISA's own wording. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire KEV and EPSS into your scanner, SIEM and ticketing, so only the exploited CVEs you actually run reach your team — with deadlines an auditor will accept.
Get in touch →