Act-now radar · 13 Nov 2026
11 vulnerabilities were confirmed exploited in the last 7 days. They're ranked by what makes them urgent: ransomware use, internet-facing products, short deadlines and severity. Check the top of this list against what you run first, or let stack check email you when it matters.
| CVE | Product and why | Added |
|---|---|---|
| CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG)EDGE Internet-facing product, a common way in; CISA set a 3-day deadline; critical (CVSS 9.3). | |
| CVE-2026-102895 | GPUStack CISA set a 3-day deadline; critical (CVSS 9.8). | |
| CVE-2026-116779 | SignalWire FreeSwitch CISA set a 3-day deadline; critical (CVSS 9.8). | |
| CVE-2026-123218 | IBM Aspera Faspex CISA set a 3-day deadline; critical (CVSS 9.8). | |
| CVE-2026-19868 | SonicWall SonicOS SSLVPNEDGE Internet-facing product, a common way in. | |
| CVE-2026-111560 | Barracuda Networks Multiple Products CISA set a 3-day deadline. | |
| CVE-2026-123158 | OpenBSD OpenSSH CISA set a 3-day deadline. | |
| CVE-2026-124194 | Microsoft Office Confirmed exploited in the wild. | |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder Confirmed exploited in the wild. | |
| CVE-2026-20320 | Cisco BroadWorks Confirmed exploited in the wild. | |
| CVE-2026-125350 | Google Chromium Confirmed exploited in the wild. |
Firewalls, VPNs and file-transfer servers are the most common way in. 8 entries in the last 30 days:
Recent CVEs whose EPSS score rose most in the last day. Not confirmed exploited, but worth checking before they are.
| CVE-2026-61511 | vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php EPSS 5.6% → 74.3% in a day (top 0.5%) |
| CVE-2026-25939 | FUXA Unauthenticated Remote Arbitrary Scheduler Write EPSS 12.5% → 24.3% in a day (top 2.1%) |
| CVE-2026-12507 | Authenticated remote code execution EPSS 0.0% → 9.4% in a day (top 4.5%) |
| CVE-2026-7482 | Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers EPSS 2.2% → 7.1% in a day (top 5.7%) |
| CVE-2025-59528 | Flowise has Remote Code Execution vulnerability EPSS 87.0% → 91.7% in a day (top 0.2%) |
| CVE-2025-7340 | HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload EPSS 1.8% → 6.0% in a day (top 6.6%) |
| CVE-2025-25231 | Omnissa Omnissa Workspace ONE UEM EPSS 25.1% → 29.1% in a day (top 1.8%) |
| CVE-2026-59726 | Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment EPSS 3.0% → 6.2% in a day (top 6.3%) |
| CVE-2025-1025 | n/a cockpit-hq/cockpit EPSS 18.9% → 21.2% in a day (top 2.4%) |
Since 10 Nov 2026 we log every recent CVE (published this year or last, not in KEV) on the day its EPSS score first passes 10%. 1 new flag so far (749 were already above 10% on day one and don't count). 0 of the new flags have been added to KEV so far; lead times are published once there are at least five.
How this is made: CISA KEV for confirmed exploitation, FIRST EPSS for predicted likelihood, the official CVE list for publication dates and severity. "Edge" marks firewalls, VPN gateways, remote-access and file-transfer products. Look up any CVE at gociux.com/cve; compare vendors on the scorecards.
We connect KEV, EPSS and your asset inventory so the radar only shows what you run, with tickets and deadlines.
Get in touch →