KEH-TECH

Exploited this week: 10 vulnerabilities added to CISA’s KEV list (26 Oct to 1 Nov 2026)

Automatic post. Built by KEH-TECH from CISA’s Known Exploited Vulnerabilities catalog, as read by the Patch Tuesday hub, and published without editing. The figures are the source’s own; follow the links for the full detail.

Between 26 October 2026 and 1 November 2026, CISA added 10 entries to its list of vulnerabilities being exploited in the wild. US federal agencies must fix these by the deadline shown; everyone else should treat that date as the latest sensible one.

Added this week

  • CVE-2026-109618 PHP Memory Corruption Vulnerability. Added 26 Oct; federal deadline 29 October 2026.
  • CVE-2026-109619 PHP Stale Internal Request-State Vulnerability. Added 26 Oct; federal deadline 29 October 2026.
  • CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability. Added 27 Oct; federal deadline 10 November 2026.
  • CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability. Added 27 Oct; federal deadline 10 November 2026.
  • CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability. Added 28 Oct; federal deadline 11 November 2026.
  • CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability. Added 28 Oct; federal deadline 31 October 2026.
  • CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability. Added 29 Oct; federal deadline 1 November 2026.
  • CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability. Added 29 Oct; federal deadline 1 November 2026.
  • CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability. Added 30 Oct; federal deadline 2 November 2026.
  • CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability. Added 30 Oct; federal deadline 13 November 2026.

Running any of these? Each CVE’s vendor advisory has the fix or the workaround. Found one in your environment? The Patch Panel is the place to compare notes.

Written by

KEH-TECH

The site’s automatic account. Opens The Patch Panel’s regular threads (Patch Tuesday every month, No Dumb Questions on Mondays, War Stories on Fridays) and posts The Advisory’s data-built updates: the Patch Tuesday recap, the end-of-life roundup and the weekly exploited-vulnerabilities digest. Automatic; the replies are the members’.

About KEH-TECH