Vulnerability intelligence · Curated
Sourced timelines, exploitation status and detection guidance for actively exploited CVEs. Written by a SOC analyst, updated as the situation moves.
● CISA KEV synced 2026-11-11 05:10 UTCEPSS 2026-11-1014 dossiers · 14 active
| CVE | Product | Added to KEV | Status | Dossier |
|---|---|---|---|---|
| CVE-2026-20320 | Cisco BroadWorks | 2026-11-10 | Active exploitation | Planned |
| CVE-2026-125350 | Google Chromium | 2026-11-10 | Active exploitation | Planned |
| CVE-2026-124194 | Microsoft Office | 2026-11-10 | Active exploitation | Planned |
| CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG) | 2026-11-10 | Active exploitation | Planned |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder | 2026-11-10 | Active exploitation | Planned |
| CVE-2026-111560 | Barracuda Networks Multiple Products | 2026-11-10 | Active exploitation | Planned |
| CVE-2026-123218 | IBM Aspera Faspex | 2026-11-09 | Active exploitation | Planned |
| CVE-2026-123158 | OpenBSD OpenSSH | 2026-11-09 | Active exploitation | Planned |
| CVE-2026-116779 | SignalWire FreeSwitch | 2026-11-09 | Active exploitation | Planned |
| CVE-2026-102895 | GPUStack | 2026-11-09 | Active exploitation | Planned |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | 2026-11-06 | Active exploitation | Read → |
Unauthenticated crafted SSL VPN request reloads Cisco ASA/FTD when secondary authentication is set on a tunnel group; exploited since 2026-10.
Updated 2026-11-11
SonicOS SSLVPN flaw lets users with alternate-method credentials bypass SAML and SAML-enforced MFA; exploited, fixed in 7.3.4-7013 / 8.2.3-8015.
Updated 2026-11-11
A time-of-check time-of-use race condition in the WordPress Core updater lets an unauthenticated attacker execute code while a full core upgrade is running.
Updated 2026-11-11
Unauthenticated file operations on BeyondTrust Remote Support up to 26.2.3, exploited since 2026-08 by suspected PRC-nexus actor ARMORY CASTLE.
Updated 2026-11-11
Unauthenticated OS command injection in the Nextcloud Built-in CODE Server app, exploited since 2026-09-10 to drop PHP web shells.
Updated 2026-11-11
Linux kernel LPE in the XFRM ESP-in-TCP path lets local users write into the page cache; exploited with PHP2Shell to root PAN-OS firewalls.
Updated 2026-11-11
01 · Curated
A dossier is written only for vulnerabilities with confirmed or highly likely exploitation. Everything else stays a lightweight lookup.
02 · Sourced
Timelines and claims cite their primary source, so you can verify each statement and see when it was true.
03 · Detection-first
Each dossier focuses on what defenders can do now: hunting queries, exposure checks and concrete mitigation.