Actively exploited this week: 10 new CISA KEV entries (26 October to 1 November 2026)
Every week CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The bar for getting on that list is not "severe on paper" but "attackers are using it now". For a small team with limited patch
Every week CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The bar for getting on that list is not "severe on paper" but "attackers are using it now". For a small team with limited patching hours, that makes KEV the most useful priority list there is.
Below: every entry added between 26 October and 1 November 2026, copied from the catalogue and linked to its NVD record, plus what Romania's national cyber security directorate and Have I Been Pwned published in the same days. Nothing is estimated or rewritten.
The 10 actively exploited vulnerabilities added this week
| Added | Product | CVE | Known ransomware use |
|---|---|---|---|
| 30 Oct | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | CVE-2026-118527 | not known |
| 30 Oct | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | CVE-2026-111357 | not known |
| 29 Oct | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | CVE-2026-97229 | not known |
| 29 Oct | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | CVE-2026-76418 | not known |
| 28 Oct | Linux Kernel Missing Initialization of a Variable Vulnerability | CVE-2026-46300 | not known |
| 28 Oct | Broadcom VMWare ESX Insufficient Logging Vulnerability | CVE-2026-41709 | not known |
| 27 Oct | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | CVE-2026-48356 | not known |
| 27 Oct | Google Brotli Unchecked Return Value Vulnerability | CVE-2026-111497 | not known |
| 26 Oct | PHP Group PHP: PHP Stale Internal Request-State Vulnerability | CVE-2026-109619 | not known |
| 26 Oct | PHP Group PHP: PHP Memory Corruption Vulnerability | CVE-2026-109618 | not known |
Breaches added to Have I Been Pwned
- AfD: 345,439 accounts, added 27 October. Check the breach page
If your team's work addresses may be in one of these, check the breach page and the password reuse question, not only the address.
How to use a list like this in an hour
- Start with what faces the internet. VPN and access gateways, firewalls, routers, mail servers and public web platforms are how many ransomware incidents start.
- Search your inventory by product name, not by memory. "We don't run that" is a claim, and the asset list is the evidence.
- Patch or apply the vendor mitigation, then confirm the version. A patch that was downloaded but not applied reads as done in a ticket and is still exploitable.
- If you cannot patch today, reduce exposure: restrict the management interface to known addresses, disable the affected feature, or put the service behind an access gateway you trust.
Where this comes from
A small collector reads official sources every hour: DNSC, CERT-EU, CERT-FR (ANSSI), CERT-Bund (BSI), the UK NCSC, CISA KEV, Have I Been Pwned and three specialist newsrooms. It copies each item exactly, with its source link, and publishes the result on one page:
https://devaland.cloud/alerte-live.html (in Romanian, with every title kept in its original language).
Nothing on that page or in this post is written by a model. A security page that paraphrases an advisory wrongly does more harm than no page at all.
Sources: CISA KEV catalogue (dateAdded 2026-10-26 to 2026-11-01), DNSC alerts, Have I Been Pwned. Generated from the sources on 2026-11-02.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.