Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 26 October to 1 November 2026 (week 44)
Final report, published . It does not change.
In the week of 26 October to 1 November 2026, 10 vulnerabilities were newly recorded as exploited in the wild, 10 of them critical. The technology hit most was Amazon AWS (3), followed by Google Cloud Platform (2) and Ivanti Connect Secure (2).
- Newly exploited
- 10
- Critical
- 10
- Technologies hit
- 15
Newly exploited this week
- CVE-2026-118527: Ivanti Connect Secure predictable identifier generationcriticalExploited since Published Ivanti Connect Secure
- CVE-2026-111357: Ivanti Connect Secure privilege escalation via DSCache configurationcriticalCVSS 7Exploited since Published Ivanti Connect Secure
- CVE-2026-76418: Cisco Secure Firewall ASA and FTD SSL VPN denial of servicecriticalCVSS 8.6Exploited since Published Cisco Secure Ftd Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Adaptive Security Appliance Software
- CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compilercriticalCVSS 10Exploited since Published GitLab Community Edition, GitLab Enterprise Edition, GitLab
- CVE-2026-46300: Linux Kernel out-of-bounds write in skbuff coalescingcriticalCVSS 7.8Exploited since Published Amazon AWS, Google Cloud Platform, Linux Kernel
- CVE-2026-41709: VMware ESX insufficient logging vulnerabilitycriticalCVSS 2.7Exploited since Published VMware Cloud Foundation, VMware ESX, VMware ESXi
- CVE-2026-111497: Google Brotli buffer overflow in decodercriticalCVSS 4Exploited since Published Amazon AWS, Google Brotli, Node.js
- CVE-2026-48356: Adobe Commerce unrestricted file upload in multiple componentscriticalCVSS 9.6Exploited since Published Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Webhooks Plugin
- CVE-2026-109619: PHP use-after-free in global state handlingcriticalExploited since Published PHP Group PHP
- CVE-2026-109618: PHP Memory Corruption VulnerabilitycriticalExploited since Published Amazon AWS, Google Cloud Platform, PHP Group PHP
Technologies hit most
- 1.Amazon AWS3 vulnerabilities
- 2.Google Cloud Platform2 vulnerabilities
- 3.Ivanti Connect Secure2 vulnerabilities
- 4.PHP Group PHP2 vulnerabilities
- 5.Adobe Commerce1 vulnerability
- 6.Adobe Commerce B2B1 vulnerability
- 7.Adobe Commerce Webhooks Plugin1 vulnerability
- 8.Adobe Magento1 vulnerability
- 9.Adobe Magento Enterprise Edition1 vulnerability
- 10.Adobe Magento Open Source1 vulnerability
- 11.Broadcom Vmware Esx1 vulnerability
- 12.brotli (PyPI)1 vulnerability
- 13.brotlicffi (PyPI)1 vulnerability
- 14.Cisco Adaptive Security Appliance Software1 vulnerability
- 15.Cisco Secure Firewall Adaptive Security Appliance (ASA) Software1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-10-26.json, and this page as text at https://junglewise.ai/threats/exploited/2026-10-26.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 26 October to 1 November 2026 (week 44)", https://junglewise.ai/threats/exploited/2026-10-26, 3 November 2026.