Vulnerabilities
Security flaws that matter: what is affected, whether attacks are happening and what to patch first.
VULNERABILITY · HIGH
Cisco BroadWorks flaw exposes sensitive files; exploited in the wild
An XML external entity flaw in Cisco BroadWorks lets remote attackers read configuration data without logging in. CISA lists it as actively exploited, and a fix is available.
VULNERABILITY · MEDIUM
Microsoft Office Outlook flaw enables spoofing; exploited in the wild
A spoofing weakness in Microsoft Office Outlook is under active attack, according to CISA. Microsoft has released a fix, and US federal agencies have until 2026-11-24 to address it.
VULNERABILITY · HIGH
Ivanti Connect Secure flaw allows root privilege escalation; exploited in the wild
A privilege escalation flaw in Ivanti Connect Secure can let an attacker gain root access. CISA lists it as actively exploited, and a patch is reported to be available.
VULNERABILITY · CRITICAL
PHP flaw allows remote code execution; exploited in the wild
A critical memory-handling flaw in PHP, tracked as CVE-2026-109619, can let remote attackers run code on affected servers. CISA lists it as actively exploited, and a fix is available.
VULNERABILITY · CRITICAL
PHP memory flaw allows remote code execution; exploited in the wild
A memory-handling flaw in PHP that can lead to remote code execution is being actively exploited, according to CISA. The PHP Group has released fixes, and Cisco and Fortinet have published advisories for their own products.
PATCH TUESDAY
Microsoft Patch Tuesday, November 2026: Exploited Outlook spoofing flaw
Microsoft's November 2026 release fixes 1094 vulnerabilities, 63 of them rated critical. Microsoft lists one, an Outlook spoofing vulnerability (CVE-2026-124194), as exploited, and it should be patched first.
VULNERABILITY · CRITICAL
GitLab CE and EE flaw allows remote code execution; exploited in the wild
A critical flaw in GitLab Community Edition and Enterprise Edition can let an attacker without an account run code on the server. It is being actively exploited, CISA has added it to its KEV catalog, and fixed releases are available.
VULNERABILITY · HIGH
SonicWall SonicOS SSLVPN flaw bypasses SAML login and MFA; exploited in the wild
A flaw in the SSLVPN service of SonicWall SonicOS can let someone holding valid credentials for another login method get around SAML authentication and SAML-enforced MFA. It is being exploited, and fixed releases are available.
VULNERABILITY · CRITICAL
Atlassian Data Center flaw exposes server files; exploited in the wild
A critical file access flaw in several Atlassian self-managed products, including Jira, Confluence and Bitbucket, lets unauthenticated attackers read certain files. It is being actively exploited, and fixed versions are available.
VULNERABILITY · CRITICAL
BeyondTrust Remote Support flaw allows file operations; exploited in the wild
A critical authentication bypass in BeyondTrust Remote Support lets attackers carry out file operations on the appliance. CISA lists the flaw as actively exploited, and a fixed version is not confirmed in the data available to us.