CVE watch_
AI-related flaws we have covered, exploited ones first.
| CVE | Affected | CVSS | Exploited | Patch | Type |
|---|---|---|---|---|---|
| CVE-2026-125883 | N-central Appliance 2026.4.0.31, a pre-release build, was the version attacks were validated against; most or all vulnerabilities should work on previous versions. | not assigned | Exploited | N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, as a critical security release. Hosted N-central was taken offline while remediation was implemented, and on-premises deployments should remain offline until patches are released or N-able confirms they can be safely restored. | Vulns & Patches |
| CVE-2026-125878 | N-central Appliance 2026.4.0.31, a pre-release build, was the version attacks were validated against; most or all vulnerabilities should work on previous versions. | not assigned | Exploited | N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, as a critical security release. Hosted N-central was taken offline while remediation was implemented, and on-premises deployments should remain offline until patches are released or N-able confirms they can be safely restored. | Vulns & Patches |
| CVE-2026-125879 | N-central Appliance 2026.4.0.31, a pre-release build, was the version attacks were validated against; most or all vulnerabilities should work on previous versions. | not assigned | Exploited | N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, as a critical security release. Hosted N-central was taken offline while remediation was implemented, and on-premises deployments should remain offline until patches are released or N-able confirms they can be safely restored. | Vulns & Patches |
| CVE-2026-125880 | N-central Appliance 2026.4.0.31, a pre-release build, was the version attacks were validated against; most or all vulnerabilities should work on previous versions. | not assigned | Exploited | N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, as a critical security release. Hosted N-central was taken offline while remediation was implemented, and on-premises deployments should remain offline until patches are released or N-able confirms they can be safely restored. | Vulns & Patches |
| CVE-2026-125881 | N-central Appliance 2026.4.0.31, a pre-release build, was the version attacks were validated against; most or all vulnerabilities should work on previous versions. | not assigned | Exploited | N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, as a critical security release. Hosted N-central was taken offline while remediation was implemented, and on-premises deployments should remain offline until patches are released or N-able confirms they can be safely restored. | Vulns & Patches |
| CVE-2026-125882 | N-central Appliance 2026.4.0.31, a pre-release build, was the version attacks were validated against; most or all vulnerabilities should work on previous versions. | not assigned | Exploited | N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, as a critical security release. Hosted N-central was taken offline while remediation was implemented, and on-premises deployments should remain offline until patches are released or N-able confirms they can be safely restored. | Vulns & Patches |
| CVE-2026-91000 | N-central Appliance 2026.4.0.31, a pre-release build, was the version attacks were validated against; most or all vulnerabilities should work on previous versions. | not assigned | Exploited | N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, as a critical security release. Hosted N-central was taken offline while remediation was implemented, and on-premises deployments should remain offline until patches are released or N-able confirms they can be safely restored. | Vulns & Patches |
| CVE-2026-105133 | AhsayCBS servers affected by CVE-2026-105133 and CVE-2026-105134, including systems used to hold or manage backups. | not assigned | Exploited | Ahsay released hotfix 10.3.4.45 for version 10 and hotfix 9.15.2.70 for versions 7 through 9. Huntress verified that 10.3.4.45 blocks the observed entry point, but patching does not remove files already planted on compromised servers. | Vulns & Patches |
| CVE-2026-105134 | AhsayCBS servers affected by CVE-2026-105133 and CVE-2026-105134, including systems used to hold or manage backups. | not assigned | Exploited | Ahsay released hotfix 10.3.4.45 for version 10 and hotfix 9.15.2.70 for versions 7 through 9. Huntress verified that 10.3.4.45 blocks the observed entry point, but patching does not remove files already planted on compromised servers. | Vulns & Patches |
| CVE-2026-125350 | Chrome users on Android, Linux, macOS and Windows are within the affected update scope. | not assigned | Exploited | Google released fixes in Chrome 157.0.8103.50 for Android and Linux and Chrome 157.0.8103.50/.51 for macOS and Windows. Google is rolling them out gradually over the coming days and weeks. | Vulns & Patches |
| CVE-2026-19868 | Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older, are affected when SAML-based login is enabled for SSL VPN. | 8.8 / 7.1 | Exploited | SonicOS versions 7.3.4-7013 and 8.2.3-8015 resolve the issue. SecurityWeek said no workarounds are available. | Vulns & Patches |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller, Cisco Catalyst SD-WAN Manager and Cisco Catalyst SD-WAN Validator. | 10.0 | Exploited | Cisco first published its advisory on Feb 25, 2026, and updated it on Oct 28, 2026. It said no workaround addresses the vulnerability. | Vulns & Patches |
| CVE-2025-8875 | Versa Director, N-Central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and, in one likely campaign, Quest KACE were targeted. | 10.0 | Exploited | The Quest KACE campaign declined after Quest’s October 2025 security updates. Lumen said Cisco Catalyst SD-WAN exploitation continued after Cisco disclosed the vulnerability in February 2026. | Vulns & Patches |
| CVE-2025-8876 | Versa Director, N-Central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and, in one likely campaign, Quest KACE were targeted. | 10.0 | Exploited | The Quest KACE campaign declined after Quest’s October 2025 security updates. Lumen said Cisco Catalyst SD-WAN exploitation continued after Cisco disclosed the vulnerability in February 2026. | Vulns & Patches |
| CVE-2026-20127 | Versa Director, N-Central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and, in one likely campaign, Quest KACE were targeted. | 10.0 | Exploited | The Quest KACE campaign declined after Quest’s October 2025 security updates. Lumen said Cisco Catalyst SD-WAN exploitation continued after Cisco disclosed the vulnerability in February 2026. | Vulns & Patches |
| CVE-2026-16812 | Versa Director, N-Central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and, in one likely campaign, Quest KACE were targeted. | 10.0 | Exploited | The Quest KACE campaign declined after Quest’s October 2025 security updates. Lumen said Cisco Catalyst SD-WAN exploitation continued after Cisco disclosed the vulnerability in February 2026. | Vulns & Patches |
| CVE-2026-109618 | PHP deployments running vulnerable versions, including websites built on WordPress, Drupal and Joomla. | not assigned | Exploited | Recorded Future said PHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Oct 21. | Vulns & Patches |
| CVE-2026-109619 | PHP deployments running vulnerable versions, including websites built on WordPress, Drupal and Joomla. | not assigned | Exploited | Recorded Future said PHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Oct 21. | Vulns & Patches |
| CVE-2026-109618 | All PHP installations serving web requests are affected, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. | 10.0 / 9.2 | Exploited | PHP shipped fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. | Vulns & Patches |
| CVE-2026-109619 | All PHP installations serving web requests are affected, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. | 10.0 / 9.2 | Exploited | PHP shipped fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. | Vulns & Patches |
| CVE-2026-109618 | PHP versions in the PHP 8.x line are affected by the two remote code execution vulnerabilities. Wiz Research said versions released during the previous decade, going back to PHP 5.4, are affected by at least one of them. | 10.0 / 9.2 | Exploited | PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz Research said applying the PHP security update remains the only complete remediation. | Vulns & Patches |
| CVE-2026-109619 | PHP versions in the PHP 8.x line are affected by the two remote code execution vulnerabilities. Wiz Research said versions released during the previous decade, going back to PHP 5.4, are affected by at least one of them. | 10.0 / 9.2 | Exploited | PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz Research said applying the PHP security update remains the only complete remediation. | Vulns & Patches |
| CVE-2026-106173 | FortiSIEM deployments exposed to the gRPC service on TCP port 27918 are affected. FortiSIEM Cloud is not affected. | 9.4 | Exploited | The Hacker News said Fortinet released patches for FortiSIEM 7.5.0, requiring an upgrade to 7.5.1 or above. Fortinet also recommends restricting access to TCP port 27918 as a workaround. | Vulns & Patches |
| CVE-2026-110936 | Siemens Software Center installations affected by CVE-2026-110936. | 8.4 | Exploited | Siemens fixed the weakness in Software Center version 4.0.9.8. Existing installations update automatically the next time they start. | Vulns & Patches |
| CVE-2026-88771 | Citrix NetScaler ADC and Gateway deployments, including edge-facing deployments, were affected by the disclosed vulnerabilities. The reported exploited flaws include CVE-2026-88771 and CVE-2026-88772. | 9.5 / 9.3 | No known exploitation | Citrix released patches by Sunday for CVE-2026-88771 through CVE-2026-88778. HKCERT advised users to apply fixes issued by the vendor. | Vulns & Patches |
| CVE-2026-88772 | Citrix NetScaler ADC and Gateway deployments, including edge-facing deployments, were affected by the disclosed vulnerabilities. The reported exploited flaws include CVE-2026-88771 and CVE-2026-88772. | 9.5 / 9.3 | No known exploitation | Citrix released patches by Sunday for CVE-2026-88771 through CVE-2026-88778. HKCERT advised users to apply fixes issued by the vendor. | Vulns & Patches |
| CVE-2026-88778 | Citrix NetScaler ADC and Gateway deployments, including edge-facing deployments, were affected by the disclosed vulnerabilities. The reported exploited flaws include CVE-2026-88771 and CVE-2026-88772. | 9.5 / 9.3 | No known exploitation | Citrix released patches by Sunday for CVE-2026-88771 through CVE-2026-88778. HKCERT advised users to apply fixes issued by the vendor. | Vulns & Patches |
| CVE-2026-126325 | PTC Windchill and FlexPLM, including the versions listed by PTC and the affected versions reported by The Hacker News. | 10.0 / 9.3 / 9.2 | No known exploitation | PTC said a security patch is available. Patches have already been applied for customers whose environments it hosts; administrators of non-PTC-hosted environments need to apply them. | Vulns & Patches |
| CVE-2026-108186 | Zoom Workplace for Windows versions starting at 7.1.0 and before 7.1.8 are affected by the improper input validation flaw. Versions before 7.1.5 are affected by the origin validation flaw. | 9.8 / 9.6 / 8.1 | No known exploitation | Zoom released software updates addressing both flaws and says users should apply the latest available updates. | Vulns & Patches |
| CVE-2026-108187 | Zoom Workplace for Windows versions starting at 7.1.0 and before 7.1.8 are affected by the improper input validation flaw. Versions before 7.1.5 are affected by the origin validation flaw. | 9.8 / 9.6 / 8.1 | No known exploitation | Zoom released software updates addressing both flaws and says users should apply the latest available updates. | Vulns & Patches |
| CVE-2026-124194 | Windows operating systems and supported Microsoft software, including Microsoft Outlook, are affected by the November update release. | not assigned | No known exploitation | Microsoft released updates addressing 1,093 vulnerabilities, including 63 critical flaws and 535 privilege-elevation flaws. | Vulns & Patches |
| CVE-2026-83844 | Windows Paint versions listed as affected below 11.2605.91.0 in the public CVE record. | 8.1 at publication; 7.0 after November 7 | No known exploitation | Paint version 11.2609.401.0 is available through the Microsoft Store or automatic updates, not Windows Update. | Vulns & Patches |
| CVE-2026-91403 | Affected products include Oracle GraalVM Enterprise Edition versions 21.3.20 and 21.3.20.0.2; Oracle GraalVM for JDK versions 17.0.21, 21.0.13, 17.0.21.0.2 and 21.0.13.0.2; and Oracle Java SE versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1. | 9.8 | No known exploitation | Oracle issued a security alert. It said its update for CVE-2026-91403 distrusts impacted intermediate certificate authorities related to eMudhra. HKCERT updated its solutions and related links on Oct 26, 2026. | Vulns & Patches |
| CVE-2026-114820 | Affected products include Oracle GraalVM Enterprise Edition versions 21.3.20 and 21.3.20.0.2; Oracle GraalVM for JDK versions 17.0.21, 21.0.13, 17.0.21.0.2 and 21.0.13.0.2; and Oracle Java SE versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1. | 9.8 | No known exploitation | Oracle issued a security alert. It said its update for CVE-2026-91403 distrusts impacted intermediate certificate authorities related to eMudhra. HKCERT updated its solutions and related links on Oct 26, 2026. | Vulns & Patches |
| CVE-2026-107441 | Zyxel GS1900 series switches running Patch 2 or earlier firmware; new firmware covers 10 GS1900 models. | 9.8 / 8.8 | No known exploitation | Zyxel released 2.90 Patch 3 firmware on Oct 23. The Patch 3 build for each model is needed for switches on Patch 2 or earlier firmware. | Vulns & Patches |
| CVE-2026-111497 | GPT-6 Cyber users, initially selected approved Daybreak Red customers using the API and Codex. | 5.6 | No known exploitation | OpenAI said it used the findings to patch software, tighten network restrictions, and report issues to maintainers and vendors. | Vulns & Patches |
| CVE-2026-58868 | Android versions 14 through 17 are affected by CVE-2026-58868. Android 12 and 13 are not listed as affected, but Google’s records do not say whether they contain the flaw. | not assigned | No known exploitation | Android security patch levels dated 2026-11-05 or later address all November bulletin issues. A 2026-11-01 or later security patch level covers CVE-2026-58868, with delivery subject to phone-maker and carrier schedules. | Vulns & Patches |
| CVE-2026-111585 | TeamViewer Full Client on Windows, Linux and macOS, Windows Portable, and the Android Remote Control app in versions before 15.83. | 8.8 | No known exploitation | TeamViewer released a fix in version 15.83 on Oct 27 and recommends updating to version 15.83 or the latest available version. | Vulns & Patches |
| CVE-2026-58882 | Android devices with vulnerable code dating back to Android 12, including Android 12 and 13 phones without ongoing security support. | not assigned | No known exploitation | Blaszczyk said Google included the fix in October security updates for Android versions 14 through 17. | Vulns & Patches |
| CVE-2026-98432 | Ubuntu, Red Hat Enterprise Linux and other Linux distributions, including Linux servers with a multipath TCP listener. | 9.8 / 8.1 / 5.9 | No known exploitation | The Hacker News said the Linux fix is included in versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. It said Ubuntu and RHEL had not released a fixed kernel as of Oct 29. | Vulns & Patches |
| CVE-2026-89078 | Applications that compile regular expressions from attacker-controlled strings, including GitLab servers using affected Ruby versions. | 10.0 / 9.9 | No known exploitation | Ruby 4.0.9, 3.4.12 and 3.3.13 contain all four fixes. Ruby recommends upgrading to one of those versions or later. | Vulns & Patches |
| CVE-2026-93577 | Applications that compile regular expressions from attacker-controlled strings, including GitLab servers using affected Ruby versions. | 10.0 / 9.9 | No known exploitation | Ruby 4.0.9, 3.4.12 and 3.3.13 contain all four fixes. Ruby recommends upgrading to one of those versions or later. | Vulns & Patches |
| CVE-2026-97229 | Applications that compile regular expressions from attacker-controlled strings, including GitLab servers using affected Ruby versions. | 10.0 / 9.9 | No known exploitation | Ruby 4.0.9, 3.4.12 and 3.3.13 contain all four fixes. Ruby recommends upgrading to one of those versions or later. | Vulns & Patches |
| CVE-2026-110264 | Applications that compile regular expressions from attacker-controlled strings, including GitLab servers using affected Ruby versions. | 10.0 / 9.9 | No known exploitation | Ruby 4.0.9, 3.4.12 and 3.3.13 contain all four fixes. Ruby recommends upgrading to one of those versions or later. | Vulns & Patches |
| CVE-2026-104351 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-104353 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-105780 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-105489 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-105781 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-104350 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-104354 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-105779 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-48360 | Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux, plus Adobe Connect Desktop and Mobile for Windows, macOS and Android. | 9.9 / 9.8 / 9.6 / 9.3 / 9.1 | No known exploitation | The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403. It listed Connect fixes for Windows Desktop 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170 and Android 4.5. | Vulns & Patches |
| CVE-2026-33096 | Chrome, Safari, Android, Windows and Linux were affected by flaws found by Anthropic’s unreleased AI model. | 9.8 | No known exploitation | Anthropic said it reported every flaw to the relevant vendor first and that all the flaws were already patched. | Vulns & Patches |
| CVE-2026-98432 | Chrome, Safari, Android, Windows and Linux were affected by flaws found by Anthropic’s unreleased AI model. | 9.8 | No known exploitation | Anthropic said it reported every flaw to the relevant vendor first and that all the flaws were already patched. | Vulns & Patches |
| CVE-2026-109618 | PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. | not assigned | No known exploitation | CISA told organizations to update PHP to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Organizations unable to update, or using unsupported PHP 8.1 or earlier, should take PHP-based systems offline until they can be patched or updated. | Vulns & Patches |
| CVE-2026-109619 | PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. | not assigned | No known exploitation | CISA told organizations to update PHP to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Organizations unable to update, or using unsupported PHP 8.1 or earlier, should take PHP-based systems offline until they can be patched or updated. | Vulns & Patches |
| CVE-2026-111594 | InterSystems IRIS for Health versions 2026.2.0.221, 2026.1.0.235 and 2025.3.0.226 are affected. CISA identified healthcare and public health as affected critical infrastructure sectors, with the product deployed worldwide. | not assigned | No known exploitation | InterSystems recommends configuring the IRIS superserver to require SSL/TLS, according to CISA. | Vulns & Patches |
| CVE-2026-111862 | Rank Math PRO v3.0.123 installations downloaded or updated between Oct 15, 2026, at 20:02 UTC and Oct 16, 2026, at 07:12 UTC. Rank Math PRO users were affected; the free WordPress.org version was not. | 9.8 | No known exploitation | Rank Math removed the affected files and released clean Rank Math PRO v3.0.124. Deactivating the affected plugin alone is insufficient for recovery. | AI Supply Chain |
| CVE-2026-111497 | Node.js 22.x, 24.x and 26.x are affected. The vulnerability can be reached when an application decompresses attacker-controlled Brotli data. | 8.1 | No known exploitation | Fixed versions are Node.js 22.23.4, 24.22.1 and 26.12.1. Running processes retain the vulnerable decoder, so updates require restarting affected services and rebuilding container images on a patched base. | Vulns & Patches |
| CVE-2026-102073 | Siemens APOGEE and TALON products covered by CVE-2026-102073, CVE-2026-102074, CVE-2026-102075 and CVE-2026-102076, plus Desigo PXC and PXM products covered by CVE-2026-89208. | not assigned | No known exploitation | Siemens released new versions for several affected products. CISA listed updates to V3.5.7 or later and V2.8.21 or later for some products, while no fix is planned for others. | Vulns & Patches |
| CVE-2026-102074 | Siemens APOGEE and TALON products covered by CVE-2026-102073, CVE-2026-102074, CVE-2026-102075 and CVE-2026-102076, plus Desigo PXC and PXM products covered by CVE-2026-89208. | not assigned | No known exploitation | Siemens released new versions for several affected products. CISA listed updates to V3.5.7 or later and V2.8.21 or later for some products, while no fix is planned for others. | Vulns & Patches |
| CVE-2026-102075 | Siemens APOGEE and TALON products covered by CVE-2026-102073, CVE-2026-102074, CVE-2026-102075 and CVE-2026-102076, plus Desigo PXC and PXM products covered by CVE-2026-89208. | not assigned | No known exploitation | Siemens released new versions for several affected products. CISA listed updates to V3.5.7 or later and V2.8.21 or later for some products, while no fix is planned for others. | Vulns & Patches |
| CVE-2026-102076 | Siemens APOGEE and TALON products covered by CVE-2026-102073, CVE-2026-102074, CVE-2026-102075 and CVE-2026-102076, plus Desigo PXC and PXM products covered by CVE-2026-89208. | not assigned | No known exploitation | Siemens released new versions for several affected products. CISA listed updates to V3.5.7 or later and V2.8.21 or later for some products, while no fix is planned for others. | Vulns & Patches |
| CVE-2026-89208 | Siemens APOGEE and TALON products covered by CVE-2026-102073, CVE-2026-102074, CVE-2026-102075 and CVE-2026-102076, plus Desigo PXC and PXM products covered by CVE-2026-89208. | not assigned | No known exploitation | Siemens released new versions for several affected products. CISA listed updates to V3.5.7 or later and V2.8.21 or later for some products, while no fix is planned for others. | Vulns & Patches |
| CVE-2026-44414 | Industrial Edge Cloud, Own and Virtual Devices earlier than 1.28.1, SIMATIC IoT2050 Advanced IED and SM IED earlier than 1.28.1.2, and SIMATIC HMI MTP1000 Unified Comfort Panel. | not assigned | No known exploitation | Siemens released new versions for several affected products and listed updating to V1.28.1 or later where a vendor fix exists. It is preparing further fixes and recommends specific mitigations where fixes are not or not yet available. | Vulns & Patches |
| CVE-2026-44415 | Industrial Edge Cloud, Own and Virtual Devices earlier than 1.28.1, SIMATIC IoT2050 Advanced IED and SM IED earlier than 1.28.1.2, and SIMATIC HMI MTP1000 Unified Comfort Panel. | not assigned | No known exploitation | Siemens released new versions for several affected products and listed updating to V1.28.1 or later where a vendor fix exists. It is preparing further fixes and recommends specific mitigations where fixes are not or not yet available. | Vulns & Patches |
| CVE-2026-109618 | PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The flaws affect nearly all PHP releases back to PHP 5.4. | 10.0 / 9.2 | No known exploitation | Fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP said updating is the only safe choice. | Vulns & Patches |
| CVE-2026-109619 | PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The flaws affect nearly all PHP releases back to PHP 5.4. | 10.0 / 9.2 | No known exploitation | Fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP said updating is the only safe choice. | Vulns & Patches |
| CVE-2026-109618 | All PHP installations serving web requests are affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. CyberScoop reported that more than 1.3 million internet-exposed hosts could be vulnerable. | 9.2 | No known exploitation | Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Maintainers also supplied minimal source patches for PHP 7.4, 8.0 and 8.1, but CISA advised organizations using PHP 8.1 or earlier unsupported versions to take PHP-based systems offline until they can be patched or updated. | Vulns & Patches |
| CVE-2026-109619 | All PHP installations serving web requests are affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. CyberScoop reported that more than 1.3 million internet-exposed hosts could be vulnerable. | 9.2 | No known exploitation | Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Maintainers also supplied minimal source patches for PHP 7.4, 8.0 and 8.1, but CISA advised organizations using PHP 8.1 or earlier unsupported versions to take PHP-based systems offline until they can be patched or updated. | Vulns & Patches |
NVD · CISA KEV · vendor advisories