| 1 | CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Original article | Confirmed 100
Policy / law | 4 Nov 2026 |
| 2 | CVE-2026-122192 - Guest Access to Firecracker Process Memory After a Failed Memory Discard
Original article | Confirmed 100
Vulnerability | 4 Nov 2026 |
| 3 | PHP2Shell: What to know about two critical PHP flaws
Original article | Confirmed 100
Actively exploited | 4 Nov 2026 |
| 4 | CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass
Original article | Confirmed 100
Vulnerability | 3 Nov 2026 |
| 5 | CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Original article | Confirmed 100
Vulnerability | 3 Nov 2026 |
| 6 | CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Original article | Confirmed 100
Vulnerability | 2 Nov 2026 |
| 7 | CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
Original article | Confirmed 100
Vulnerability | 2 Nov 2026 |
| 8 | CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Original article | Confirmed 100
Vulnerability | 2 Nov 2026 |
| 9 | CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Original article | Confirmed 100
Vulnerability | 2 Nov 2026 |
| 10 | CVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C
Original article | Confirmed 100
Vulnerability | 30 Oct 2026 |
| 11 | CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
Original article | Confirmed 100
Vulnerability | 29 Oct 2026 |
| 12 | CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas
Original article | Confirmed 100
Vulnerability | 28 Oct 2026 |
| 13 | CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)
Original article | Confirmed 100
Vulnerability | 26 Oct 2026 |
| 14 | CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles
Original article | Confirmed 100
Vulnerability | 25 Oct 2026 |
| 15 | CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server
Original article | Confirmed 100
Vulnerability | 23 Oct 2026 |
| 16 | CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Original article | Confirmed 100
Vulnerability | 22 Oct 2026 |
| 17 | Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Original article | Reported 80
Actively exploited | 31 Oct 2026 |
| 18 | CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
Original article | Reported 80
Actively exploited | 30 Oct 2026 |
| 19 | SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
Original article | Reported 70
Vulnerability | 4 Nov 2026 |
| 20 | Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory
Original article | Reported 70
Vulnerability | 4 Nov 2026 |
| 21 | Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Original article | Reported 70
Vulnerability | 3 Nov 2026 |
| 22 | Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
Original article | Reported 70
Vulnerability | 2 Nov 2026 |
| 23 | WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Original article | Reported 70
Threat actor | 30 Oct 2026 |
| 24 | Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched
Original article | Reported 70
Vulnerability | 29 Oct 2026 |
| 25 | Chrome and Firefox updates fix serious security flaws. Install now
Original article | Reported 60
Vulnerability | 28 Oct 2026 |