Recent additions to CISA’s Known Exploited Vulnerabilities catalog, selected for review. Inclusion means CISA has evidence of exploitation; it does not establish that your systems are affected. Check the linked sources for affected versions and mitigations.
Entries are editorially selected from the newest 50 catalog additions, favouring widely deployed software; they are not the complete catalog.
Catalog 2026.10.28 · Published · Retrieved · 6 reviewed entries of 1762 in the catalog · CISA catalog source ↗
CVE-2026-46300 · Added to KEV · CISA due · Reviewed
Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Linux · Kernel · CWE-456 · Ransomware use unknown · CISA description
CISA recommended action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-48356 · Added to KEV · CISA due · Reviewed
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Adobe · Commerce and Magento · CWE-434 · Ransomware use unknown · CISA description
CISA recommended action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-111497 · Added to KEV · CISA due · Reviewed
Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Google · Brotli · CWE-252, CWE-787 · Ransomware use unknown · CISA description
CISA recommended action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-109619 · Added to KEV · CISA due · Reviewed
PHP Stale Internal Request-State Vulnerability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
PHP Group · PHP · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · Ransomware use unknown · CISA description
CISA recommended action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-109618 · Added to KEV · CISA due · Reviewed
PHP Memory Corruption Vulnerability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
PHP Group · PHP · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · Ransomware use unknown · CISA description
CISA recommended action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Selected public disclosures, with claims attributed to the organizations reporting them. This is not a complete list of breaches.
Disclosed · Reviewed
Astrana Health reports a social-engineering incident
Astrana Health reported unauthorized activity after social-engineering calls. Its filing says it believes certain private or confidential information was accessed and/or acquired; the investigation was ongoing.
GitHub discloses unauthorized access to internal repositories
GitHub reported a compromised employee device and unauthorized access to internal repositories. At the time of its disclosure, it said there was no evidence of impact to customer repositories; some internal repositories contained customer support excerpts. In a May 26 update, GitHub instructed Enterprise Server administrators to rotate its signing public key.
Tools for security research and authorized testing. Check the project’s documentation, license and platform support.
Source available; Nmap Public Source License has restrictions · Reviewed
Nmap
Network exploration and security auditing tool for host discovery, port scanning and service identification. Use it only on systems you are authorized to test.
Distribution and individual tool terms vary · Reviewed
Kali Linux
A Linux distribution for penetration testing and security research, with device-specific installation images and a catalog of tools. Individual tools have their own licenses and restrictions.
Device-specific community research and ways to extend devices you own. Methods can be patched; check the exact model, firmware and recovery instructions before proceeding.
Patched on newer firmware; check the project’s version table · Reviewed
RootMyTV for LG webOS TVs
A legacy webOS rooting project. Its maintainers say the exploit was patched and is unlikely to work on firmware released since mid-2022. Compatibility depends on the exact webOS TV version and model; older firmware is not guaranteed to work.
Compatibility depends on device, firmware and method · Reviewed
webOS Homebrew rooting guide
Community guide to rooting LG webOS TVs. Check the device and firmware-specific guidance and recovery information. Developer Mode provides app access but is distinct from root access.
Two exact models and firmware versions reported by the project · Reviewed
Samsung TV root research
The project author reports root on QN55QN90BAFXZA with T-PTMAKUC-1602.3 and QN75QN90FAFXZA with T-RSMFAKUC-0090-1203.0. Other models and firmware require separate verification; UID 0 does not mean all device security boundaries are removed.
The project documentation lists Apple TV HD and first-generation Apple TV 4K among supported devices. Check the project’s current release and tvOS compatibility before use; newer Apple TV models are not implied by that list.
