Friday 30 October 2026 Updated 07:26 Dubai time (25m ago)
SentryFeed

Security news, read and ranked every 30 minutes.

Patch this first

The flaws most worth fixing this week, ranked by points you can check: whether they're on CISA's exploited list, their chance of being used, how severe they are, and how much they're in the news.

Follow by RSS Deadlines in your calendar

  1. 1. Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

    CVE-2026-35273 · Oracle PeopleSoft Enterprise PeopleTools

    • On CISA's exploited list +40
    • Used by ransomware +10
    • 97% chance of use in 30 days +29
    • Rated 9.8 out of 10 +10
    • In 1 article this week +2

    Vendor advisory

    91points

  2. 2. PHP Memory Corruption Vulnerability

    CVE-2026-109618 · PHP Group PHP

    • On CISA's exploited list +40
    • over 99% chance of use in 30 days +30
    • Rated 9.2 out of 10 +8
    • In 5 articles this week +10

    No patch link in NVD's record: check the vendor

    88points

  3. 3. PHP Stale Internal Request-State Vulnerability

    CVE-2026-109619 · PHP Group PHP

    • On CISA's exploited list +40
    • over 99% chance of use in 30 days +30
    • Rated 9.2 out of 10 +8
    • In 3 articles this week +6

    No patch link in NVD's record: check the vendor

    84points

  4. 4. Google Brotli Unchecked Return Value Vulnerability

    CVE-2026-111497 · Google Brotli

    • On CISA's exploited list +40
    • 83% chance of use in 30 days +25
    • Rated 9.2 out of 10 +8
    • In 5 articles this week +10

    No patch link in NVD's record: check the vendor

    83points

  5. 5. Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

    CVE-2026-20127 · Cisco Catalyst SD-WAN Controller and Manager

    • On CISA's exploited list +40
    • 89% chance of use in 30 days +27
    • Rated 10.0 out of 10 +10
    • In 2 articles this week +4

    Vendor advisory

    81points

  6. 6. ProFTPD Improper Access Control Vulnerability

    CVE-2015-3306 · ProFTPD ProFTPD

    • On CISA's exploited list +40
    • 99% chance of use in 30 days +30
    • Rated 10.0 out of 10 +10

    No patch link in NVD's record: check the vendor

    80points

  7. 7. Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

    CVE-2026-21589 · Atlassian Multiple Products

    • On CISA's exploited list +40
    • 99% chance of use in 30 days +30
    • Rated 9.3 out of 10 +9

    Vendor advisory

    79points

  8. 8. ISC BIND Data Processing Errors Vulnerability

    CVE-2015-5477 · ISC BIND

    • On CISA's exploited list +40
    • over 99% chance of use in 30 days +30
    • Rated 7.5 out of 10 +4

    Patch available

    74points

  9. 9. Apache Struts Command Injection Vulnerability

    CVE-2016-3081 · Apache Struts

    • On CISA's exploited list +40
    • 97% chance of use in 30 days +29
    • Rated 8.1 out of 10 +5

    Patch available

    74points

  10. 10. Ahsay AhsayCBS Command Injection Vulnerability

    CVE-2026-105134 · Ahsay AhsayCBS

    • On CISA's exploited list +40
    • 82% chance of use in 30 days +25
    • Rated 9.3 out of 10 +9

    No patch link in NVD's record: check the vendor

    74points

  11. 11. Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

    CVE-2026-104935 · Ivanti Connect Secure

    • On CISA's exploited list +40
    • 87% chance of use in 30 days +26
    • Rated 8.6 out of 10 +7

    Vendor advisory

    73points

  12. 12. Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

    CVE-2026-110447 · Collabora Collabora Online – Built-in CODE Server

    • On CISA's exploited list +40
    • 73% chance of use in 30 days +22
    • Rated 9.2 out of 10 +8
    • In 1 article this week +2

    No patch link in NVD's record: check the vendor

    72points

  13. 13. Ahsay AhsayCBS Improper Authentication Vulnerability

    CVE-2026-105133 · Ahsay AhsayCBS

    • On CISA's exploited list +40
    • 79% chance of use in 30 days +24

    No patch link in NVD's record: check the vendor

    64points

  14. 14. Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

    CVE-2026-48356 · Adobe Commerce and Magento

    • On CISA's exploited list +40
    • 45% chance of use in 30 days +13
    • Rated 9.3 out of 10 +9

    Vendor advisory

    62points

  15. 15. Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

    CVE-2026-76504 · Cisco Catalyst SD-WAN Manager

    • On CISA's exploited list +40
    • 39% chance of use in 30 days +12
    • Rated 9.8 out of 10 +10

    Vendor advisory

    62points

  16. 16. ONLYOFFICE Docs Server Path Traversal Vulnerability

    CVE-2021-3199 · ONLYOFFICE Docs

    • On CISA's exploited list +40
    • 30% chance of use in 30 days +9
    • Rated 9.8 out of 10 +10

    No patch link in NVD's record: check the vendor

    59points

  17. 17. Apple Multiple Products Out-of-Bounds Write Vulnerability

    CVE-2026-86950 · Apple Multiple Products

    • On CISA's exploited list +40
    • 26% chance of use in 30 days +8
    • Rated 8.8 out of 10 +7
    • In 2 articles this week +4

    Vendor advisory

    59points

  18. 18. Zammad GmbH Zammad Session Fixation Vulnerability

    CVE-2026-102489 · Zammad GmbH Zammad

    • On CISA's exploited list +40
    • 22% chance of use in 30 days +7
    • Rated 9.4 out of 10 +9

    Vendor advisory

    56points

  19. 19. BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

    CVE-2026-102764 · BeyondTrust Remote Support

    • On CISA's exploited list +40
    • 19% chance of use in 30 days +6
    • Rated 9.3 out of 10 +9

    Vendor advisory

    55points

  20. 20. Linux Kernel Missing Initialization of a Variable Vulnerability

    CVE-2026-46300 · Linux Kernel

    • On CISA's exploited list +40
    • 16% chance of use in 30 days +5
    • Rated 7.8 out of 10 +5
    • CISA deadline due tomorrow +5

    Patch available

    55points

  21. 21. Zammad GmbH Zammad Improper Privilege Management Vulnerability

    CVE-2026-102490 · Zammad GmbH Zammad

    • On CISA's exploited list +40
    • 11% chance of use in 30 days +3
    • Rated 9.4 out of 10 +9

    Vendor advisory

    52points

  22. 22. Fortinet FortiMail Path Traversal Vulnerability

    CVE-2026-104286 · Fortinet FortiMail

    • On CISA's exploited list +40
    • 4.6% chance of use in 30 days +1
    • Rated 9.8 out of 10 +10

    Vendor advisory

    51points

  23. 23. Cisco Secure Email Gateway Relative Path Traversal Vulnerability

    CVE-2026-76519 · Cisco Secure Email Gateway

    • On CISA's exploited list +40
    • 2.2% chance of use in 30 days +1
    • Rated 9.8 out of 10 +10

    Vendor advisory

    51points

  24. 24. Siemens Software Center Uncontrolled Search Path Element Vulnerability

    CVE-2026-110936 · Siemens Software Center

    • On CISA's exploited list +40
    • Rated 8.4 out of 10 +6
    • CISA deadline due in 4 days +5

    No patch link in NVD's record: check the vendor

    51points

  25. 25. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

    CVE-2026-88779 · Citrix NetScaler

    • On CISA's exploited list +40
    • 11% chance of use in 30 days +3
    • Rated 8.7 out of 10 +7

    Vendor advisory

    50points

How the order is worked out

Every CVE in the last 7 days of security news, and every flaw CISA added in the last 30 days or whose deadline is still ahead, gets points:

SignalPoints
On CISA's exploited list40
Used by ransomware, says CISA10
EPSS: chance of being used in the next 30 daysup to 30 (30 × the chance)
CVSS: rated 7 or more out of 10up to 10
News: each article this week2 each, up to 10
CISA's deadline within 7 days5

Being exploited counts most: a flaw already used in attacks matters more than a worse one nobody is using. "Patch available" means NVD's record links to a patch; it doesn't prove you have it. Your stack only reorders the list in your browser; it's never sent anywhere.