Skip to content
VulniPulse

Free · every Monday · no account

The week's CVEs, in one email.

Every Monday morning (13:00 UTC) VulniPulse sends a short summary of what 34 vendors published the week before: critical and high advisories, new CISA KEV entries, changes to the CVEs you follow, and end-of-life dates coming up. Cover every vendor or only the ones you run.

Subscribe

Free. No account needed. We email a confirmation link first; nothing is sent until you click it.

What to include
Vendors (1 selected)

CISA KEV entries and known-exploited advisories are always included.

Each issue reports if one was added to CISA KEV, reported exploited, got a fixed version, or changed severity that week.

  • The week's critical and high advisories

    Vendor, product, CVSS, the fixed version when the vendor names one, and a link to the advisory.

  • New CISA KEV entries

    Every CVE CISA added to its Known Exploited Vulnerabilities catalog that week, with the federal due date.

  • CVEs you follow

    Follow up to 25 CVEs. The issue says if one was added to KEV, reported exploited, got a fix or changed severity.

  • End-of-life dates

    Published end-of-support dates in the next 30 days for the vendors you chose.

Weekly digest or real-time alerts?

The digest is a weekly look back. If you need to know the day a vendor publishes, matched to the products and versions you run, that is what paid alerts are for.

  • Digest: free, once a week, vendor or all-vendor summary.
  • Alerts: within minutes of publication, per product, by email, Android and Discord. First month free, then US$15/month; card needed at checkout.
See real-time alerts

This week's issue

Built from last week's public advisories with the default selection: all vendors, high and critical. Your issue follows your own selection.

VulniPulse weekly: 61 critical, 88 high (19–25 Oct 2026)
61
critical
88
high
0
added to KEV
13
exploited

337 new advisories in scope this week (92 medium, 18 low, 78 unrated).

Known exploited

Critical CISA KEV Exploited
Critical [CVE-2026-109618 +1] PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
Fortinet · CVSS 9.8
Critical Exploited
Critical [CVE-2026-76473 +7] Cisco Unified Communications Products Security Hardening Release: October 2026
Cisco · Emergency Responder · CVSS 9.8 · Fixed in 15SU5
Critical CISA KEV Exploited
Critical [CVE-2026-111497] Brotli Vulnerability in NetApp Products
NetApp · NetApp Console Agent Container (audit) · CVSS 9.2
Critical CISA KEV Exploited
Critical [CVE-2026-109618 +1] Impact of Critical Vulnerabilities in PHP (, CVE-2026-109619) on Palo Alto Networks Products
Palo Alto · PAN-OS · CVSS 9.2 · Fixed in PAN-OS >= 12.2.4-h1, PAN-OS >= 12.1.10-h3 …
Critical CISA KEV Exploited
Critical [CVE-2026-109618 +1] October 2026 PHP Vulnerabilities in NetApp Products
NetApp · ONTAP 9 · CVSS 9.2 · Fixed in ONTAP 9: 9.14.1P18HF1, ONTAP 9: 9.15.1P20HF1 …
Critical Exploited
Critical [CVE-2026-20043 +3] Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
Cisco · Secure Firewall Threat Defense (FTD) Software · CVSS 9.0 · Fixed in 3.12.4.0, 5.6.0 …
Critical CISA KEV Exploited
Critical [CVE-2026-109618 +1] Vulnerabilities in PHP Affecting Cisco Products: October 2026
Cisco · Fixed in 27.1.1 (Mar 2027), 15.5.21 …
High Exploited
High [CVE-2026-76490 +7] Cisco Expressway Series Security Hardening Release: October 2026
Cisco · TelePresence Video Communication Server (VCS) Expressway · CVSS 8.6 · Fixed in X15.5.20

Top critical and high advisories

Critical
Critical [CVE-2026-79851] Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
Aruba · ArubaOS (AOS) · CVSS 10.0
Critical
Critical [CVE-2026-79850] Authentication Bypass Leading to Remote Code Execution in AOS-8
Aruba · ArubaOS (AOS) · CVSS 10.0
Critical
Critical [CVE-2026-79849] Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
Aruba · ArubaOS (AOS) · CVSS 10.0
Critical
Critical [CVE-2026-79848] Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
Aruba · ArubaOS (AOS) · CVSS 10.0
Critical
Critical [CVE-2026-79847] Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
Aruba · ArubaOS (AOS) · CVSS 10.0
Critical
Critical [CVE-2026-79846] Unauthenticated Command Injection Vulnerabilities in AOS-8
Aruba · ArubaOS (AOS) · CVSS 10.0
Critical
Critical [CVE-2026-79844] Authentication Bypass Leading to Remote Code Execution in AOS-10
Aruba · ArubaOS (AOS) · CVSS 10.0
Critical
Critical [CVE-2026-110264] issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression
GitLab · GitLab · CVSS 10.0 · Fixed in 18.11.13, 19.0.10 …
Critical
Critical [CVE-2026-111813] Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration
Apache · Apache Traffic Server · CVSS 10.0 · Fixed in 9.2.16, 10.1.5 …
Critical
Critical [CVE-2026-105944] Apache Pulsar Manager is a web console for administering Apache Pulsar clusters
Apache · Apache Pulsar Manager · CVSS 10.0

136 more critical or high in your selection →

End-of-life dates in the next 30 days

Atlassian Bitbucket Data Center 9.3
End of support on 2026-10-29 (in 2 days)
Check Point Harmony (Endpoint/Mobile) Check Point Endpoint Security E89.10 for macOS
End of support on 2026-10 (in 4 days)
Cisco Switches: 72 releases or models
End of support on 2026-10-31 (in 4 days)
Including WS-C3650-48TS-S, WS-C3650-48TS-L, WS-C3650-48TS-E and 69 more
NETGEAR Switches (ProSAFE/Insight) GS110MX
End of support on 2026-10-31 (in 4 days)
Cisco ISE ISE 3.2, ISE 3.1
End of support on 2026-11-03 (in 7 days)
Juniper Session Smart Router SSR 6.3
End of support on 2026-11-06 (in 10 days)
Cisco ASA / Firepower: 5 releases or models
End of support on 2026-11-18 (in 22 days)
Including ASDM 7.18(x), ASA / ASAv 9.18(x), FXOS 2.10(x) and 2 more
GitLab GitLab CE / EE 19.5
End of active support on 2026-11-19 (in 23 days)

Get alerts the minute advisories are published, matched to your products. First month free, then US$15/month; card needed at checkout.

Start your free month

Details

We send a confirmation link first and nothing else until you click it. Every issue has a link to change your selection or pause it, and a one-click unsubscribe. You can delete your digest data from the same page.

We store your address, your selection and when issues were sent. See the privacy policy.

Content comes from the same public advisory pages on this site. Confirm fixes against the linked vendor advisory before change work.