Skip to content
VulniPulse
Sign in

Free · every Monday · no account

The week's CVEs, in one email.

Every Monday morning (13:00 UTC) VulniPulse sends a short summary of what 34 vendors published the week before: critical and high advisories, new CISA KEV entries, changes to the CVEs you follow, and end-of-life dates coming up. Cover every vendor or only the ones you run.

Subscribe

Free. No account needed. We email a confirmation link first; nothing is sent until you click it.

What to include
Vendors (1 selected)

CISA KEV entries and known-exploited advisories are always included.

Each issue reports if one was added to CISA KEV, reported exploited, got a fixed version, or changed severity that week.

  • The week's critical and high advisories

    Vendor, product, CVSS, the fixed version when the vendor names one, and a link to the advisory.

  • New CISA KEV entries

    Every CVE CISA added to its Known Exploited Vulnerabilities catalog that week, with the federal due date.

  • CVEs you follow

    Follow up to 25 CVEs. The issue says if one was added to KEV, reported exploited, got a fix or changed severity.

  • End-of-life dates

    Published end-of-support dates in the next 30 days for the vendors you chose.

Weekly digest or real-time alerts?

The digest is a weekly look back. If you need to know the day a vendor publishes, matched to the products and versions you run, that is what paid alerts are for.

  • Digest: free, once a week, vendor or all-vendor summary.
  • Alerts: within minutes of publication, per product, by email, Android and Discord. First month free, then US$15/month; card needed at checkout.
See real-time alerts

This week's issue

Built from last week's public advisories with the default selection: all vendors, high and critical. Your issue follows your own selection.

VulniPulse weekly: 29 critical, 55 high, 8 added to KEV (26 Oct–1 Nov 2026)
29
critical
55
high
8
added to KEV
5
exploited

157 new advisories in scope this week (43 medium, 9 low, 21 unrated).

Added to CISA KEV

CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti · Connect Secure · Listed 2026-10-30 · Federal due date 2026-11-02
CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco · Secure Firewall Adaptive Security Appliance (ASA) Software · Listed 2026-10-29 · Federal due date 2026-11-01
CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab · GitLab · Listed 2026-10-29 · Federal due date 2026-11-01
CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
VMware · Cloud Foundation · Listed 2026-10-28 · Federal due date 2026-11-11
CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability
Red Hat · NVIDIA for RHEL 10 · Listed 2026-10-28 · Federal due date 2026-10-31
CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
Cisco · Brotli · Listed 2026-10-27 · Federal due date 2026-11-10
CVE-2026-109618 PHP Memory Corruption Vulnerability
Cisco · PHP · Listed 2026-10-26 · Federal due date 2026-10-29
CVE-2026-109619 PHP Stale Internal Request-State Vulnerability
Cisco · PHP · Listed 2026-10-26 · Federal due date 2026-10-29

Known exploited

Advisory CISA KEV Exploited
Advisory [CVE-2026-105477 +13] Release Information for Veeam Backup & Replication 13 and Updates
Veeam · Fixed in Veeam Software Appliance 13.1, Veeam Agent for Microsoft Windows 13.1.2.812 …

Top critical and high advisories

Critical
Critical [CVE-2026-85746] MariaDB Vulnerability in NetApp Products
NetApp · CVSS 9.9
Critical
Critical [CVE-2026-92262] MariaDB Vulnerability in NetApp Products
NetApp · CVSS 9.9
Critical
Critical [CVE-2026-118636] Apache MINA: **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE
Apache · Apache MINA · CVSS 9.8
Critical
Critical [CVE-2026-64618] Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0)
Apache · Apache Fineract · CVSS 9.8 · Fixed in 1.16.1
Critical
Critical [CVE-2026-101607 +65] October 2026 MySQL Server 8.4.0, 9.7.0, 9.7.3 Vulnerabilities in NetApp Products
NetApp · SnapCenter · CVSS 9.8
Critical
Critical [CVE-2026-103409] Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root
Juniper · Session Smart Router · CVSS 9.8 · Fixed in 7.0.5, 7.1.7 …
Critical
Critical [CVE-2026-103406] Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID
Juniper · Session Smart Conductor · CVSS 9.8 · Fixed in 7.0.5, 7.1.7 …
Critical
Critical [CVE-2026-19931] Libcurl Vulnerability in NetApp Products
NetApp · CVSS 9.8
Critical CISA KEV Exploited
Critical [CVE-2026-105481 +9] Node2Shell CVEs
Fortinet · CVSS 9.8
Critical
Critical [CVE-2026-97631] Tianocore EDK2 Vulnerability in NetApp Products
NetApp · CVSS 9.5

74 more critical or high in your selection →

End-of-life dates in the next 30 days

Cisco ISE ISE 3.2, ISE 3.1
End of support on 2026-11-03 (in 1 day)
Juniper Session Smart Router SSR 6.3
End of support on 2026-11-06 (in 4 days)
Cisco ASA / Firepower: 5 releases or models
End of support on 2026-11-18 (in 16 days)
Including ASDM 7.18(x), ASA / ASAv 9.18(x), FXOS 2.10(x) and 2 more
GitLab GitLab CE / EE 19.5
End of active support on 2026-11-19 (in 17 days)
GitLab GitLab CE / EE 19.3
End of support on 2026-11-19 (in 17 days)
Atlassian Bamboo 10.1
End of support on 2026-11-20 (in 18 days)
Atlassian Jira Software 10.2
End of support on 2026-11-20 (in 18 days)
Palo Alto Cortex XDR agent 9.1
End of support on 2026-11-22 (in 20 days)

Get alerts the minute advisories are published, matched to your products. First month free, then US$15/month; card needed at checkout.

Start your free month

Details

We send a confirmation link first and nothing else until you click it. Every issue has a link to change your selection or pause it, and a one-click unsubscribe. You can delete your digest data from the same page.

We store your address, your selection and when issues were sent. See the privacy policy.

Content comes from the same public advisory pages on this site. Confirm fixes against the linked vendor advisory before change work.