Week of September 29, 2026
This is an archived issue. See the latest digest or all issues.
Exploitation probability spikes overnight. Public exploits land. CVEs cross into confirmed in-the-wild use. That movement, the change, is what ESIP scores and surfaces.
Silence is not clearance: a CVE that didn't move isn't a safe one, just one nothing has happened to that week. When something does move, that change is the exposure signal.
Improper certificate validation during VPN negotiation in Check Point Quantum, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.
An input-validation flaw in on-prem VMware VeloCloud Orchestrator, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.
A heap overflow in F5 BIG-IP APM when an access policy and OAuth profile are configured, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.
A SQL injection in Cisco AsyncOS email parsing, confirmed exploited with probability climbing sharply. High velocity, evidence accumulating fast. Treat as immediate.
The confirmed-exploited SonicWall SMA1000 SSRF, with a public Metasploit module, is still escalating fast twenty-seven days in. Treat as immediate if you run it.
Browse every issue, or read the latest.