Vulnerability of the day

Vulnerability of the day.

Every day one real, current vulnerability in software that many businesses run: WordPress and plugins, PHP, frameworks, web servers, mail and collaboration servers, firewalls. With affected versions, severity and the link to the vendor’s own report.

Today · 3 November 2026 · CVE-2026-109619

PHP Use after free

8.1 CVSS · highExploited

Use after free in PHP. Exploitable over the network, without logging in, without any user action. CVSS 8.1 (high). According to CISA it is already being exploited. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Details Vendor security advisory (github.com) ↗

Archive. The past days.

DateProductVulnerabilityCVSS
02/11/2026Ivanti Connect Secure CVE-2026-104935Authentication bypass (spoofing)8.6Exploited
01/11/2026Fortinet FortiOS CVE-2025-61624Path traversal6.5Exploited
31/10/2026Apache Struts CVE-2016-3081Command injection8.1Exploited
30/10/2026Citrix NetScaler ADC / Gateway CVE-2026-88779Memory corruption (buffer overflow)7.5Exploited
29/10/2026GitLab CVE-2026-97229Integer overflow10.0Exploited
28/10/2026Adobe Commerce / Magento CVE-2026-48356Unrestricted file upload9.3Exploited
27/10/2026Node.js CVE-2026-111497Out-of-bounds write9.8Exploited
26/10/2026PHP CVE-2026-109618Use after free9.8Exploited

How we choose

Sources are the Known Exploited Vulnerabilities (KEV) catalog of the US agency CISA and NIST’s National Vulnerability Database (NVD).
Only software from our list of widely used products qualifies, with a CVSS score of 7.0 or more, or already exploited.
Vulnerabilities that CISA added as exploited in the last 30 days come first, then the most severe of the last 14 days.
Every entry links the vendor’s report and the official references. We only use facts from these sources. Each entry is checked automatically for completeness before it goes live.

RSS feed