CVE-2026-109618 / 109619php2shell — F5 BIG-IP
The pair already exploited in the wild. F5 advisory K000163821 lists fixes in 21.1.0.4, 17.5.1.11 and 17.1.3.7 — point releases, no EHF.
SCROLLER.EXE — hover to pauseEST. TOPSITE // SECTOR 7
COMFYTRON PVM-1430 · GREEN PHOSPHOR · 800×600
POWER
Latest scan — Oct 27: 208 CVEs tracked, filtered down to what needs action first. Highlighted Drops, the Ones to Watch, and the grouped 208-CVE index are below — search any of them by CVE ID or vendor, and tap a card for the full record.
LATEST DROPS ▸
208CVEs tracked
9.8Top CVSS — php2shell
WILDExploited now flagged
OCT 27Last updated — hourly scans
Highlighted drops
The highest-priority flaws right now. One search covers these drops, Ones to Watch, and the grouped index below — by CVE ID, vendor, title, or status. Tap any card to drill in.
CVE-2026-94127F5 BIG-IP APM — heap overflow
OAuth heap overflow in APM. The circulating Hotfix-BIGIP *-ENG builds belong to this flaw — not to php2shell. Keep the two separate when patching.
CVE-2026-110447Collabora — exploited early
VulnCheck recorded exploitation on Oct 14 — nine days before CISA KEV listed it on Oct 23. Exactly why the telemetry feed was added.
CVE-2026-110264GitLab — tracked flaw
Part of the baseline GitLab set under hourly monitoring. Its CVE record landed a day after the vendor advisory — the NVD-lag case the CVE.org feed now covers.
CVE-2026-97229GitLab — baseline watch
Monitored for status changes: in-the-wild exploitation, weaponised PoC, or a CISA KEV listing. No change is reported silently — only material events surface.
CVE-2026-90970GitLab — baseline watch
Held in the same baseline set. Scope for the feed is any new CVE at CVSS ≥ 8.0, RCE-class on appsec / admin interfaces, or granting management access.
Ones to watch
Severe, talked about, and researched — but not there yet. These are CVSS 9.0+ flaws from the Oct 27 scan with no exploitation in the wild, no CISA KEV listing, and no public PoC in the scan data. 75 CVEs meet that bar; the 15 below lead on severity and how widely the product is deployed. The moment one gets a PoC or is seen exploited, it leaves this group in the index below. Plus two pre-CVE early signals that have no CVE ID at all yet. Grouping follows the scan’s status flags; tap any card and the detail view carries its full status note exactly as recorded.
Pre-CVE early signals — no CVE assigned yet
Opens the Ones to watch group in the full index below.
Full index — all 208 CVEs
Every entry from the Oct 27 scan, grouped by status — pick a group, 24 per page. The search above filters every group by CVE ID, vendor / product, title, and status text. Tap any card for fixed versions, exploitation status, the full status note, and the source.
Each CVE sits in exactly one group, highest urgency first — exploited beats KEV-listed, KEV-listed beats public PoC. Group counts add up to 208.
Fed by — hourly scans, every day of the week
NVD API 2.0CISA KEVVulnCheck KEVGitHub AdvisoryCVE.orgEUVDOSV.devCisco PSIRTFortinet PSIRTPalo Alto PSIRTGitLabMicrosoftIvantiExploit-DB RSSSploitus RSS