Free and open · new CVEs checked every 20 minutesStatus RSS Open data Contact

PatchTheCVE.com

Blog · Weekly roundup · 2026-10-27

CVE-2026-41940 Cpanel: exploited in ransomware attacks, patch now | Week 44: 821 new CVEs, 30 exploited

By the PatchTheCVE security team · Updated 2026-10-27 · Data from NVD, CISA KEV, EPSS and vendor advisories

Most urgent: CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
Critical severity (CVSS 9.8), exploited in the wild, used in ransomware, remotely exploitable, no login needed. Recommended action: upgrade to 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5.

Between 26 October 2026 and 27 October 2026 we tracked 821 new CVEs: 26 critical, 30 exploited in the wild and 30 that should be patched immediately. Here are the ten that matter most.

Top 10 this week

CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Risk: Critical (CVSS 9.8), priority 100/100 (patch now), published 29 April 2026
Exploitation: exploited in the wild (CISA KEV), federal due date 2026-05-03; used in ransomware campaigns; 98.5% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
Affected: cpanel cpanel (>= 11.40 and < 86.0.41, >= 88.0.0 and < 110.0.97, >= 112.0.0 and < 118.0.63)
Fixed in: 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5
What to do: upgrade to 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5 for cpanel cpanel

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Risk: Critical (CVSS 10.0), priority 98/100 (patch now), published 14 May 2026
Exploitation: exploited in the wild (CISA KEV), federal due date 2026-05-17; 91.8% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
Affected: cisco catalyst sd-wan manager (< 20.9.9.1, >= 20.10 and < 20.12.5.4, >= 20.12.6 and < 20.12.6.2)
Fixed in: 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1
What to do: upgrade to 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1 for cisco catalyst sd-wan manager

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability

Risk: Critical (CVSS 9.8), priority 97/100 (patch now), published 14 April 2026
Exploitation: exploited in the wild (CISA KEV), federal due date 2026-07-19; 93.2% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
Affected: fortinet fortisandbox (>= 4.4.0 and <= 4.4.9)
Fixed in: newer than 4.4.9
What to do: upgrade to newer than 4.4.9 for fortinet fortisandbox

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability

Risk: Critical (CVSS 9.8), priority 97/100 (patch now), published 8 May 2026
Exploitation: exploited in the wild (CISA KEV), federal due date 2026-05-11; 89.4% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
Affected: litellm litellm (>= 1.81.16 and < 1.83.7)
Fixed in: 1.83.7
What to do: upgrade to 1.83.7 for litellm litellm

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Mitigation, Patch · Mitigation, Third Party Advisory

CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Risk: Critical (CVSS 9.1), priority 97/100 (patch now), published 13 May 2026
Exploitation: exploited in the wild (CISA KEV), federal due date 2026-06-01; used in ransomware campaigns; 95.0% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
Affected: paloaltonetworks pan-os (< 10.2.7, 10.2.7, 10.2.7 h1)
Fixed in: 10.2.7
What to do: upgrade to 10.2.7 for paloaltonetworks pan-os

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques

Risk: Critical (CVSS 9.8), priority 97/100 (patch now), published 21 October 2026
Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-29; 100.0% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
Affected: php php (>= 7.3.0 and < 8.2.35, >= 8.3.0 and < 8.3.36, >= 8.4.0 and < 8.4.27)
Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12
Patch ID: RHSA-2026:87070, RHSA-2026:87071, RHSA-2026:88561
What to do: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12 for php php

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Mitigation, Vendor Advisory

CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability

Risk: Critical (CVSS 9.1), priority 95/100 (patch now), published 11 August 2026
Exploitation: exploited in the wild (CISA KEV), federal due date 2026-09-27; 90.5% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
Affected: adobe commerce (< 2.4.4, 2.4.4, 2.4.4 p1)
Fixed in: 2.4.4
What to do: upgrade to 2.4.4 for adobe commerce

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Risk: Critical (CVSS 9.8), priority 94/100 (patch now), published 14 October 2026
Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-26; 12.3% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
Affected: collabora online (< 26.4.303)
Fixed in: 26.4.303
What to do: upgrade to 26.4.303 for collabora online

Why it ranks here: critical severity; epss top 4%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2024-58400: llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_

Risk: High (CVSS 8.2), priority 34/100 (routine), published 27 October 2026
Exploitation: attackable over the network without a login
What to do: apply the vendor mitigation

Why it ranks here: high severity; remotely exploitable, no login, no user action.

References: NVD

CVE-2026-116818: OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote a

Risk: High (CVSS 8.2), priority 34/100 (routine), published 27 October 2026
Exploitation: attackable over the network without a login
What to do: apply the vendor mitigation

Why it ranks here: high severity; remotely exploitable, no login, no user action.

References: NVD

Most affected vendors

openpanel-dev: 14 new CVEs
yeswiki: 9 new CVEs
cure53: 3 new CVEs
sourcecodester: 2 new CVEs
apache software foundation: 1 new CVE
parse-community: 1 new CVE

Daily digests

26 October 2026: 769 new CVEs
27 October 2026: 52 new CVEs

How to act on this list

Start with anything marked exploited or patch now.
Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

How many new CVEs were there in week 44 of 2026?

We tracked 821 new CVEs between 26 October 2026 and 27 October 2026, 26 of them critical.

What should I patch first this week?

Start with CVE-2026-41940 (WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability): upgrade to 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5.

Sources

NIST National Vulnerability Database: CVE details and affected versions
CVE Program: official CVE records
CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
FIRST EPSS: exploit probability
Distribution and vendor advisories linked under each item.

Keep reading