GitLab Community Edition and Enterprise Edition top 8 new exploited vulns; 4 rated patch-now

GitLab Community Edition and Enterprise Edition

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

Added 2026-10-29 · CISA due 2026-11-01 · EPSS 27.7%

What it is: GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to...

Why it matters: EPSS estimates a 27.7% chance of exploitation activity in the next 30 days, higher than 98.1% of all scored CVEs. The federal patch deadline passed 2 days ago.

Gridwatch notes: The headline: GitLab's critical regex bug, and the sibling patch you might have missed. CISA added GitLab CVE-2026-97229 to its exploited list on Oct 29 with a Nov 1 deadline, which has now passed. It lets an unauthenticated attacker run code on a GitLab server through a crafted regular expression in CI/CD configuration. GitLab rates the related bug CVE-2026-110264 CVSS 10.0, and it affects every self-managed version from 7.0 onward. The catch: GitLab's earlier patch releases (19.4.2, 19.3.5, 19.2.8) fixed CVE-2026-97229 but not CVE-2026-110264. Go to 19.5.1, 19.4.3, 19.3.6 or 19.2.9 (backports: 19.1.9, 19.0.10, 18.11.13). If you build GitLab from source or a custom container, upgrading GitLab isn't enough: the fix lives in Ruby, so you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. GitLab.com and GitLab Dedicated are already patched. CISA flags this entry for forensic triage. If your instance was reachable from the internet before you patched, review CI/CD config changes and runner activity from the exposure window. CVE-2026-110264 is not on KEV, and we have seen no public exploitation report for it.

Uncertain: the 19.4.2/19.3.5/19.2.8 fix scope comes from earlier research and GitLab's affected-version ranges, not a re-read this turn of the 19.4.2 release notes.

Fix: Upgrade to 19.5.1, 19.4.3, 19.3.6 or 19.2.9 (backports: 19.1.9, 19.0.10, 18.11.13). Do not stop at 19.4.2 or 19.3.5: they leave sibling CVE-2026-110264 (CVSS 10.0, unauthenticated RCE, every version since 7.0) open. Source-compiled or custom-image installs must also upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later. CISA flags this entry for forensic triage. GitLab.com and Dedicated are already patched. GitLab advisory · Ruby advisory · NVD

Sources: GitLab patch release · Ruby advisory · CISA KEV

Linux Kernel

Linux Kernel Missing Initialization of a Variable Vulnerability

Added 2026-10-28 · CISA due 2026-10-31 · EPSS 16.1%

What it is: Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared...

Why it matters: EPSS estimates a 16.1% chance of exploitation activity in the next 30 days, higher than 96.9% of all scored CVEs. The federal patch deadline passed 3 days ago.

Fix: Install your distribution's patched kernel, then reboot; a patched kernel does nothing until the machine restarts. Check your distro's advisory, as fix availability varies. CISA says this bug chains with PHP2Shell (CVE-2026-109618/-109619) to plant webshells running as root, so patch PHP too. Upstream fix · NVD

Secure Firewall ASA Software and Cisco Secure FTD Software

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Added 2026-10-29 · CISA due 2026-11-01 · EPSS 0.8%

What it is: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service...

Why it matters: EPSS estimates a 0.8% chance of exploitation activity in the next 30 days, higher than 57.3% of all scored CVEs. The federal patch deadline passed 2 days ago.

Fix: Apply mitigations in accordance with vendor instructions. Vendor advisory · NVD

Ivanti Connect Secure

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Added 2026-10-30 · CISA due 2026-11-02 · EPSS 0.5%

What it is: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.

Why it matters: EPSS estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 45.1% of all scored CVEs. The federal patch deadline passed 1 day ago.

Fix: Upgrade to 25.1.1.3 or 22.8R2.6 (versions per CISA and government summaries; Ivanti's advisory was not independently readable). If the appliance was internet-exposed, assume compromise is possible: CISA warns Ivanti's Integrity Checker may miss in-memory exploitation, so do forensics rather than relying on a clean ICT scan. Ivanti advisory · NVD

Google Brotli

Google Brotli Unchecked Return Value Vulnerability

Added 2026-10-27 · CISA due 2026-11-10 · EPSS 82.6%

What it is: Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted...

Why it matters: EPSS estimates a 82.6% chance of exploitation activity in the next 30 days, higher than 99.67% of all scored CVEs. The federal patch deadline is in 7 days.

Fix: Update Brotli to v1.2.1 or later, and update software that bundles it. Brotli v1.2.1 · NVD

Adobe Commerce and Magento

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Added 2026-10-27 · CISA due 2026-11-10 · EPSS 44.6%

What it is: Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

Why it matters: EPSS estimates a 44.6% chance of exploitation activity in the next 30 days, higher than 98.8% of all scored CVEs. The federal patch deadline is in 7 days.

Fix: Apply Adobe's APSB26-73 update. Adobe APSB26-73 · NVD

Broadcom VMware ESX

Broadcom VMWare ESX Insufficient Logging Vulnerability

Added 2026-10-28 · CISA due 2026-11-11 · EPSS 0.7%

What it is: Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

Why it matters: EPSS estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 52.8% of all scored CVEs.

Fix: Apply mitigations in accordance with vendor instructions. Vendor advisory · NVD

Ivanti Connect Secure

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Added 2026-10-30 · CISA due 2026-11-13 · EPSS n/a

What it is: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and...

Why it matters:

Fix: Upgrade to 25.1.1.3 or 22.8R2.6 (versions per CISA and government summaries; Ivanti's advisory was not independently readable). If the appliance was internet-exposed, assume compromise is possible: CISA warns Ivanti's Integrity Checker may miss in-memory exploitation, so do forensics rather than relying on a clean ICT scan. Ivanti advisory · NVD