4 articles
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.
On November 9, CISA added four actively exploited flaws to its KEV catalog. The standout is an OpenSSH bug on Linux systems using musl libc without PAM, such as Alpine Linux, where some setups accept any long password.
CISA lists an exploited UnrealIRCd flaw (CVSS 8.6): any user on a network of linked servers can inject commands that run with server privileges.
CISA flags two exploited Barracuda flaws: an ESG auth bypass (CVE-2026-116606) and a root command injection (CVE-2026-111560) that attackers can chain.
