https://audit.viewconic.de/en/vulnerability-of-the-day/ Every day one real, current vulnerability in widely used software: affected versions, CVSS, whether it is exploited, and a direct link to the vendor’s own advisory. en https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-109619/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-109619/ Tue, 03 Nov 2026 06:00:00 GMT Use after free in PHP. Exploitable over the network, without logging in, without any user action. CVSS 8.1 (high). According to CISA it is already being exploited. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-104935/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-104935/ Mon, 02 Nov 2026 06:00:00 GMT Authentication bypass (spoofing) in Ivanti Connect Secure. Exploitable over the network, without logging in, without any user action. CVSS 8.6 (high). According to CISA it is already being exploited. Fixed in 25.1.1.2 and 25.1.3.0. https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2025-61624/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2025-61624/ Sun, 01 Nov 2026 06:00:00 GMT Path traversal in Fortinet FortiOS. Exploitable over the network, only with a highly privileged account, without any user action. CVSS 6.5 (medium). According to CISA it is already being exploited. The vendor names the fixed versions in its report. https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2016-3081/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2016-3081/ Sat, 31 Oct 2026 06:00:00 GMT Command injection in Apache Struts. Exploitable over the network, without logging in, without any user action. CVSS 8.1 (high). According to CISA it is already being exploited. Fixed in 2.3.20.3, 2.3.24.3 and 2.3.28.1. https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-88779/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-88779/ Fri, 30 Oct 2026 06:00:00 GMT Memory corruption (buffer overflow) in Citrix NetScaler ADC / Gateway. Exploitable over the network, without logging in, without any user action. CVSS 7.5 (high). According to CISA it is already being exploited. Fixed in 13.1-37.282, 13.1-64.28 and 14.1-73.41. https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-97229/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-97229/ Thu, 29 Oct 2026 06:00:00 GMT Integer overflow in GitLab. Exploitable over the network, without logging in, without any user action. CVSS 10.0 (critical). According to CISA it is already being exploited. Fixed in 19.2.8, 19.3.5 and 19.4.2. https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-48356/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-48356/ Wed, 28 Oct 2026 06:00:00 GMT Unrestricted file upload in Adobe Commerce / Magento. Exploitable over the network, without logging in, a user has to take part. CVSS 9.3 (critical). According to CISA it is already being exploited. The vendor names the fixed versions in its report. https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-111497/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-111497/ Tue, 27 Oct 2026 06:00:00 GMT Out-of-bounds write in Node.js. Exploitable over the network, without logging in, without any user action. CVSS 9.8 (critical). According to CISA it is already being exploited. Fixed in 22.23.4, 24.22.1 and 26.12.1. https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-109618/ https://audit.viewconic.de/en/vulnerability-of-the-day/cve-2026-109618/ Mon, 26 Oct 2026 06:00:00 GMT Use after free in PHP. Exploitable over the network, without logging in, without any user action. CVSS 9.8 (critical). According to CISA it is already being exploited. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.