--- title: "Threat pulse and articles" description: "Newly exploited vulnerabilities from the CISA KEV catalog, CISA joint advisories and Buguardian articles, refreshed every six hours." url: https://buguardian.com/en/updates.html updated: 2026-11-05 --- Threat pulse · articles # What changed this week. Newly exploited vulnerabilities and joint advisories from CISA, refreshed every six hours, next to Buguardian's own articles. Each card says what it means for your exposure. 4 Nov 2026 · CISA KEV ### [Apple Multiple Products Improper Authentication Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2024-27834) Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. Buguardian Vulnerability Management flags this with the CISA due date: 18 Nov 2026. 3 Nov 2026 · 2 min read ### [How the Watcher posture score is calculated](https://buguardian.com/en/blog-how-the-watcher-posture-score-works.html) Seven weighted categories, published weights and a deterministic calculation. Here is what goes into the number, and what never does. 3 Nov 2026 · CISA KEV ### [WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2026-119977) WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is… Buguardian Vulnerability Management flags this with the CISA due date: 6 Nov 2026. 30 Oct 2026 · CISA KEV ### [Ivanti Connect Secure: 2 vulnerabilities now exploited](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=Ivanti%20Connect%20Secure) Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location… Buguardian Vulnerability Management flags these with the CISA due date: 2 Nov 2026. 29 Oct 2026 · CISA KEV ### [GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2026-97229) GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially… Buguardian Vulnerability Management flags this with the CISA due date: 1 Nov 2026. 29 Oct 2026 · CISA KEV ### [Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2026-76418) Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the… Buguardian Vulnerability Management flags this with the CISA due date: 1 Nov 2026. 28 Oct 2026 · CISA KEV ### [Broadcom VMWare ESX Insufficient Logging Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2026-41709) Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. Buguardian Vulnerability Management flags this with the CISA due date: 11 Nov 2026. 28 Oct 2026 · CISA KEV ### [Linux Kernel Missing Initialization of a Variable Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2026-46300) Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during… Buguardian Vulnerability Management flags this with the CISA due date: 31 Oct 2026. 27 Oct 2026 · CISA KEV ### [Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2026-48356) Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining… Buguardian Vulnerability Management flags this with the CISA due date: 10 Nov 2026. Updated 5 Nov 2026 · Sources: [CISA Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [CISA advisories](https://www.cisa.gov/news-events/cybersecurity-advisories) Where this comes from ## Public sources, read the way Buguardian reads them. Exploited now ### CISA Known Exploited Vulnerabilities The catalog of vulnerabilities confirmed as exploited in the wild, with a remediation due date. Buguardian Vulnerability Management flags these on every matching finding. Advisory ### CISA joint advisories Detailed advisories on active threat groups and techniques, such as #StopRansomware. Buguardian's threat bulletin brings notices like this into one view. Buguardian ### Our articles How the platform works, what changed in the product, and how to read the posture score — written by the Buguardian team. Summaries come from CISA, a US government source in the public domain. Always check the linked source before acting. ## Which of these *affect you?* Buguardian matches exploited vulnerabilities against your own assets and tells you what to fix first. [Book a demo](https://buguardian.com/en/demo.html) [Vulnerability management](https://buguardian.com/en/services.html#vulnerability-management)