Weekly CVE Report Finds Siemens, Zyxel and Sogou Attacks Missing From CISA KEV

Between November 2 and November 8, 2026, CVE Watchtower logged 3,570 new CVEs. This weekly CVE report tracks 10 flaws flagged as exploited during that period. Daily Cybersecurity’s intelligence sources flagged seven of them, and none had reached the CISA KEV catalog by its latest release.

The Week in Numbers

• New CVEs: 3,570
• Critical: 311, with 310 scored CVSS 9.0 or higher
• High: 1,220, with 1,216 scored between 7.0 and 8.9
• Flaws flagged by Daily Cybersecurity (DC): 7
• DC flaws that reached CISA KEV: 0
• DC-exclusive flaws: 7
• CISA KEV-only additions: 3

The Intelligence Lead: Daily Cybersecurity vs CISA KEV

For this weekly CVE report, we checked every DC flag against CISA catalog version 2026.11.06.

This week, there is no shared flaw, so there is no lead time to measure. Four DC flags match public attack reports: Siemens, CryptoPayment, Zyxel and Sogou. However, for the Linux kernel, Puppet and OpenSSH flaws, vendors and researchers report no exploitation so far. This is a feed-to-feed comparison, and “Not listed” flaws may still join KEV later.

Exploited Vulnerabilities From CISA KEV Only

Meanwhile, none of last week’s five DC exclusives, including YOOtheme Pro and Oracle EBS, has joined KEV yet.

The Flaws That Stand Out

Siemens SIMATIC IoT2050 (CVE-2026-58115, CVSS 10.0)

The Node-RED interface on these industrial gateways did not require a login. VulnCheck researcher Patrick Garrity saw attackers hit its honeypots by October 30. The attackers deployed malicious flows that fetched a Linux bot, and some planted a backdoor that survives reboots. Version 4.3.4.1 fixes the flaw.

CryptoPayment Gateway (CVE-2026-81648, CVSS 10.0)

This WordPress plugin lets unauthenticated users delete files and read stored wallet credentials. Defused Cyber reported in-the-wild exploitation attempts. Worse, no fix exists, and the plugin directory closed the plugin on August 28.

Sogou Input Method (CVE-2026-120422, CVSS 8.9)

SGTool.exe fetched its configuration over plain HTTP. ESET says the China-aligned group SlippyNunchucks has abused this since July 1, 2026, by hijacking that traffic. Victims received the DarkVigil implant in Hong Kong, Thailand, Japan and other countries.

What Defenders Should Do

• Update SIMATIC IoT2050 to 4.3.4.1, or remove Node-RED.
• Remove the CryptoPayment Gateway plugin, since no patch exists.
• Install the October Zyxel GS1900 firmware and keep switch admin pages off untrusted networks.
• Update Sogou Input Method to 16.10 or later.
• Patch WordPress to 7.1.4 and SonicOS per SonicWall’s advisory.
• Then schedule the Linux kernel, Puppet and OpenSSH fixes.

Get the Full Data

This week, all seven DC flags were still absent from CISA KEV. Four of them already have public attack reports. You can download the full weekly CVE report data in JSON to run your own checks. We will track whether these flaws reach KEV next week.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.