Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

156 results · page 1 of 4

Oct 20, 2026Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityCVE-2026-96654 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 6.9
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 14, 2026Ahsay AhsayCBS Improper Authentication VulnerabilityCVE-2026-105133 · Other software · Ahsay · reported by VulDBExploitedMedium 6.9
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Product
AhsayCBS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Ahsay’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vuldb.com vuldb.com
Oct 8, 2026ProFTPD Improper Access Control VulnerabilityCVE-2015-3306 · Other software · ProFTPD · reported by MITREExploitedCritical 10
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Product
ProFTPD
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ProFTPD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Oct 4, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88779 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedHigh 8.7
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Product
NetScaler
On CISA’s list since
Oct 4, 2026 (federal fix deadline Oct 7, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com community.citrix.com
Oct 2, 2026Zammad GmbH Zammad Improper Privilege Management VulnerabilityCVE-2026-102490 · Other software · Zammad GmbH · reported by csirt@divd.nlExploitedCritical 9.4
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
Product
Zammad
On CISA’s list since
Oct 2, 2026 (federal fix deadline Oct 5, 2026)
What to do
Attackers are using this now. Install Zammad GmbH’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog csirt.divd.nl csirt.divd.nl
Sep 27, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88772 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 27, 2026Citrix NetScaler Improper Input Validation VulnerabilityCVE-2026-88771 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 25, 2026Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityCVE-2026-67279 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedMedium 6.9
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
Product
RouterOS
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert.pl cert.pl
Sep 22, 2026Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityCVE-2026-93952 · Other software · Arista · reported by psirt@arista.comExploitedCritical 9.5
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Product
VeloCloud Orchestrator
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arista.com cisa.gov
Sep 22, 2026Check Point Multiple Products Improper Certificate Validation VulnerabilityCVE-2026-85102 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedCritical 9.8
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Product
Multiple Products
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com blog.checkpoint.com
Sep 18, 2026Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityCVE-2025-39682 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedCritical 9.8
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 16, 2026Google Pixel Improper Authorization VulnerabilityCVE-2026-58704 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comExploitedHigh 8.8
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
Product
Pixel
On CISA’s list since
Sep 16, 2026 (federal fix deadline Sep 19, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com cisa.gov
Sep 11, 2026ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityCVE-2026-84869 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49ExploitedCritical 9.9
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
Product
ScreenConnect
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 14, 2026)
What to do
Attackers are using this now. Install ConnectWise’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com connectwise.com
Sep 11, 2026JFrog Artifactory Improper Authentication VulnerabilityCVE-2026-42018 · Other software · JFrog · reported by reefs@jfrog.comExploitedHigh 7.5
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Product
Artifactory
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.jfrog.com docs.jfrog.com
Sep 10, 2026MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command VulnerabilityCVE-2026-86060 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedCritical 9.2
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
Product
RouterOS
On CISA’s list since
Sep 10, 2026 (federal fix deadline Sep 13, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert.pl cert.pl
Sep 8, 2026Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCVE-2026-75650 · Websites & servers · Adobe · reported by AdobeExploitedCritical 10
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
Product
Commerce and Magento
On CISA’s list since
Sep 8, 2026 (federal fix deadline Sep 11, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com cisa.gov
Sep 2, 2026BerriAI LiteLLM Improper Authentication VulnerabilityCVE-2026-59822 · Other software · BerriAI · reported by GitHubExploitedHigh 8.8
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
Product
LiteLLM
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 16, 2026)
What to do
Attackers are using this now. Install BerriAI’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Sep 2, 2026JFrog Artifactory Improper Authentication VulnerabilityCVE-2026-82329 · Other software · JFrog · reported by reefs@jfrog.comExploitedCritical 9.8
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
Product
Artifactory
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.jfrog.com docs.jfrog.com
Aug 27, 2026ownCloud Improper Authentication VulnerabilityCVE-2023-49105 · Other software · ownCloud · reported by MITREExploitedCritical 9.8
ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.
Product
ownCloud
On CISA’s list since
Aug 27, 2026 (federal fix deadline Aug 30, 2026)
What to do
Attackers are using this now. Install ownCloud’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog owncloud.com owncloud.org
Aug 27, 2026JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityCVE-2026-66384 · Other software · JFrog · reported by reefs@jfrog.comExploitedMedium 5.3
JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.
Product
Artifactory
On CISA’s list since
Aug 27, 2026 (federal fix deadline Sep 10, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.jfrog.com docs.jfrog.com
Aug 26, 2026Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-8452 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedHigh 8.8
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.
Product
NetScaler ADC and NetScaler Gateway
On CISA’s list since
Aug 26, 2026 (federal fix deadline Aug 29, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Aug 24, 2026Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityCVE-2026-21962 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 10
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
Product
HTTP Server and Oracle Weblogic Server Proxy Plug-in
On CISA’s list since
Aug 24, 2026 (federal fix deadline Aug 27, 2026)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com github.com
Aug 18, 2026Apple macOS Improper Authentication VulnerabilityCVE-2026-65400 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 9.8
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
Product
macOS
On CISA’s list since
Aug 18, 2026 (federal fix deadline Aug 21, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jul 22, 2026Check Point SmartConsole Improper Authentication VulnerabilityCVE-2026-16232 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedCritical 9.3
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
Product
SmartConsole
On CISA’s list since
Jul 22, 2026 (federal fix deadline Jul 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com cisa.gov
Jul 15, 2026Oracle E-Business Suite Improper Privilege Management VulnerabilityCVE-2026-46817 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
Product
E-Business Suite
On CISA’s list since
Jul 15, 2026 (federal fix deadline Jul 18, 2026)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com cisa.gov
Jul 7, 2026Joomlack Page Builder Improper Access Control VulnerabilityCVE-2026-56290 · Websites & servers · Joomlack · reported by security@joomla.orgExploitedCritical 10
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
Product
Page Builder
On CISA’s list since
Jul 7, 2026 (federal fix deadline Jul 10, 2026)
What to do
Attackers are using this now. Install Joomlack’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog joomlack.fr forum.joomlack.fr
Jun 29, 2026SimpleHelp Authentication Bypass VulnerabilityCVE-2026-48558 · Other software · SimpleHelp · reported by VulnCheckExploitedCritical 9.5
SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.
Product
SimpleHelp
On CISA’s list since
Jun 29, 2026 (federal fix deadline Jul 2, 2026)
What to do
Attackers are using this now. Install SimpleHelp ’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog horizon3.ai simple-help.com
Jun 25, 2026PTC Windchill and FlexPLM Improper Input Validation VulnerabilityCVE-2026-12569 · Other software · PTC · reported by 0b655efc-079c-4cb9-9e8d-164871239f4eExploitedRansomwareCritical 9.3
PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
Product
Windchill and FlexPLM
On CISA’s list since
Jun 25, 2026 (federal fix deadline Jun 28, 2026)
What to do
Attackers are using this now. Install PTC’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ptc.com cisa.gov
Jun 23, 2026Ubiquiti UniFi OS Improper Input Validation VulnerabilityCVE-2026-34910 · Network & remote access · Ubiquiti · reported by support@hackerone.comExploitedCritical 10
Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
Product
UniFi OS
On CISA’s list since
Jun 23, 2026 (federal fix deadline Jun 26, 2026)
What to do
Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.ui.com cisa.gov
Jun 23, 2026Ubiquiti UniFi OS Improper Access Control VulnerabilityCVE-2026-34908 · Network & remote access · Ubiquiti · reported by support@hackerone.comExploitedCritical 10
Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
Product
UniFi OS
On CISA’s list since
Jun 23, 2026 (federal fix deadline Jun 26, 2026)
What to do
Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.ui.com cisa.gov
Jun 16, 2026Widget Factory Joomla Content Editor Improper Access Control VulnerabilityCVE-2026-48907 · Other software · Widget Factory · reported by security@joomla.orgExploitedCritical 10
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
Product
Joomla Content Editor
On CISA’s list since
Jun 16, 2026 (federal fix deadline Jun 19, 2026)
What to do
Attackers are using this now. Install Widget Factory’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog joomlacontenteditor.net cisa.gov
Jun 9, 2026Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output VulnerabilityCVE-2026-20245 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.8
Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Jun 9, 2026 (federal fix deadline Jun 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Jun 8, 2026Check Point Security Gateway Improper Authentication VulnerabilityCVE-2026-50751 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedRansomwareCritical 9.3
Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
Product
Security Gateway
On CISA’s list since
Jun 8, 2026 (federal fix deadline Jun 11, 2026)
What to do
Attackers are using this now. Install Check Point’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com blog.checkpoint.com
Jun 2, 2026Linux Kernel Improper Authentication VulnerabilityCVE-2022-0492 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 7.8
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
Product
Kernel
On CISA’s list since
Jun 2, 2026 (federal fix deadline Jun 5, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 7, 2026Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityCVE-2026-6973 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 7.2
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
May 7, 2026 (federal fix deadline May 10, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog hub.ivanti.com cisa.gov
Apr 24, 2026SimpleHelp Path Traversal VulnerabilityCVE-2024-57728 · Other software · SimpleHelp · reported by MITREExploitedRansomwareHigh 7.2
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
Product
SimpleHelp
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Apr 24, 2026SimpleHelp Missing Authorization VulnerabilityCVE-2024-57726 · Other software · SimpleHelp · reported by MITREExploitedRansomwareCritical 9.9
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
Product
SimpleHelp
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Apr 20, 2026PaperCut NG/MF Improper Authentication VulnerabilityCVE-2023-27351 · Other software · PaperCut · reported by zdi-disclosures@trendmicro.comExploitedRansomwareHigh 7.5
PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.
Product
NG/MF
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install PaperCut’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog papercut.com zerodayinitiative.com
Apr 20, 2026Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityCVE-2025-32975 · Other software · Quest · reported by MITREExploitedCritical 10
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
Product
KACE Systems Management Appliance (SMA)
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Quest’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seralys.com
Apr 16, 2026Apache ActiveMQ Improper Input Validation VulnerabilityCVE-2026-34197 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Product
ActiveMQ
On CISA’s list since
Apr 16, 2026 (federal fix deadline Apr 30, 2026)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog activemq.apache.org openwall.com
Apr 14, 2026Microsoft SharePoint Server Improper Input Validation VulnerabilityCVE-2026-32201 · Email & office · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Product
SharePoint Server
On CISA’s list since
Apr 14, 2026 (federal fix deadline Apr 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Apr 6, 2026Fortinet FortiClient EMS Improper Access Control VulnerabilityCVE-2026-35616 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Product
FortiClient EMS
On CISA’s list since
Apr 6, 2026 (federal fix deadline Apr 9, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Mar 20, 2026Apple Multiple Products Improper Locking VulnerabilityCVE-2025-43510 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 13, 2026Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityCVE-2026-3910 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Mar 13, 2026 (federal fix deadline Mar 27, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Mar 11, 2026n8n Improper Control of Dynamically-Managed Code Resources VulnerabilityCVE-2025-68613 · Other software · n8n · reported by GitHubExploitedCritical 9.9
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
Product
n8n
On CISA’s list since
Mar 11, 2026 (federal fix deadline Mar 25, 2026)
What to do
Attackers are using this now. Install n8n’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Mar 5, 2026Hikvision Multiple Products Improper Authentication VulnerabilityCVE-2017-7921 · Network & remote access · Hikvision · reported by ics-cert@hq.dhs.govExploitedCritical 9.8
Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Hikvision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog hikvision.com securityfocus.com
Feb 10, 2026Microsoft Windows Improper Privilege Management VulnerabilityCVE-2026-21533 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Feb 3, 2026 Sangoma FreePBX Improper Authentication VulnerabilityCVE-2019-19006 · Other software · Sangoma · reported by MITREExploitedCritical 9.8
Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.
Product
FreePBX
On CISA’s list since
Feb 3, 2026 (federal fix deadline Feb 24, 2026)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.freepbx.org pastebin.com
Jan 22, 2026Versa Concerto Improper Authentication VulnerabilityCVE-2025-34026 · Other software · Versa · reported by VulnCheckExploitedCritical 9.2
Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.
Product
Concerto
On CISA’s list since
Jan 22, 2026 (federal fix deadline Feb 12, 2026)
What to do
Attackers are using this now. Install Versa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog projectdiscovery.io projectdiscovery.io
Jan 22, 2026Vite Vitejs Improper Access Control VulnerabilityCVE-2025-31125 · Other software · Vite · reported by GitHubExploitedMedium 5.3
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Product
Vitejs
On CISA’s list since
Jan 22, 2026 (federal fix deadline Feb 12, 2026)
What to do
Attackers are using this now. Install Vite’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.