Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

637 results · page 1 of 13

Oct 27, 2026Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-48356 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.3
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Product
Commerce and Magento
On CISA’s list since
Oct 27, 2026 (federal fix deadline Nov 10, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com sansec.io
Oct 27, 2026Google Brotli Unchecked Return Value VulnerabilityCVE-2026-111497 · Computers, phones & browsers · Google · reported by cve-coordination@google.comExploitedCritical 9.2
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Product
Brotli
On CISA’s list since
Oct 27, 2026 (federal fix deadline Nov 10, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com nodejs.org
Oct 26, 2026PHP Memory Corruption VulnerabilityCVE-2026-109618 · Websites & servers · PHP Group · reported by security@php.netExploitedCritical 9.2
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Product
PHP
On CISA’s list since
Oct 26, 2026 (federal fix deadline Oct 29, 2026)
What to do
Attackers are using this now. Install PHP Group’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com seclists.org
Oct 26, 2026PHP Stale Internal Request-State VulnerabilityCVE-2026-109619 · Websites & servers · PHP Group · reported by security@php.netExploitedCritical 9.2
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Product
PHP
On CISA’s list since
Oct 26, 2026 (federal fix deadline Oct 29, 2026)
What to do
Attackers are using this now. Install PHP Group’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com openwall.com
Oct 23, 2026Arista VeloCloud Orchestrator SQL Injection VulnerabilityCVE-2026-114625 · Other software · Arista · reported by psirt@arista.comExploitedCritical 9.4
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Product
VeloCloud Orchestrator
On CISA’s list since
Oct 23, 2026 (federal fix deadline Oct 26, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arista.com cisa.gov
Oct 23, 2026Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCVE-2026-110447 · Other software · Collabora · reported by MITREExploitedCritical 9.2
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Product
Collabora Online – Built-in CODE Server
On CISA’s list since
Oct 23, 2026 (federal fix deadline Oct 26, 2026)
What to do
Attackers are using this now. Install Collabora’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com help.nextcloud.com
Oct 16, 2026BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityCVE-2026-102764 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.3
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Product
Remote Support
On CISA’s list since
Oct 16, 2026 (federal fix deadline Oct 19, 2026)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog beyondtrustcorp.service-now.com nvd.nist.gov
Oct 15, 2026Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityCVE-2026-21589 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedCritical 9.3
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Product
Multiple Products
On CISA’s list since
Oct 15, 2026 (federal fix deadline Oct 18, 2026)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jira.atlassian.com jira.atlassian.com
Oct 14, 2026Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Product
Secure Email Gateway
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Oct 14, 2026Ahsay AhsayCBS Command Injection VulnerabilityCVE-2026-105134 · Other software · Ahsay · reported by VulDBExploitedCritical 10
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Product
AhsayCBS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Ahsay’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vuldb.com vuldb.com
Oct 8, 2026ONLYOFFICE Docs Server Path Traversal VulnerabilityCVE-2021-3199 · Other software · ONLYOFFICE · reported by MITREExploitedCritical 9.8
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Product
Docs
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ONLYOFFICE’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Oct 8, 2026ProFTPD Improper Access Control VulnerabilityCVE-2015-3306 · Other software · ProFTPD · reported by MITREExploitedCritical 10
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Product
ProFTPD
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ProFTPD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Oct 2, 2026Zammad GmbH Zammad Improper Privilege Management VulnerabilityCVE-2026-102490 · Other software · Zammad GmbH · reported by csirt@divd.nlExploitedCritical 9.4
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
Product
Zammad
On CISA’s list since
Oct 2, 2026 (federal fix deadline Oct 5, 2026)
What to do
Attackers are using this now. Install Zammad GmbH’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog csirt.divd.nl csirt.divd.nl
Oct 2, 2026Zammad GmbH Zammad Session Fixation VulnerabilityCVE-2026-102489 · Other software · Zammad GmbH · reported by csirt@divd.nlExploitedCritical 9.4
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Product
Zammad
On CISA’s list since
Oct 2, 2026 (federal fix deadline Oct 5, 2026)
What to do
Attackers are using this now. Install Zammad GmbH’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.zammad.org csirt.divd.nl
Oct 1, 2026Fortinet FortiMail Path Traversal VulnerabilityCVE-2026-104286 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Product
FortiMail
On CISA’s list since
Oct 1, 2026 (federal fix deadline Oct 4, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Sep 30, 2026Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCVE-2026-76504 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Sep 30, 2026 (federal fix deadline Oct 3, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Sep 27, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88772 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 27, 2026Citrix NetScaler Improper Input Validation VulnerabilityCVE-2026-88771 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 24, 2026WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-5430 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8ExploitedCritical 10
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
Product
Multiple Products
On CISA’s list since
Sep 24, 2026 (federal fix deadline Sep 27, 2026)
What to do
Attackers are using this now. Install WSO2’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.docs.wso2.com cisa.gov
Sep 24, 2026Adobe Commerce and Magento Incorrect Authorization Vulnerability CVE-2026-71362 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.1
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
Product
Commerce and Magento
On CISA’s list since
Sep 24, 2026 (federal fix deadline Sep 27, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com cisa.gov
Sep 22, 2026Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityCVE-2026-93952 · Other software · Arista · reported by psirt@arista.comExploitedCritical 9.5
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Product
VeloCloud Orchestrator
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arista.com cisa.gov
Sep 22, 2026F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityCVE-2026-94127 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedCritical 9.3
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
Product
BIG-IP APM
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog my.f5.com cisa.gov
Sep 22, 2026Check Point Multiple Products Path Traversal VulnerabilityCVE-2026-93616 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedCritical 9.8
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Product
Multiple Products
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com blog.checkpoint.com
Sep 22, 2026Check Point Multiple Products Improper Certificate Validation VulnerabilityCVE-2026-85102 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedCritical 9.8
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Product
Multiple Products
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com blog.checkpoint.com
Sep 18, 2026Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityCVE-2025-39682 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedCritical 9.8
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 16, 2026Cisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityCVE-2026-76460 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Product
Identity Services Engine
On CISA’s list since
Sep 16, 2026 (federal fix deadline Sep 19, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Sep 14, 2026Cisco Secure Email Gateway SQL Injection VulnerabilityCVE-2026-76461 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
Product
Secure Email Gateway
On CISA’s list since
Sep 14, 2026 (federal fix deadline Sep 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Sep 11, 2026ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityCVE-2026-84869 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49ExploitedCritical 9.9
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
Product
ScreenConnect
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 14, 2026)
What to do
Attackers are using this now. Install ConnectWise’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com connectwise.com
Sep 11, 2026GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityCVE-2026-85706 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Product
Community Edition and Enterprise Edition
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 14, 2026)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com hackerone.com
Sep 10, 2026MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command VulnerabilityCVE-2026-86060 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedCritical 9.2
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
Product
RouterOS
On CISA’s list since
Sep 10, 2026 (federal fix deadline Sep 13, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert.pl cert.pl
Sep 9, 2026Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-20079 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Product
Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
On CISA’s list since
Sep 9, 2026 (federal fix deadline Sep 12, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com seclists.org
Sep 9, 2026Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-19490 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.3
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
Product
NetScaler
On CISA’s list since
Sep 9, 2026 (federal fix deadline Sep 12, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 8, 2026Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCVE-2026-75650 · Websites & servers · Adobe · reported by AdobeExploitedCritical 10
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
Product
Commerce and Magento
On CISA’s list since
Sep 8, 2026 (federal fix deadline Sep 11, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com cisa.gov
Sep 8, 2026N-able N-central Static Code Injection VulnerabilityCVE-2026-86218 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 10
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
Product
N-central
On CISA’s list since
Sep 8, 2026 (federal fix deadline Sep 11, 2026)
What to do
Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog me.n-able.com cisa.gov
Sep 2, 2026Kestra OSS OS Command Injection VulnerabilityCVE-2026-49869 · Other software · Kestra · reported by GitHubExploitedCritical 10
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
Product
Kestra OSS
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install Kestra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Sep 2, 2026JFrog Artifactory Improper Authentication VulnerabilityCVE-2026-82329 · Other software · JFrog · reported by reefs@jfrog.comExploitedCritical 9.8
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
Product
Artifactory
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.jfrog.com docs.jfrog.com
Sep 2, 2026Sangoma Switchvox SQL Injection VulnerabilityCVE-2026-9586 · Other software · Sangoma · reported by 57dba5dd-1a03-47f6-8b36-e84e47d335d8ExploitedCritical 9.3
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Product
Switchvox
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog labs.sra.io sangomakb.atlassian.net
Sep 2, 2026SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityCVE-2026-83548 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedCritical 10
SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Product
SMA1000 Appliances
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Aug 31, 2026PaperCut NG/MF Unsafe Reflection VulnerabilityCVE-2026-82078 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4ExploitedCritical 9.4
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
Product
NG/MF
On CISA’s list since
Aug 31, 2026 (federal fix deadline Sep 14, 2026)
What to do
Attackers are using this now. Install PaperCut’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog papercut.com github.com
Aug 27, 2026ownCloud Improper Authentication VulnerabilityCVE-2023-49105 · Other software · ownCloud · reported by MITREExploitedCritical 9.8
ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.
Product
ownCloud
On CISA’s list since
Aug 27, 2026 (federal fix deadline Aug 30, 2026)
What to do
Attackers are using this now. Install ownCloud’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog owncloud.com owncloud.org
Aug 25, 2026Gitea Code Injection VulnerabilityCVE-2026-60004 · Other software · Gitea · reported by MITREExploitedCritical 9.8
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Product
Gitea
On CISA’s list since
Aug 25, 2026 (federal fix deadline Aug 28, 2026)
What to do
Attackers are using this now. Install Gitea’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.gitea.com github.com
Aug 24, 2026Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityCVE-2026-21962 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 10
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
Product
HTTP Server and Oracle Weblogic Server Proxy Plug-in
On CISA’s list since
Aug 24, 2026 (federal fix deadline Aug 27, 2026)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com github.com
Aug 20, 2026TrueConf Server Code Injection VulnerabilityCVE-2026-72530 · Other software · TrueConf · reported by vulnerability@kaspersky.comExploitedCritical 9.5
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
Product
Server
On CISA’s list since
Aug 20, 2026 (federal fix deadline Sep 3, 2026)
What to do
Attackers are using this now. Install TrueConf’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ics-cert.kaspersky.com securelist.com
Aug 20, 2026TrueConf Server Missing Authentication for Critical Function VulnerabilityCVE-2026-72529 · Other software · TrueConf · reported by vulnerability@kaspersky.comExploitedCritical 9.3
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
Product
Server
On CISA’s list since
Aug 20, 2026 (federal fix deadline Aug 23, 2026)
What to do
Attackers are using this now. Install TrueConf’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ics-cert.kaspersky.com securelist.com
Aug 19, 2026MLflow Server-Side Request Forgery VulnerabilityCVE-2026-64849 · Other software · MLflow · reported by GitHubExploitedCritical 9.3
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Product
MLflow
On CISA’s list since
Aug 19, 2026 (federal fix deadline Sep 2, 2026)
What to do
Attackers are using this now. Install MLflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Aug 18, 2026Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityCVE-2026-33824 · Email & office · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
Product
Internet Key Exchange (IKE) Service Extensions
On CISA’s list since
Aug 18, 2026 (federal fix deadline Aug 21, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com unit42.paloaltonetworks.com
Aug 18, 2026Broadcom VMware vCenter Path Traversal VulnerabilityCVE-2026-59310 · Other software · Broadcom · reported by security@vmware.comExploitedRansomwareCritical 9.8
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
Product
VMware vCenter
On CISA’s list since
Aug 18, 2026 (federal fix deadline Aug 21, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com medium.com
Aug 18, 2026Microsoft SharePoint Weak Authentication VulnerabilityCVE-2026-55040 · Email & office · Microsoft · reported by secure@microsoft.comExploitedCritical 9.1
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
Product
SharePoint
On CISA’s list since
Aug 18, 2026 (federal fix deadline Aug 21, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com github.com
Aug 18, 2026Apple macOS Improper Authentication VulnerabilityCVE-2026-65400 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 9.8
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
Product
macOS
On CISA’s list since
Aug 18, 2026 (federal fix deadline Aug 21, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Aug 17, 2026Ray-Project Ray Code Injection VulnerabilityCVE-2025-62593 · Other software · Ray-Project · reported by GitHubExploitedCritical 9.4
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.
Product
Ray
On CISA’s list since
Aug 17, 2026 (federal fix deadline Aug 20, 2026)
What to do
Attackers are using this now. Install Ray-Project’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.