Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

572 results · page 1 of 12

Oct 28, 2026Broadcom VMWare ESX Insufficient Logging VulnerabilityCVE-2026-41709 · Other software · Broadcom · reported by security@vmware.comExploitedLow 2.7
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Product
VMware ESX
On CISA’s list since
Oct 28, 2026 (federal fix deadline Nov 11, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Oct 28, 2026Linux Kernel Missing Initialization of a Variable VulnerabilityCVE-2026-46300 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
Product
Kernel
On CISA’s list since
Oct 28, 2026 (federal fix deadline Oct 31, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Oct 20, 2026Plex Media Server External Control of File Name or Path VulnerabilityCVE-2026-96656 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedHigh 8.6
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 20, 2026Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96655 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 5.3
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 20, 2026Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityCVE-2026-96654 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 6.9
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 20, 2026Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96652 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 5.3
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 15, 2026Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityCVE-2026-21589 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedCritical 9.3
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Product
Multiple Products
On CISA’s list since
Oct 15, 2026 (federal fix deadline Oct 18, 2026)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jira.atlassian.com jira.atlassian.com
Oct 8, 2026Strapi Cleartext Storage of Sensitive Information VulnerabilityCVE-2023-22894 · Other software · Strapi · reported by MITREExploitedMedium 4.9
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Product
Strapi
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install Strapi’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com strapi.io
Oct 4, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88779 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedHigh 8.7
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Product
NetScaler
On CISA’s list since
Oct 4, 2026 (federal fix deadline Oct 7, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com community.citrix.com
Oct 2, 2026Zammad GmbH Zammad Session Fixation VulnerabilityCVE-2026-102489 · Other software · Zammad GmbH · reported by csirt@divd.nlExploitedCritical 9.4
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Product
Zammad
On CISA’s list since
Oct 2, 2026 (federal fix deadline Oct 5, 2026)
What to do
Attackers are using this now. Install Zammad GmbH’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.zammad.org csirt.divd.nl
Sep 30, 2026Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCVE-2026-76504 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Sep 30, 2026 (federal fix deadline Oct 3, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Sep 27, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88772 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 27, 2026Citrix NetScaler Improper Input Validation VulnerabilityCVE-2026-88771 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 21, 2026Zyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityCVE-2026-7273 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Product
GS1900 Series Switches
On CISA’s list since
Sep 21, 2026 (federal fix deadline Sep 24, 2026)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Sep 18, 2026Linux Kernel Race Condition VulnerabilityCVE-2025-39964 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 18, 2026Linux Kernel Out-of-Bounds Write VulnerabilityCVE-2026-53266 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 8.8
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 18, 2026Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityCVE-2025-39682 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedCritical 9.8
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 16, 2026Google Pixel Improper Authorization VulnerabilityCVE-2026-58704 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comExploitedHigh 8.8
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
Product
Pixel
On CISA’s list since
Sep 16, 2026 (federal fix deadline Sep 19, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com cisa.gov
Sep 9, 2026Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-19490 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.3
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
Product
NetScaler
On CISA’s list since
Sep 9, 2026 (federal fix deadline Sep 12, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 2, 2026Kludex Starlette HTTP Request/Response Smuggling VulnerabilityCVE-2026-48710 · Other software · Kludex · reported by GitHubExploitedMedium 6.5
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Product
Starlette
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 16, 2026)
What to do
Attackers are using this now. Install Kludex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog badhost.org github.com
Sep 2, 2026Sangoma Switchvox SQL Injection VulnerabilityCVE-2026-9586 · Other software · Sangoma · reported by 57dba5dd-1a03-47f6-8b36-e84e47d335d8ExploitedCritical 9.3
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Product
Switchvox
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog labs.sra.io sangomakb.atlassian.net
Aug 27, 2026Linux Kernel Unspecified VulnerabilityCVE-2026-53362 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.
Product
Kernel
On CISA’s list since
Aug 27, 2026 (federal fix deadline Aug 30, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Aug 26, 2026Ajax.NET Professional Deserialization of Untrusted Data VulnerabilityCVE-2021-23758 · Other software · Ajax.NET Professional · reported by report@snyk.ioExploitedHigh 8.1
Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Ajax.NET Professional
On CISA’s list since
Aug 26, 2026 (federal fix deadline Sep 9, 2026)
What to do
Attackers are using this now. Install Ajax.NET Professional’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Aug 26, 2026Linux Kernel Out-of-Bounds Write VulnerabilityCVE-2022-0995 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 7.8
Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.
Product
Kernel
On CISA’s list since
Aug 26, 2026 (federal fix deadline Aug 29, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 26, 2026Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-8452 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedHigh 8.8
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.
Product
NetScaler ADC and NetScaler Gateway
On CISA’s list since
Aug 26, 2026 (federal fix deadline Aug 29, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Aug 26, 2026Microsoft SQL Server Remote Code Execution VulnerabilityCVE-2019-1068 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
Product
SQL Server
On CISA’s list since
Aug 26, 2026 (federal fix deadline Aug 29, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Aug 24, 2026Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityCVE-2026-21962 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 10
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
Product
HTTP Server and Oracle Weblogic Server Proxy Plug-in
On CISA’s list since
Aug 24, 2026 (federal fix deadline Aug 27, 2026)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com github.com
Aug 18, 2026Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityCVE-2026-33824 · Email & office · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
Product
Internet Key Exchange (IKE) Service Extensions
On CISA’s list since
Aug 18, 2026 (federal fix deadline Aug 21, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com unit42.paloaltonetworks.com
Jul 27, 2026Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2025-68686 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 5.9
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
Product
FortiOS
On CISA’s list since
Jul 27, 2026 (federal fix deadline Aug 10, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Jul 16, 2026Fortinet FortiSandbox OS Command Injection VulnerabilityCVE-2026-25089 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
Product
FortiSandbox
On CISA’s list since
Jul 16, 2026 (federal fix deadline Jul 19, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Jul 16, 2026Fortinet FortiSandbox OS Command Injection VulnerabilityCVE-2026-39808 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Product
FortiSandbox
On CISA’s list since
Jul 16, 2026 (federal fix deadline Jul 19, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com github.com
Jul 15, 2026KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism VulnerabilityCVE-2023-4346 · Other software · KNX Association · reported by ics-cert@hq.dhs.govExploitedHigh 7.5
KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.
Product
KNX Protocol Connection Authorization Option 1
On CISA’s list since
Jul 15, 2026 (federal fix deadline Jul 29, 2026)
What to do
Attackers are using this now. Install KNX Association’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cisa.gov cisa.gov
Jun 25, 2026PTC Windchill and FlexPLM Improper Input Validation VulnerabilityCVE-2026-12569 · Other software · PTC · reported by 0b655efc-079c-4cb9-9e8d-164871239f4eExploitedRansomwareCritical 9.3
PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
Product
Windchill and FlexPLM
On CISA’s list since
Jun 25, 2026 (federal fix deadline Jun 28, 2026)
What to do
Attackers are using this now. Install PTC’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ptc.com cisa.gov
Jun 23, 2026Lantronix EDS5000 Code Injection VulnerabilityCVE-2025-67038 · Other software · Lantronix · reported by ics-cert@hq.dhs.govExploitedCritical 9.3
Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
Product
EDS5000
On CISA’s list since
Jun 23, 2026 (federal fix deadline Jun 26, 2026)
What to do
Attackers are using this now. Install Lantronix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com cisa.gov
Jun 15, 2026LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following VulnerabilityCVE-2026-54420 · Other software · LiteSpeed · reported by MITREExploitedHigh 8.5
LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.
Product
cPanel Plugin
On CISA’s list since
Jun 15, 2026 (federal fix deadline Jun 18, 2026)
What to do
Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.litespeedtech.com litespeedtech.com
Jun 9, 2026Arista Extensible Operating System Incomplete Comparison with Missing Factors VulnerabilityCVE-2026-7473 · Other software · Arista · reported by psirt@arista.comExploitedMedium 6.9
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
Product
Extensible Operating System
On CISA’s list since
Jun 9, 2026 (federal fix deadline Jun 23, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arista.com arista.com
Jun 2, 2026Linux Kernel Improper Authentication VulnerabilityCVE-2022-0492 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 7.8
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
Product
Kernel
On CISA’s list since
Jun 2, 2026 (federal fix deadline Jun 5, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 27, 2026Nx Console Embedded Malicious Code VulnerabilityCVE-2026-48027 · Other software · Nx · reported by GitHubExploitedRansomwareCritical 9.3
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
Product
Nx Console
On CISA’s list since
May 27, 2026 (federal fix deadline Jun 10, 2026)
What to do
Attackers are using this now. Install Nx’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 21, 2026Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityCVE-2026-34926 · Other software · Trend Micro · reported by security@trendmicro.comExploitedMedium 6.7
Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
Product
Apex One
On CISA’s list since
May 21, 2026 (federal fix deadline Jun 4, 2026)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp success.trendmicro.com
May 20, 2026Microsoft DirectX NULL Byte Overwrite VulnerabilityCVE-2009-1537 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
Product
DirectX
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com blogs.technet.com
May 20, 2026Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2010-0249 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com news.cnet.com
May 20, 2026Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2010-0806 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com osvdb.org
May 15, 2026Microsoft Exchange Server Cross-Site Scripting VulnerabilityCVE-2026-42897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.1
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
Product
Microsoft
On CISA’s list since
May 15, 2026 (federal fix deadline May 29, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 1, 2026Linux Kernel Incorrect Resource Transfer Between Spheres VulnerabilityCVE-2026-31431 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Product
Kernel
On CISA’s list since
May 1, 2026 (federal fix deadline May 15, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Apr 24, 2026D-Link DIR-823X Command Injection VulnerabilityCVE-2025-29635 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.2
D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DIR-823X
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com akamai.com
Apr 23, 2026Marimo Remote Code Execution VulnerabilityCVE-2026-39987 · Other software · Marimo · reported by GitHubExploitedCritical 9.3
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
Product
Marimo
On CISA’s list since
Apr 23, 2026 (federal fix deadline May 7, 2026)
What to do
Attackers are using this now. Install Marimo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 20, 2026Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2026-20133 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Apr 20, 2026Kentico Xperience Path Traversal VulnerabilityCVE-2025-2749 · Other software · Kentico · reported by VulnCheckExploitedHigh 7.2
Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
Product
Kentico Xperience
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com labs.watchtowr.com
Apr 14, 2026Microsoft Office Remote Code ExecutionCVE-2009-0238 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.
Product
Office
On CISA’s list since
Apr 14, 2026 (federal fix deadline Apr 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.zdnet.com isc.sans.org
Apr 13, 2026Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityCVE-2023-21529 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
Product
Exchange Server
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 27, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.