Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

1,762 results · page 1 of 36

Oct 28, 2026Broadcom VMWare ESX Insufficient Logging VulnerabilityCVE-2026-41709 · Other software · Broadcom · reported by security@vmware.comExploitedLow 2.7
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Product
VMware ESX
On CISA’s list since
Oct 28, 2026 (federal fix deadline Nov 11, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Oct 28, 2026Linux Kernel Missing Initialization of a Variable VulnerabilityCVE-2026-46300 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Product
Kernel
On CISA’s list since
Oct 28, 2026 (federal fix deadline Oct 31, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Oct 27, 2026Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-48356 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.3
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Product
Commerce and Magento
On CISA’s list since
Oct 27, 2026 (federal fix deadline Nov 10, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com sansec.io
Oct 27, 2026Google Brotli Unchecked Return Value VulnerabilityCVE-2026-111497 · Computers, phones & browsers · Google · reported by cve-coordination@google.comExploitedCritical 9.2
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Product
Brotli
On CISA’s list since
Oct 27, 2026 (federal fix deadline Nov 10, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com nodejs.org
Oct 26, 2026PHP Stale Internal Request-State VulnerabilityCVE-2026-109619 · Websites & servers · PHP Group · reported by security@php.netExploitedCritical 9.2
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
Product
PHP
On CISA’s list since
Oct 26, 2026 (federal fix deadline Oct 29, 2026)
What to do
Attackers are using this now. Install PHP Group’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com openwall.com
Oct 26, 2026PHP Memory Corruption VulnerabilityCVE-2026-109618 · Websites & servers · PHP Group · reported by security@php.netExploitedCritical 9.2
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
Product
PHP
On CISA’s list since
Oct 26, 2026 (federal fix deadline Oct 29, 2026)
What to do
Attackers are using this now. Install PHP Group’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com openwall.com
Oct 23, 2026Arista VeloCloud Orchestrator SQL Injection VulnerabilityCVE-2026-114625 · Other software · Arista · reported by psirt@arista.comExploitedCritical 9.4
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Product
VeloCloud Orchestrator
On CISA’s list since
Oct 23, 2026 (federal fix deadline Oct 26, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arista.com cisa.gov
Oct 23, 2026Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCVE-2026-110447 · Other software · Collabora · reported by MITREExploitedCritical 9.2
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Product
Collabora Online – Built-in CODE Server
On CISA’s list since
Oct 23, 2026 (federal fix deadline Oct 26, 2026)
What to do
Attackers are using this now. Install Collabora’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com help.nextcloud.com
Oct 20, 2026Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96655 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 5.3
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 20, 2026Plex Media Server External Control of File Name or Path VulnerabilityCVE-2026-96656 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedHigh 8.6
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 20, 2026EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityCVE-2026-106931 · Other software · EG Secure Solutions · reported by vultures@jpcert.or.jpExploitedHigh 8.5
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Product
SiteGuard Server Edition
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install EG Secure Solutions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp eg-secure.co.jp
Oct 20, 2026Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityCVE-2026-96654 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 6.9
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 20, 2026Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96652 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 5.3
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 20, 2026Siemens Software Center Uncontrolled Search Path Element VulnerabilityCVE-2026-110936 · Other software · Siemens · reported by productcert@siemens.comExploitedHigh 8.4
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Product
Software Center
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Siemens’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert-portal.siemens.com productcert.siemens.com
Oct 16, 2026Fortinet Multiple Products Path Traversal VulnerabilityCVE-2025-61624 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 6
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Product
Multiple Products
On CISA’s list since
Oct 16, 2026 (federal fix deadline Oct 19, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cert-portal.siemens.com
Oct 16, 2026BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityCVE-2026-102764 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.3
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Product
Remote Support
On CISA’s list since
Oct 16, 2026 (federal fix deadline Oct 19, 2026)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog beyondtrustcorp.service-now.com nvd.nist.gov
Oct 15, 2026Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityCVE-2026-21589 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedCritical 9.3
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Product
Multiple Products
On CISA’s list since
Oct 15, 2026 (federal fix deadline Oct 18, 2026)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jira.atlassian.com jira.atlassian.com
Oct 14, 2026Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Product
Secure Email Gateway
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Oct 14, 2026Ahsay AhsayCBS Improper Authentication VulnerabilityCVE-2026-105133 · Other software · Ahsay · reported by VulDBExploitedMedium 6.9
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Product
AhsayCBS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Ahsay’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vuldb.com vuldb.com
Oct 14, 2026Ahsay AhsayCBS Command Injection VulnerabilityCVE-2026-105134 · Other software · Ahsay · reported by VulDBExploitedCritical 10
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Product
AhsayCBS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Ahsay’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vuldb.com vuldb.com
Oct 14, 2026Palo Alto Networks PAN-OS Code Injection VulnerabilityCVE-2026-0322 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.6
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Product
PAN-OS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cisa.gov
Oct 13, 2026Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityCVE-2026-104935 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 8.6
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Product
Connect Secure
On CISA’s list since
Oct 13, 2026 (federal fix deadline Oct 16, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog hub.ivanti.com cisa.gov
Oct 13, 2026Microsoft Windows Command Injection VulnerabilityCVE-2026-96951 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Oct 13, 2026 (federal fix deadline Oct 16, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Oct 8, 2026 ISC BIND Data Processing Errors VulnerabilityCVE-2015-5477 · Other software · ISC · reported by MITREExploitedHigh 7.5
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Product
BIND
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ISC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.juniper.net lists.fedoraproject.org
Oct 8, 2026Apache Struts Command Injection VulnerabilityCVE-2016-3081 · Websites & servers · Apache · reported by Red HatExploitedHigh 8.1
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Product
Struts
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com huawei.com
Oct 8, 2026Strapi Cleartext Storage of Sensitive Information VulnerabilityCVE-2023-22894 · Other software · Strapi · reported by MITREExploitedMedium 4.9
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Product
Strapi
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install Strapi’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com strapi.io
Oct 8, 2026ONLYOFFICE Docs Server Path Traversal VulnerabilityCVE-2021-3199 · Other software · ONLYOFFICE · reported by MITREExploitedCritical 9.8
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Product
Docs
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ONLYOFFICE’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Oct 8, 2026ProFTPD Improper Access Control VulnerabilityCVE-2015-3306 · Other software · ProFTPD · reported by MITREExploitedCritical 10
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Product
ProFTPD
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ProFTPD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Oct 4, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88779 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedHigh 8.7
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Product
NetScaler
On CISA’s list since
Oct 4, 2026 (federal fix deadline Oct 7, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com community.citrix.com
Oct 2, 2026Zammad GmbH Zammad Session Fixation VulnerabilityCVE-2026-102489 · Other software · Zammad GmbH · reported by csirt@divd.nlExploitedCritical 9.4
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Product
Zammad
On CISA’s list since
Oct 2, 2026 (federal fix deadline Oct 5, 2026)
What to do
Attackers are using this now. Install Zammad GmbH’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.zammad.org csirt.divd.nl
Oct 2, 2026Zammad GmbH Zammad Improper Privilege Management VulnerabilityCVE-2026-102490 · Other software · Zammad GmbH · reported by csirt@divd.nlExploitedCritical 9.4
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
Product
Zammad
On CISA’s list since
Oct 2, 2026 (federal fix deadline Oct 5, 2026)
What to do
Attackers are using this now. Install Zammad GmbH’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog csirt.divd.nl csirt.divd.nl
Oct 1, 2026Fortinet FortiMail Path Traversal VulnerabilityCVE-2026-104286 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Product
FortiMail
On CISA’s list since
Oct 1, 2026 (federal fix deadline Oct 4, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Sep 30, 2026Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCVE-2026-76504 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Sep 30, 2026 (federal fix deadline Oct 3, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Sep 29, 2026Apple Multiple Products Out-of-Bounds Write VulnerabilityCVE-2026-86950 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
Sep 29, 2026 (federal fix deadline Oct 13, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 27, 2026Citrix NetScaler Improper Input Validation VulnerabilityCVE-2026-88771 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 27, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88772 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Sep 25, 2026Microsoft SharePoint Code Injection VulnerabilityCVE-2026-65660 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
Product
SharePoint
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com blog.previdian.com
Sep 25, 2026Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityCVE-2026-67279 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedMedium 6.9
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
Product
RouterOS
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert.pl cert.pl
Sep 25, 2026WordPress Core Remote File Inclusion VulnerabilityCVE-2026-87902 · WordPress plugins & themes · reported by support@hackerone.comExploitedHigh 8.1
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
Product
Core
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com patchstack.com
Sep 24, 2026Adobe Commerce and Magento Incorrect Authorization Vulnerability CVE-2026-71362 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.1
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
Product
Commerce and Magento
On CISA’s list since
Sep 24, 2026 (federal fix deadline Sep 27, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com cisa.gov
Sep 24, 2026WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-5430 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8ExploitedCritical 10
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
Product
Multiple Products
On CISA’s list since
Sep 24, 2026 (federal fix deadline Sep 27, 2026)
What to do
Attackers are using this now. Install WSO2’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.docs.wso2.com cisa.gov
Sep 22, 2026F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityCVE-2026-94127 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedCritical 9.3
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
Product
BIG-IP APM
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog my.f5.com cisa.gov
Sep 22, 2026Check Point Multiple Products Improper Certificate Validation VulnerabilityCVE-2026-85102 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedCritical 9.8
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Product
Multiple Products
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com blog.checkpoint.com
Sep 22, 2026Check Point Multiple Products Path Traversal VulnerabilityCVE-2026-93616 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedCritical 9.8
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Product
Multiple Products
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com blog.checkpoint.com
Sep 22, 2026Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityCVE-2026-93952 · Other software · Arista · reported by psirt@arista.comExploitedCritical 9.5
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Product
VeloCloud Orchestrator
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arista.com cisa.gov
Sep 21, 2026Zyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityCVE-2026-7273 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Product
GS1900 Series Switches
On CISA’s list since
Sep 21, 2026 (federal fix deadline Sep 24, 2026)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Sep 18, 2026Linux Kernel Race Condition VulnerabilityCVE-2025-39964 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 18, 2026Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityCVE-2025-39682 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedCritical 9.8
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 18, 2026Linux Kernel Out-of-Bounds Write VulnerabilityCVE-2026-53266 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 8.8
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Sep 16, 2026Acronis Backup Incorrect Default Permissions VulnerabilityCVE-2026-87886 · Other software · Acronis · reported by security@acronis.comExploitedHigh 7.8
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
Product
Backup
On CISA’s list since
Sep 16, 2026 (federal fix deadline Sep 19, 2026)
What to do
Attackers are using this now. Install Acronis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security-advisory.acronis.com cisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.