Updated 52 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,754exploited flaws on CISA’s list

33added in the last 30 days

398new WordPress flaws this week

13,868entries in the database

1,754 results · page 1 of 36

Oct 20, 2026Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityCVE-2026-96654 · Other software · PlexExploited
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 20, 2026Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96652 · Other software · PlexExploited
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 20, 2026Siemens Software Center Uncontrolled Search Path Element VulnerabilityCVE-2026-110936 · Other software · SiemensExploited
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Product
Software Center
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Siemens’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 20, 2026EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityCVE-2026-106931 · Other software · EG Secure SolutionsExploited
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Product
SiteGuard Server Edition
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install EG Secure Solutions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 20, 2026Plex Media Server External Control of File Name or Path VulnerabilityCVE-2026-96656 · Other software · PlexExploited
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 20, 2026Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96655 · Other software · PlexExploited
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 16, 2026Fortinet Multiple Products Path Traversal VulnerabilityCVE-2025-61624 · Network & remote access · FortinetExploited
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Product
Multiple Products
On CISA’s list since
Oct 16, 2026 (federal fix deadline Oct 19, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 16, 2026BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityCVE-2026-102764 · Other software · BeyondTrustExploited
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Product
Remote Support
On CISA’s list since
Oct 16, 2026 (federal fix deadline Oct 19, 2026)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 15, 2026Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityCVE-2026-21589 · Websites & servers · AtlassianExploited
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Product
Multiple Products
On CISA’s list since
Oct 15, 2026 (federal fix deadline Oct 18, 2026)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 14, 2026Palo Alto Networks PAN-OS Code Injection VulnerabilityCVE-2026-0322 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Product
PAN-OS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 14, 2026Ahsay AhsayCBS Improper Authentication VulnerabilityCVE-2026-105133 · Other software · AhsayExploited
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Product
AhsayCBS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Ahsay’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 14, 2026Ahsay AhsayCBS Command Injection VulnerabilityCVE-2026-105134 · Other software · AhsayExploited
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Product
AhsayCBS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Ahsay’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 14, 2026Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519 · Network & remote access · CiscoExploited
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Product
Secure Email Gateway
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 13, 2026Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityCVE-2026-104935 · Network & remote access · IvantiExploited
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Product
Connect Secure
On CISA’s list since
Oct 13, 2026 (federal fix deadline Oct 16, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 13, 2026Microsoft Windows Command Injection VulnerabilityCVE-2026-96951 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Oct 13, 2026 (federal fix deadline Oct 16, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 8, 2026 ISC BIND Data Processing Errors VulnerabilityCVE-2015-5477 · Other software · ISCExploited
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Product
BIND
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ISC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 8, 2026Apache Struts Command Injection VulnerabilityCVE-2016-3081 · Websites & servers · ApacheExploited
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Product
Struts
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 8, 2026ONLYOFFICE Docs Server Path Traversal VulnerabilityCVE-2021-3199 · Other software · ONLYOFFICEExploited
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Product
Docs
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ONLYOFFICE’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 8, 2026ProFTPD Improper Access Control VulnerabilityCVE-2015-3306 · Other software · ProFTPDExploited
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Product
ProFTPD
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ProFTPD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 8, 2026Strapi Cleartext Storage of Sensitive Information VulnerabilityCVE-2023-22894 · Other software · StrapiExploited
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Product
Strapi
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install Strapi’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 4, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88779 · Network & remote access · CitrixExploited
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Product
NetScaler
On CISA’s list since
Oct 4, 2026 (federal fix deadline Oct 7, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 2, 2026Zammad GmbH Zammad Session Fixation VulnerabilityCVE-2026-102489 · Other software · Zammad GmbHExploited
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Product
Zammad
On CISA’s list since
Oct 2, 2026 (federal fix deadline Oct 5, 2026)
What to do
Attackers are using this now. Install Zammad GmbH’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 2, 2026Zammad GmbH Zammad Improper Privilege Management VulnerabilityCVE-2026-102490 · Other software · Zammad GmbHExploited
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
Product
Zammad
On CISA’s list since
Oct 2, 2026 (federal fix deadline Oct 5, 2026)
What to do
Attackers are using this now. Install Zammad GmbH’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Oct 1, 2026Fortinet FortiMail Path Traversal VulnerabilityCVE-2026-104286 · Network & remote access · FortinetExploited
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Product
FortiMail
On CISA’s list since
Oct 1, 2026 (federal fix deadline Oct 4, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 30, 2026Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCVE-2026-76504 · Network & remote access · CiscoExploited
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Sep 30, 2026 (federal fix deadline Oct 3, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 29, 2026Apple Multiple Products Out-of-Bounds Write VulnerabilityCVE-2026-86950 · Computers, phones & browsers · AppleExploited
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
Sep 29, 2026 (federal fix deadline Oct 13, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 27, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88772 · Network & remote access · CitrixExploited
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 27, 2026Citrix NetScaler Improper Input Validation VulnerabilityCVE-2026-88771 · Network & remote access · CitrixExploited
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Product
NetScaler
On CISA’s list since
Sep 27, 2026 (federal fix deadline Sep 30, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 25, 2026Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityCVE-2026-67279 · Network & remote access · MikroTikExploited
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
Product
RouterOS
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 25, 2026Microsoft SharePoint Code Injection VulnerabilityCVE-2026-65660 · Email & office · MicrosoftExploited
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
Product
SharePoint
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 25, 2026WordPress Core Remote File Inclusion VulnerabilityCVE-2026-87902 · WordPress plugins & themesExploited
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
Product
Core
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 24, 2026WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-5430 · Other software · WSO2Exploited
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
Product
Multiple Products
On CISA’s list since
Sep 24, 2026 (federal fix deadline Sep 27, 2026)
What to do
Attackers are using this now. Install WSO2’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 24, 2026Adobe Commerce and Magento Incorrect Authorization Vulnerability CVE-2026-71362 · Websites & servers · AdobeExploited
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
Product
Commerce and Magento
On CISA’s list since
Sep 24, 2026 (federal fix deadline Sep 27, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 22, 2026F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityCVE-2026-94127 · Network & remote access · F5Exploited
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
Product
BIG-IP APM
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 22, 2026Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityCVE-2026-93952 · Other software · AristaExploited
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Product
VeloCloud Orchestrator
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 22, 2026Check Point Multiple Products Path Traversal VulnerabilityCVE-2026-93616 · Network & remote access · Check PointExploited
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Product
Multiple Products
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 22, 2026Check Point Multiple Products Improper Certificate Validation VulnerabilityCVE-2026-85102 · Network & remote access · Check PointExploited
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Product
Multiple Products
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 21, 2026Zyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityCVE-2026-7273 · Network & remote access · ZyxelExploited
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Product
GS1900 Series Switches
On CISA’s list since
Sep 21, 2026 (federal fix deadline Sep 24, 2026)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 18, 2026Linux Kernel Race Condition VulnerabilityCVE-2025-39964 · Computers, phones & browsers · LinuxExploited
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 18, 2026Linux Kernel Out-of-Bounds Write VulnerabilityCVE-2026-53266 · Computers, phones & browsers · LinuxExploited
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 18, 2026Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityCVE-2025-39682 · Computers, phones & browsers · LinuxExploited
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Kernel
On CISA’s list since
Sep 18, 2026 (federal fix deadline Sep 21, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 16, 2026Google Pixel Improper Authorization VulnerabilityCVE-2026-58704 · Computers, phones & browsers · GoogleExploited
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
Product
Pixel
On CISA’s list since
Sep 16, 2026 (federal fix deadline Sep 19, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 16, 2026Cisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityCVE-2026-76460 · Network & remote access · CiscoExploited
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Product
Identity Services Engine
On CISA’s list since
Sep 16, 2026 (federal fix deadline Sep 19, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 16, 2026Acronis Backup Incorrect Default Permissions VulnerabilityCVE-2026-87886 · Other software · Acronis · reported by security@acronis.comExploitedHigh 7.8
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
Product
Backup
On CISA’s list since
Sep 16, 2026 (federal fix deadline Sep 19, 2026)
What to do
Attackers are using this now. Install Acronis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog security-advisory.acronis.com cisa.gov
Sep 14, 2026Cisco Secure Email Gateway SQL Injection VulnerabilityCVE-2026-76461 · Network & remote access · CiscoExploited
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
Product
Secure Email Gateway
On CISA’s list since
Sep 14, 2026 (federal fix deadline Sep 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 11, 2026JFrog Artifactory Improper Authentication VulnerabilityCVE-2026-42018 · Other software · JFrogExploited
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Product
Artifactory
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 11, 2026GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityCVE-2026-85706 · Websites & servers · GitLabExploited
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Product
Community Edition and Enterprise Edition
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 14, 2026)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 11, 2026ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityCVE-2026-84869 · Other software · ConnectWiseExploited
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
Product
ScreenConnect
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 14, 2026)
What to do
Attackers are using this now. Install ConnectWise’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 11, 2026JFrog Artifactory Incorrect Authorization VulnerabilityCVE-2026-42016 · Other software · JFrogExploited
JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Product
Artifactory
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Sep 10, 2026MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command VulnerabilityCVE-2026-86060 · Network & remote access · MikroTikExploited
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
Product
RouterOS
On CISA’s list since
Sep 10, 2026 (federal fix deadline Sep 13, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.