Exploited vulnerabilities tracker
CISA's catalog of vulnerabilities confirmed as exploited in the wild: 1769 entries, 35 added in the last 30 days, latest on Nov 6, 2026.
1769 matching
| Added | CVE | Vendor / product | Vulnerability | Severity | Exploit odds | Due |
|---|---|---|---|---|---|---|
| Nov 6, 2026 | CVE-2026-19868 | SonicWall · SonicOS SSLVPN | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | High 7.5 | – | Nov 20, 2026 |
| Nov 4, 2026 | CVE-2024-27834 | Apple · Multiple Products | Apple Multiple Products Improper Authentication Vulnerability | Medium 5.5 | 1.5% | Nov 18, 2026 |
| Nov 3, 2026 | CVE-2026-119977 | WordPress · WordPress Core | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | High 8.1 | 1.2% | Nov 6, 2026 |
| Oct 30, 2026 | CVE-2026-118527 | Ivanti · Connect Secure | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Medium 4.3 | 0.8% | Nov 13, 2026 |
| Oct 30, 2026 | CVE-2026-111357 | Ivanti · Connect Secure | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | High 7.0 | 0.5% | Nov 2, 2026 |
| Oct 29, 2026 | CVE-2026-97229 | GitLab · Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | Critical 10.0 | 65.2% | Nov 1, 2026 |
| Oct 29, 2026 | CVE-2026-76418 | Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | High 8.6 | 0.8% | Nov 1, 2026 |
| Oct 28, 2026 | CVE-2026-46300 | Linux · Kernel | Linux Kernel Missing Initialization of a Variable Vulnerability | High 7.8 | 16.1% | Oct 31, 2026 |
| Oct 28, 2026 | CVE-2026-41709 | Broadcom · VMware ESX | Broadcom VMWare ESX Insufficient Logging Vulnerability | Low 2.7 | 0.7% | Nov 11, 2026 |
| Oct 27, 2026 | CVE-2026-48356 | Adobe · Commerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Critical 9.3 | 47.5% | Nov 10, 2026 |
| Oct 27, 2026 | CVE-2026-111497 | Google · Brotli | Google Brotli Unchecked Return Value Vulnerability | Critical 9.2 | 82.6% | Nov 10, 2026 |
| Oct 26, 2026 | CVE-2026-109619 | PHP Group · PHP | PHP Stale Internal Request-State Vulnerability | Critical 9.2 | 100.0% | Oct 29, 2026 |
| Oct 26, 2026 | CVE-2026-109618 | PHP Group · PHP | PHP Memory Corruption Vulnerability | Critical 9.2 | 100.0% | Oct 29, 2026 |
| Oct 23, 2026 | CVE-2026-114625 | Arista · VeloCloud Orchestrator | Arista VeloCloud Orchestrator SQL Injection Vulnerability | Critical 9.9 | 1.0% | Oct 26, 2026 |
| Oct 23, 2026 | CVE-2026-110447 | Collabora · Collabora Online – Built-in CODE Server | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | Critical 9.2 | 73.3% | Oct 26, 2026 |
| Oct 20, 2026 | CVE-2026-96656 | Plex · Media Server | Plex Media Server External Control of File Name or Path Vulnerability | High 7.2 | 1.8% | Oct 23, 2026 |
| Oct 20, 2026 | CVE-2026-96655 | Plex · Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Medium 4.3 | 10.7% | Nov 3, 2026 |
| Oct 20, 2026 | CVE-2026-96654 | Plex · Media Server | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | Medium 6.5 | 1.9% | Oct 23, 2026 |
| Oct 20, 2026 | CVE-2026-96652 | Plex · Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Medium 4.3 | 11.9% | Nov 3, 2026 |
| Oct 20, 2026 | CVE-2026-110936 | Siemens · Software Center | Siemens Software Center Uncontrolled Search Path Element Vulnerability | Medium 6.7 | 1.0% | Nov 3, 2026 |
| Oct 20, 2026 | CVE-2026-106931 | EG Secure Solutions · SiteGuard Server Edition | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | High 7.8 | 2.5% | Oct 23, 2026 |
| Oct 16, 2026 | CVE-2026-102764 | BeyondTrust · Remote Support | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | Critical 9.3 | 78.0% | Oct 19, 2026 |
| Oct 16, 2026 | CVE-2025-61624 | Fortinet · Multiple Products | Fortinet Multiple Products Path Traversal Vulnerability | Medium 5.4 | 1.3% | Oct 19, 2026 |
| Oct 15, 2026 | CVE-2026-21589 | Atlassian · Multiple Products | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Critical 9.3 | 99.7% | Oct 18, 2026 |
| Oct 14, 2026 | CVE-2026-76519 | Cisco · Secure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | Critical 9.8 | 6.2% | Oct 17, 2026 |
| Oct 14, 2026 | CVE-2026-105134 | Ahsay · AhsayCBS | Ahsay AhsayCBS Command Injection Vulnerability | Critical 10.0 | 81.8% | Oct 17, 2026 |
| Oct 14, 2026 | CVE-2026-105133 | Ahsay · AhsayCBS | Ahsay AhsayCBS Improper Authentication Vulnerability | High 7.3 | 79.5% | Oct 17, 2026 |
| Oct 14, 2026 | CVE-2026-0322 | Palo Alto Networks · PAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability | High 8.6 | 1.7% | Oct 17, 2026 |
| Oct 13, 2026 | CVE-2026-96951 | Microsoft · Windows | Microsoft Windows Command Injection Vulnerability | High 8.8 | 9.8% | Oct 16, 2026 |
| Oct 13, 2026 | CVE-2026-104935 | Ivanti · Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | High 8.6 | 88.9% | Oct 16, 2026 |
| Oct 8, 2026 | CVE-2023-22894 | Strapi · Strapi | Strapi Cleartext Storage of Sensitive Information Vulnerability | High 7.2 | 4.1% | Oct 11, 2026 |
| Oct 8, 2026 | CVE-2021-3199 | ONLYOFFICE · Docs | ONLYOFFICE Docs Server Path Traversal Vulnerability | Critical 9.8 | 30.2% | Oct 11, 2026 |
| Oct 8, 2026 | CVE-2016-3081 | Apache · Struts | Apache Struts Command Injection Vulnerability | High 8.1 | 96.5% | Oct 11, 2026 |
| Oct 8, 2026 | CVE-2015-5477 | ISC · BIND | ISC BIND Data Processing Errors Vulnerability | High 7.5 | 99.6% | Oct 11, 2026 |
| Oct 8, 2026 | CVE-2015-3306 | ProFTPD · ProFTPD | ProFTPD Improper Access Control Vulnerability | Critical 10.0 | 99.5% | Oct 11, 2026 |
| Oct 4, 2026 | CVE-2026-88779 | Citrix · NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | High 8.7 | 11.4% | Oct 7, 2026 |
| Oct 2, 2026 | CVE-2026-102490 | Zammad GmbH · Zammad | Zammad GmbH Zammad Improper Privilege Management Vulnerability | High 8.5 | 10.9% | Oct 5, 2026 |
| Oct 2, 2026 | CVE-2026-102489 | Zammad GmbH · Zammad | Zammad GmbH Zammad Session Fixation Vulnerability | High 8.7 | 22.5% | Oct 5, 2026 |
| Oct 1, 2026 | CVE-2026-104286 | Fortinet · FortiMail | Fortinet FortiMail Path Traversal Vulnerability | Critical 9.8 | 4.6% | Oct 4, 2026 |
| Sep 30, 2026 | CVE-2026-76504 | Cisco · Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | Critical 9.8 | 38.9% | Oct 3, 2026 |
| Sep 29, 2026 | CVE-2026-86950 | Apple · Multiple Products | Apple Multiple Products Out-of-Bounds Write Vulnerability | High 8.8 | 26.2% | Oct 13, 2026 |
| Sep 27, 2026 | CVE-2026-88772 | Citrix · NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | Critical 9.5 | 76.6% | Sep 30, 2026 |
| Sep 27, 2026 | CVE-2026-88771 | Citrix · NetScaler | Citrix NetScaler Improper Input Validation Vulnerability | Critical 9.5 | 81.9% | Sep 30, 2026 |
| Sep 25, 2026 | CVE-2026-87902 | WordPress · Core | WordPress Core Remote File Inclusion Vulnerability | High 8.1 | 95.8% | Sep 28, 2026 |
| Sep 25, 2026 | CVE-2026-67279 | MikroTik · RouterOS | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | Medium 6.9 | 2.3% | Sep 28, 2026 |
| Sep 25, 2026 | CVE-2026-65660 | Microsoft · SharePoint | Microsoft SharePoint Code Injection Vulnerability | High 8.8 | 8.2% | Sep 28, 2026 |
| Sep 24, 2026 | CVE-2026-71362 | Adobe · Commerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | Critical 9.1 | 90.5% | Sep 27, 2026 |
| Sep 24, 2026 | CVE-2026-5430 | WSO2 · Multiple Products | WSO2 Multiple Products Path Traversal Vulnerability | Critical 10.0 | 22.4% | Sep 27, 2026 |
| Sep 22, 2026 | CVE-2026-94127 | F5 · BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | Critical 9.8 | 26.6% | Sep 25, 2026 |
| Sep 22, 2026 | CVE-2026-93952 | Arista · VeloCloud Orchestrator | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | Critical 10.0 | 1.4% | Sep 25, 2026 |