Exploited vulnerabilities tracker
CISA's catalog of vulnerabilities confirmed as exploited in the wild: 1769 entries, 35 added in the last 30 days, latest on Nov 6, 2026.
1769 matching
| Added | CVE | Vendor / product | Vulnerability | Severity | Exploit odds | Due |
|---|---|---|---|---|---|---|
| Sep 22, 2026 | CVE-2026-93616 | Check Point · Multiple Products | Check Point Multiple Products Path Traversal Vulnerability | Critical 9.8 | 91.6% | Sep 25, 2026 |
| Sep 22, 2026 | CVE-2026-85102 | Check Point · Multiple Products | Check Point Multiple Products Improper Certificate Validation Vulnerability | Critical 9.8 | 54.1% | Sep 25, 2026 |
| Sep 21, 2026 | CVE-2026-7273 | Zyxel · GS1900 Series Switches | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | High 8.8 | 2.7% | Sep 24, 2026 |
| Sep 18, 2026 | CVE-2026-53266 | Linux · Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | High 8.8 | 0.9% | Sep 21, 2026 |
| Sep 18, 2026 | CVE-2025-39964 | Linux · Kernel | Linux Kernel Race Condition Vulnerability | High 7.8 | 1.6% | Sep 21, 2026 |
| Sep 18, 2026 | CVE-2025-39682 | Linux · Kernel | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | Critical 9.8 | 3.2% | Sep 21, 2026 |
| Sep 16, 2026 | CVE-2026-87886 | Acronis · Backup | Acronis Backup Incorrect Default Permissions Vulnerability | High 7.8 | 0.2% | Sep 19, 2026 |
| Sep 16, 2026 | CVE-2026-76460 | Cisco · Identity Services Engine | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | Critical 10.0 | 75.6% | Sep 19, 2026 |
| Sep 16, 2026 | CVE-2026-58704 | Google · Pixel | Google Pixel Improper Authorization Vulnerability | High 8.8 | 0.6% | Sep 19, 2026 |
| Sep 14, 2026 | CVE-2026-76461 | Cisco · Secure Email Gateway | Cisco Secure Email Gateway SQL Injection Vulnerability | Critical 9.8 | 40.2% | Sep 17, 2026 |
| Sep 11, 2026 | CVE-2026-85706 | GitLab · Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | Critical 10.0 | 97.4% | Sep 14, 2026 |
| Sep 11, 2026 | CVE-2026-84869 | ConnectWise · ScreenConnect | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | Critical 9.9 | 0.9% | Sep 14, 2026 |
| Sep 11, 2026 | CVE-2026-42018 | JFrog · Artifactory | JFrog Artifactory Improper Authentication Vulnerability | High 7.5 | 10.0% | Sep 25, 2026 |
| Sep 11, 2026 | CVE-2026-42016 | JFrog · Artifactory | JFrog Artifactory Incorrect Authorization Vulnerability | High 8.1 | 8.6% | Sep 25, 2026 |
| Sep 10, 2026 | CVE-2026-86060 | MikroTik · RouterOS | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | Critical 9.2 | 6.4% | Sep 13, 2026 |
| Sep 10, 2026 | CVE-2026-67277 | MikroTik · RouterOS | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | High 8.8 | 1.6% | Sep 13, 2026 |
| Sep 9, 2026 | CVE-2026-87491 | Google · Chromium V8 | Google Chromium V8 Out of Bounds Write Vulnerability | High 8.8 | 3.5% | Sep 23, 2026 |
| Sep 9, 2026 | CVE-2026-20079 | Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | Critical 10.0 | 88.7% | Sep 12, 2026 |
| Sep 9, 2026 | CVE-2026-19490 | Citrix · NetScaler | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | Critical 9.3 | 32.7% | Sep 12, 2026 |
| Sep 9, 2026 | CVE-2025-25249 | Fortinet · Multiple Products | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | High 7.4 | 3.7% | Sep 12, 2026 |
| Sep 8, 2026 | CVE-2026-86218 | N-able · N-central | N-able N-central Static Code Injection Vulnerability | Critical 10.0 | 15.4% | Sep 11, 2026 |
| Sep 8, 2026 | CVE-2026-85880 | Microsoft · Windows | Microsoft Windows Heap-Based Buffer Overflow Vulnerability | High 7.8 | 0.4% | Sep 22, 2026 |
| Sep 8, 2026 | CVE-2026-81963 | Microsoft · Windows | Microsoft Windows Link Following Vulnerability | High 7.8 | 0.4% | Sep 22, 2026 |
| Sep 8, 2026 | CVE-2026-75650 | Adobe · Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | Critical 10.0 | 34.7% | Sep 11, 2026 |
| Sep 4, 2026 | CVE-2026-85046 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | High 8.8 | 1.8% | Sep 18, 2026 |
| Sep 2, 2026 | CVE-2026-9586 | Sangoma · Switchvox | Sangoma Switchvox SQL Injection Vulnerability | Critical 9.3 | 19.0% | Sep 5, 2026 |
| Sep 2, 2026 | CVE-2026-83549 | SonicWall · SMA1000 Appliances | SonicWall SMA1000 Appliances OS Command Injection Vulnerability | High 7.8 | 9.9% | Sep 5, 2026 |
| Sep 2, 2026 | CVE-2026-83548 | SonicWall · SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | Critical 10.0 | 8.0% | Sep 5, 2026 |
| Sep 2, 2026 | CVE-2026-82329 | JFrog · Artifactory | JFrog Artifactory Improper Authentication Vulnerability | Critical 9.8 | 14.4% | Sep 5, 2026 |
| Sep 2, 2026 | CVE-2026-59822 | BerriAI · LiteLLM | BerriAI LiteLLM Improper Authentication Vulnerability | High 8.8 | 0.8% | Sep 16, 2026 |
| Sep 2, 2026 | CVE-2026-49869 | Kestra · Kestra OSS | Kestra OSS OS Command Injection Vulnerability | Critical 10.0 | 2.1% | Sep 5, 2026 |
| Sep 2, 2026 | CVE-2026-48710 | Kludex · Starlette | Kludex Starlette HTTP Request/Response Smuggling Vulnerability | Medium 6.5 | 70.3% | Sep 16, 2026 |
| Aug 31, 2026 | CVE-2026-82078 | PaperCut · NG/MF | PaperCut NG/MF Unsafe Reflection Vulnerability | Critical 9.4 | 63.0% | Sep 14, 2026 |
| Aug 31, 2026 | CVE-2026-81578 | PaperCut · NG/MF | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability | High 8.8 | 84.7% | Sep 14, 2026 |
| Aug 27, 2026 | CVE-2026-66384 | JFrog · Artifactory | JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability | Medium 5.3 | 0.7% | Sep 10, 2026 |
| Aug 27, 2026 | CVE-2026-53362 | Linux · Kernel | Linux Kernel Unspecified Vulnerability | High 7.8 | 0.7% | Aug 30, 2026 |
| Aug 27, 2026 | CVE-2023-49105 | ownCloud · ownCloud | ownCloud Improper Authentication Vulnerability | Critical 9.8 | 43.2% | Aug 30, 2026 |
| Aug 26, 2026 | CVE-2026-8452 | Citrix · NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | High 8.8 | 1.0% | Aug 29, 2026 |
| Aug 26, 2026 | CVE-2022-0995 | Linux · Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | High 7.8 | 8.9% | Aug 29, 2026 |
| Aug 26, 2026 | CVE-2021-23758 | Ajax.NET Professional · Ajax.NET Professional | Ajax.NET Professional Deserialization of Untrusted Data Vulnerability | High 8.1 | 82.6% | Sep 9, 2026 |
| Aug 26, 2026 | CVE-2019-1068 | Microsoft · SQL Server | Microsoft SQL Server Remote Code Execution Vulnerability | High 8.8 | 57.3% | Aug 29, 2026 |
| Aug 26, 2026 | CVE-2015-5287 | Red Hat · Automatic Bug Reporting Tool | Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability | High 7.8 | 5.0% | Sep 9, 2026 |
| Aug 26, 2026 | CVE-2015-3246 | Red Hat · Libuser | Red Hat Libuser Race Condition Vulnerability | High 7.4 | 8.5% | Sep 9, 2026 |
| Aug 25, 2026 | CVE-2026-60004 | Gitea · Gitea | Gitea Code Injection Vulnerability | Critical 9.8 | 24.0% | Aug 28, 2026 |
| Aug 24, 2026 | CVE-2026-21962 | Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | Critical 10.0 | 73.2% | Aug 27, 2026 |
| Aug 21, 2026 | CVE-2026-73570 | Synacor · Zimbra Collaboration Suite (ZCS) | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | High 8.9 | 71.7% | Aug 24, 2026 |
| Aug 20, 2026 | CVE-2026-72530 | TrueConf · Server | TrueConf Server Code Injection Vulnerability | Critical 9.0 | 1.7% | Sep 3, 2026 |
| Aug 20, 2026 | CVE-2026-72529 | TrueConf · Server | TrueConf Server Missing Authentication for Critical Function Vulnerability | Critical 9.8 | 1.5% | Aug 23, 2026 |
| Aug 19, 2026 | CVE-2026-64849 | MLflow · MLflow | MLflow Server-Side Request Forgery Vulnerability | Critical 9.3 | 10.0% | Sep 2, 2026 |
| Aug 18, 2026 | CVE-2026-65400 | Apple · macOS | Apple macOS Improper Authentication Vulnerability | Critical 9.8 | 1.7% | Aug 21, 2026 |