Exploited vulnerabilities tracker
CISA's catalog of vulnerabilities confirmed as exploited in the wild: 1769 entries, 30 added in the last 30 days, latest on Nov 6, 2026.
1769 matching
| Added | CVE | Vendor / product | Vulnerability | Severity | Exploit odds | Due |
|---|---|---|---|---|---|---|
| Aug 18, 2026 | CVE-2026-59310 Ransomware | Broadcom · VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability | Critical 9.8 | 61.7% | Aug 21, 2026 |
| Aug 18, 2026 | CVE-2026-55040 | Microsoft · SharePoint | Microsoft SharePoint Weak Authentication Vulnerability | Critical 9.1 | 69.5% | Aug 21, 2026 |
| Aug 18, 2026 | CVE-2026-33824 | Microsoft · Internet Key Exchange (IKE) Service Extensions | Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | Critical 9.8 | 77.1% | Aug 21, 2026 |
| Aug 17, 2026 | CVE-2025-62593 | Ray-Project · Ray | Ray-Project Ray Code Injection Vulnerability | Critical 9.4 | 60.2% | Aug 20, 2026 |
| Aug 11, 2026 | CVE-2026-72898 | Metabase · Metabase | Metabase SQL Injection Vulnerability | Critical 10.0 | 98.8% | Aug 14, 2026 |
| Aug 11, 2026 | CVE-2026-68820 | Microsoft · Windows Ancillary Function Driver for WinSock | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | High 7.0 | 8.6% | Aug 25, 2026 |
| Aug 11, 2026 | CVE-2026-20349 | Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | High 8.6 | 1.0% | Aug 14, 2026 |
| Aug 7, 2026 | CVE-2026-8037 | Progress · LoadMaster | Progress LoadMaster Command Injection Vulnerability | Critical 9.6 | 99.8% | Aug 10, 2026 |
| Aug 5, 2026 | CVE-2026-63077 Ransomware | JetBrains · TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability | Critical 9.8 | 94.9% | Aug 8, 2026 |
| Aug 4, 2026 | CVE-2026-9198 | IBM · Langflow | IBM Langflow Code Injection Vulnerability | Critical 9.8 | 28.7% | Aug 7, 2026 |
| Aug 4, 2026 | CVE-2026-34486 | Apache · Tomcat | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | High 7.5 | 98.5% | Aug 7, 2026 |
| Aug 4, 2026 | CVE-2026-18556 | N-able · N-central | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | High 8.2 | 7.9% | Aug 7, 2026 |
| Aug 3, 2026 | CVE-2026-18577 | N-able · N-central | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | High 8.2 | 14.6% | Aug 6, 2026 |
| Jul 29, 2026 | CVE-2026-20316 Ransomware | Cisco · Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | Medium 5.3 | 35.1% | Aug 1, 2026 |
| Jul 27, 2026 | CVE-2026-16812 | Arista · VeloCloud Orchestrator | Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability | Critical 10.0 | 1.8% | Jul 30, 2026 |
| Jul 27, 2026 | CVE-2025-68686 | Fortinet · FortiOS | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | Medium 5.3 | 29.5% | Aug 10, 2026 |
| Jul 22, 2026 | CVE-2026-50522 | Microsoft · SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | Critical 9.8 | 3.0% | Jul 25, 2026 |
| Jul 22, 2026 | CVE-2026-16232 | Check Point · SmartConsole | Check Point SmartConsole Improper Authentication Vulnerability | Critical 9.3 | 3.5% | Jul 25, 2026 |
| Jul 21, 2026 | CVE-2026-63030 | WordPress · Core | WordPress Core Interpretation Conflict Vulnerability | Critical 9.8 | 10.6% | Jul 24, 2026 |
| Jul 21, 2026 | CVE-2026-60137 | WordPress · Core | WordPress Core SQL Injection Vulnerability | Medium 5.9 | 5.3% | Aug 4, 2026 |
| Jul 21, 2026 | CVE-2026-0770 | Langflow · Langflow | Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability | Critical 9.8 | 62.6% | Jul 24, 2026 |
| Jul 21, 2026 | CVE-2021-27137 | DD-WRT · DD-WRT | DD-WRT Stack-Based Buffer Overflow Vulnerability | High 8.1 | 4.0% | Jul 24, 2026 |
| Jul 16, 2026 | CVE-2026-58644 | Microsoft · SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | Critical 9.8 | 15.9% | Jul 19, 2026 |
| Jul 16, 2026 | CVE-2026-39808 | Fortinet · FortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability | Critical 9.1 | 93.2% | Jul 19, 2026 |
| Jul 16, 2026 | CVE-2026-25089 | Fortinet · FortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability | Critical 9.1 | 76.1% | Jul 19, 2026 |
| Jul 15, 2026 | CVE-2026-46817 | Oracle · E-Business Suite | Oracle E-Business Suite Improper Privilege Management Vulnerability | Critical 9.8 | 12.3% | Jul 18, 2026 |
| Jul 15, 2026 | CVE-2023-4346 | KNX Association · KNX Protocol Connection Authorization Option 1 | KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability | High 7.5 | 1.4% | Jul 29, 2026 |
| Jul 14, 2026 | CVE-2026-56164 | Microsoft · SharePoint Server | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | Medium 5.3 | 1.0% | Jul 17, 2026 |
| Jul 14, 2026 | CVE-2026-56155 | Microsoft · Active Directory Federation Services | Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | High 7.8 | 0.3% | Jul 28, 2026 |
| Jul 14, 2026 | CVE-2026-15410 Ransomware | SonicWall · SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability | High 7.2 | 11.8% | Jul 17, 2026 |
| Jul 14, 2026 | CVE-2026-15409 Ransomware | SonicWall · SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | Critical 10.0 | 6.8% | Jul 17, 2026 |
| Jul 13, 2026 | CVE-2008-4128 | Cisco · IOS | Cisco IOS Cross-Site Request Forgery Vulnerability | High 8.1 | 33.9% | Jul 16, 2026 |
| Jul 10, 2026 | CVE-2026-56291 | Balbooa · Forms | Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | Critical 10.0 | 14.9% | Jul 13, 2026 |
| Jul 10, 2026 | CVE-2026-48939 | iCagenda · iCagenda | iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability | Critical 10.0 | 20.1% | Jul 13, 2026 |
| Jul 7, 2026 | CVE-2026-56290 | Joomlack · Page Builder | Joomlack Page Builder Improper Access Control Vulnerability | Critical 10.0 | 30.9% | Jul 10, 2026 |
| Jul 7, 2026 | CVE-2026-55255 | Langflow · Langflow | Langflow Authorization Bypass Through User-Controlled Key Vulnerability | High 8.4 | 0.9% | Jul 10, 2026 |
| Jul 7, 2026 | CVE-2026-48908 | JoomShaper · SP Page Builder | JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability | Critical 10.0 | 89.2% | Jul 10, 2026 |
| Jul 7, 2026 | CVE-2026-48282 | Adobe · ColdFusion | Adobe ColdFusion Path Traversal Vulnerability | Critical 10.0 | 42.4% | Jul 10, 2026 |
| Jul 1, 2026 | CVE-2026-45659 Ransomware | Microsoft · SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability | High 8.8 | 80.2% | Jul 4, 2026 |
| Jun 29, 2026 | CVE-2026-48558 | SimpleHelp · SimpleHelp | SimpleHelp Authentication Bypass Vulnerability | Critical 10.0 | 80.8% | Jul 2, 2026 |
| Jun 25, 2026 | CVE-2026-20230 | Cisco · Unified Communications Manager | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | High 8.6 | 88.5% | Jun 28, 2026 |
| Jun 25, 2026 | CVE-2026-12569 Ransomware | PTC · Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability | Critical 9.3 | 46.0% | Jun 28, 2026 |
| Jun 23, 2026 | CVE-2026-34910 | Ubiquiti · UniFi OS | Ubiquiti UniFi OS Improper Input Validation Vulnerability | Critical 10.0 | 90.0% | Jun 26, 2026 |
| Jun 23, 2026 | CVE-2026-34909 | Ubiquiti · UniFi OS | Ubiquiti UniFi OS Path Traversal Vulnerability | Critical 10.0 | 69.2% | Jun 26, 2026 |
| Jun 23, 2026 | CVE-2026-34908 | Ubiquiti · UniFi OS | Ubiquiti UniFi OS Improper Access Control Vulnerability | Critical 10.0 | 88.9% | Jun 26, 2026 |
| Jun 23, 2026 | CVE-2025-67038 | Lantronix · EDS5000 | Lantronix EDS5000 Code Injection Vulnerability | Critical 9.8 | 21.1% | Jun 26, 2026 |
| Jun 18, 2026 | CVE-2026-20253 | Splunk · Enterprise | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | Critical 9.8 | 96.9% | Jun 21, 2026 |
| Jun 16, 2026 | CVE-2026-48907 | Widget Factory · Joomla Content Editor | Widget Factory Joomla Content Editor Improper Access Control Vulnerability | Critical 10.0 | 85.4% | Jun 19, 2026 |
| Jun 15, 2026 | CVE-2026-54420 | LiteSpeed · cPanel Plugin | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | High 8.5 | 1.4% | Jun 18, 2026 |
| Jun 15, 2026 | CVE-2026-20262 | Cisco · Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | Medium 6.5 | 29.1% | Jun 29, 2026 |