Exploited vulnerabilities

CVEs named in our security coverage, matched against CISA's catalog of flaws known to be exploited in the wild.

350 CVEs covered · Updated as we publish · Page 2 of 7

124 in CISA's known-exploited catalog

SearchVendor

Status

350 CVEs

CVE	Vendor / product	Exploited	Our coverage
CVE-2019-11510	Ivanti Pulse Connect SecureIvanti Pulse Connect Secure Arbitrary File Read Vulnerability	Known exploitedAdded Nov 3Ransomware	FBI Seizes Seven Domains Tied to Integrity Tech's MicroScan and FishHubOct 9 Flax Typhoon Advisory AA26-281A Names Integrity Tech and Eight Old CVEsOct 11 Seven Nations Name Integrity Tech Behind Flax Typhoon Tools as FBI Seizes Seven DomainsOct 13 Why a 2015 BIND Bug Is Now on CISA's Must-Patch List: Inside Advisory AA26-281AOct 18
CVE-2021-22205	GitLab Community and Enterprise EditionsGitLab Community and Enterprise Editions Remote Code Execution Vulnerability	Known exploitedAdded Nov 3Ransomware	FBI Seizes Seven Domains Tied to Integrity Tech's MicroScan and FishHubOct 9 Flax Typhoon Advisory AA26-281A Names Integrity Tech and Eight Old CVEsOct 11 Seven Nations Name Integrity Tech Behind Flax Typhoon Tools as FBI Seizes Seven DomainsOct 13 Why a 2015 BIND Bug Is Now on CISA's Must-Patch List: Inside Advisory AA26-281AOct 18
CVE-2021-3199	ONLYOFFICE DocsONLYOFFICE Docs Server Path Traversal Vulnerability	Known exploitedAdded Oct 8	FBI Seizes Seven Domains Tied to Integrity Tech's MicroScan and FishHubOct 9 CISA Gave Agencies Three Days for Five 2015-2023 Bugs, and Four Come With a Forensic Triage OrderOct 10 Flax Typhoon Advisory AA26-281A Names Integrity Tech and Eight Old CVEsOct 11 CISA Adds Five Bugs, Up to 11 Years Old, to Its Exploited ListOct 11 Seven Nations Name Integrity Tech Behind Flax Typhoon Tools as FBI Seizes Seven DomainsOct 13 Why a 2015 BIND Bug Is Now on CISA's Must-Patch List: Inside Advisory AA26-281AOct 18
CVE-2023-22894	Strapi StrapiStrapi Cleartext Storage of Sensitive Information Vulnerability	Known exploitedAdded Oct 8	FBI Seizes Seven Domains Tied to Integrity Tech's MicroScan and FishHubOct 9 CISA Gave Agencies Three Days for Five 2015-2023 Bugs, and Four Come With a Forensic Triage OrderOct 10 Flax Typhoon Advisory AA26-281A Names Integrity Tech and Eight Old CVEsOct 11 CISA Adds Five Bugs, Up to 11 Years Old, to Its Exploited ListOct 11 Seven Nations Name Integrity Tech Behind Flax Typhoon Tools as FBI Seizes Seven DomainsOct 13 Why a 2015 BIND Bug Is Now on CISA's Must-Patch List: Inside Advisory AA26-281AOct 18
CVE-2014-8361	Realtek SDKRealtek SDK Improper Input Validation Vulnerability	Known exploitedAdded Sep 18	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2021-35394	Realtek Jungle Software Development Kit (SDK)Realtek Jungle SDK Remote Code Execution Vulnerability	Known exploitedAdded Dec 10	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2025-6543	Citrix NetScaler ADC and GatewayCitrix NetScaler ADC and Gateway Buffer Overflow Vulnerability	Known exploitedAdded Jun 30	NetScaler SAML Zero-Day CVE-2026-88779 Was Exploited Days After Two Others, and CISA's Deadline Is TodayOct 7 FortiMail and NetScaler Flaws Were Exploited Before Fixes ShippedOct 15
CVE-2026-21589	Atlassian Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability	Known exploitedAdded Oct 15	Atlassian CVE-2026-21589: A 9.3 File-Access Flaw Hits Every Data Center Version of Eight ProductsOct 6 Atlassian's CVE-2026-21589 Draws Exploit Attempts Two Hours After watchTowr PublishesOct 9 Atlassian CVE-2026-21589 Probed Within Two Hours of Public ExploitOct 15 Atlassian CVE-2026-21589 Reads Files Without a Login in Eight Data Center Products, and Crowd Keeps Its Password in OneOct 16 All 16 CISA Exploited-Flaw Listings in October Carry a Three-Day Deadline, and 13 Add a Forensic-Triage OrderOct 16 Atlassian CVE-2026-21589 Reaches CISA's Exploited List After a Public ExploitOct 17 How a 171-Character JavaScript Payload Runs Code With No Parentheses in V8Oct 17
CVE-2026-87902	WordPress CoreWordPress Core Remote File Inclusion Vulnerability	Known exploitedAdded Sep 25	WordPress CVE-2026-87902: A Page-Template Bug in Every Release Since 4.7, Patched in 7.1.2Oct 6 Atlassian CVE-2026-21589: A 9.3 File-Access Flaw Hits Every Data Center Version of Eight ProductsOct 6 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7 FortiMail CVE-2026-104286: Unauthenticated File Write Exploited at Disclosure, With No Fixed Build YetOct 7
CVE-2026-88779	Citrix NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	Known exploitedAdded Oct 4	NetScaler CVE-2026-88779 Is Rated Denial of Service, but a Researcher Reports a Payload DownloadOct 5 Citrix's September 27 NetScaler Fix Does Not Cover CVE-2026-88779, Now on CISA's Exploited ListOct 6 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7 NetScaler SAML Zero-Day CVE-2026-88779 Was Exploited Days After Two Others, and CISA's Deadline Is TodayOct 7 Citrix NetScaler Gets Two Exploited Flaws, Then a Third in a WeekOct 8 Citrix's Third NetScaler Zero-Day in Seven Days Crashes Appliances Already PatchedOct 9 Citrix Patches NetScaler CVE-2026-107406, a 9.5 Memory Overflow Reachable Only on SAML AppliancesOct 11 Citrix NetScaler Zero-Day Attack Copies nsconfig to a Public Web PathOct 13 FortiMail and NetScaler Flaws Were Exploited Before Fixes ShippedOct 15 Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17
CVE-2026-102489	Zammad GmbH ZammadZammad GmbH Zammad Session Fixation Vulnerability	Known exploitedAdded Oct 2	CISA Lists Two Zammad Flaws as Exploited; the Root-Escalation Bug Has No PatchOct 3 Zammad Flaws That Breached a Dutch Security Nonprofit Land on CISA's Exploited ListOct 4 Two Zammad Zero-Days Took an Attacker From Session Hijack to Root at the Dutch Institute for Vulnerability DisclosureOct 4 Zammad Flaws Used Against DIVD Reach CISA's Exploited ListOct 5 DIVD Says an AI Agent Chained Two Zammad Zero-Days to Reach Root, and One Flaw Is Still UnpatchedOct 7 Zammad Disputes DIVD Over Two Zero-Days Now on CISA's Exploited ListOct 9 Zammad's Two Chained Flaws Hit CISA's Exploited List Before a Root Fix Was NamedOct 12
CVE-2026-102490	Zammad GmbH ZammadZammad GmbH Zammad Improper Privilege Management Vulnerability	Known exploitedAdded Oct 2	CISA Lists Two Zammad Flaws as Exploited; the Root-Escalation Bug Has No PatchOct 3 Zammad Flaws That Breached a Dutch Security Nonprofit Land on CISA's Exploited ListOct 4 Two Zammad Zero-Days Took an Attacker From Session Hijack to Root at the Dutch Institute for Vulnerability DisclosureOct 4 Zammad Flaws Used Against DIVD Reach CISA's Exploited ListOct 5 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7 DIVD Says an AI Agent Chained Two Zammad Zero-Days to Reach Root, and One Flaw Is Still UnpatchedOct 7 Zammad Disputes DIVD Over Two Zero-Days Now on CISA's Exploited ListOct 9 Zammad's Two Chained Flaws Hit CISA's Exploited List Before a Root Fix Was NamedOct 12
CVE-2026-20127	Cisco Catalyst SD-WAN Controller and ManagerCisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability	Known exploitedAdded Feb 25	Cisco SD-WAN Manager Auth Bypass Exploited, With No WorkaroundOct 2 Cisco SD-WAN Manager Flaw CVE-2026-76504 Needs One Encoded Character for Admin API Access, With No WorkaroundOct 5 Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Has No WorkaroundOct 8
CVE-2026-20182	Cisco Catalyst SD-WANCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability	Known exploitedAdded May 14	Cisco SD-WAN Manager Auth Bypass Exploited, With No WorkaroundOct 2 Cisco SD-WAN Manager Flaw CVE-2026-76504 Needs One Encoded Character for Admin API Access, With No WorkaroundOct 5 Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Has No WorkaroundOct 8
CVE-2026-20245	Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability	Known exploitedAdded Jun 9	Cisco SD-WAN Manager Auth Bypass Exploited, With No WorkaroundOct 2 Cisco SD-WAN Manager Flaw CVE-2026-76504 Needs One Encoded Character for Admin API Access, With No WorkaroundOct 5 Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Has No WorkaroundOct 8
CVE-2026-20262	Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability	Known exploitedAdded Jun 15	Cisco SD-WAN Manager Auth Bypass Exploited, With No WorkaroundOct 2 Cisco SD-WAN Manager Flaw CVE-2026-76504 Needs One Encoded Character for Admin API Access, With No WorkaroundOct 5 Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Has No WorkaroundOct 8
CVE-2026-104286	Fortinet FortiMailFortinet FortiMail Path Traversal Vulnerability	Known exploitedAdded Oct 1	Three Exploited Edge Flaws Test CISA's Three-Day Patch DeadlineOct 2 Fortinet FortiMail Path-Traversal Flaw Exploited Before Fixes ShipOct 2 Fortinet FortiMail Zero-Day CVE-2026-104286 Is Exploited Before Patches ShipOct 3 Monta's EV Charging Platform Lets Anyone Impersonate a Station, CISA Advisory SaysOct 4 Zammad Flaws That Breached a Dutch Security Nonprofit Land on CISA's Exploited ListOct 4 FortiMail CVE-2026-104286 Is Exploited With No Fixed Release, and the Workaround Is Turning Off a FeatureOct 4 NetScaler CVE-2026-88779 Is Rated Denial of Service, but a Researcher Reports a Payload DownloadOct 5 FortiMail CVE-2026-104286: Exploited 9.8 Flaw Lets Unauthenticated Requests Write FilesOct 6 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7 FortiMail CVE-2026-104286: Unauthenticated File Write Exploited at Disclosure, With No Fixed Build YetOct 7 NetScaler SAML Zero-Day CVE-2026-88779 Was Exploited Days After Two Others, and CISA's Deadline Is TodayOct 7 Fortinet Confirms FortiMail Flaw CVE-2026-104286 Is Under AttackOct 8 Citrix's Third NetScaler Zero-Day in Seven Days Crashes Appliances Already PatchedOct 9 FortiMail and NetScaler Flaws Were Exploited Before Fixes ShippedOct 15 Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17 FortiMail CVE-2026-104286 Is Exploited, and Fortinet's Fixes Are 8.0.2, 7.6.7 and 7.4.9Oct 24 AhsayCBS 10.3.4 Was Not the Fix, Huntress Found, Before CISA Listed ItOct 25
CVE-2023-46604	Apache ActiveMQApache ActiveMQ Deserialization of Untrusted Data Vulnerability	Known exploitedAdded Nov 2Ransomware	Armatura One Ships an Exposed ActiveMQ Listener and Five Other Flaws, CISA SaysOct 1 Armatura One Access-Control Software Shipped With an ActiveMQ Bug Apache Fixed in 2023Oct 4
CVE-2026-73570	Synacor Zimbra Collaboration Suite (ZCS)Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability	Known exploitedAdded Aug 21	Attackers Probed Zimbra's SNMP Flaw Eight Days After Its PatchOct 1
CVE-2026-76504	Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Hex Encoding Vulnerability	Known exploitedAdded Sep 30	Cisco SD-WAN Manager Flaw Hands Unauthenticated Callers the Admin APIOct 1 Three Exploited Edge Flaws Test CISA's Three-Day Patch DeadlineOct 2 Cisco SD-WAN Manager Auth Bypass Exploited, With No WorkaroundOct 2 Cisco SD-WAN Manager Flaw CVE-2026-76504 Needs One Encoded Character for Admin API Access, With No WorkaroundOct 5 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7 Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Has No WorkaroundOct 8 Cisco Email Gateway Flaw CVE-2026-76461 Gives Root From One Crafted MessageOct 9
CVE-2026-48710	Kludex StarletteKludex Starlette HTTP Request/Response Smuggling Vulnerability	Known exploitedAdded Sep 2	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7
CVE-2026-59822	BerriAI LiteLLMBerriAI LiteLLM Improper Authentication Vulnerability	Known exploitedAdded Sep 2	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7
CVE-2026-42271	BerriAI LiteLLMBerriAI LiteLLM Command Injection Vulnerability	Known exploitedAdded Jun 8	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30
CVE-2026-49869	Kestra Kestra OSSKestra OSS OS Command Injection Vulnerability	Known exploitedAdded Sep 2	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30
CVE-2026-20700	Apple Multiple ProductsApple Multiple Buffer Overflow Vulnerability	Known exploitedAdded Feb 12	Apple's CoreGraphics Zero-Day CVE-2026-86950 Hit Pre-iOS 27 Devices, and Three Outlets Count It DifferentlySep 30 Apple Patches iPhone XR and XS for Exploited CoreGraphics Flaw 28 Days After Newer iPhones Got the FixOct 28
CVE-2026-86950	Apple Multiple ProductsApple Multiple Products Out-of-Bounds Write Vulnerability	Known exploitedAdded Sep 29	Apple's CoreGraphics Zero-Day CVE-2026-86950 Hit Pre-iOS 27 Devices, and Three Outlets Count It DifferentlySep 30 Calif Releases Proof of Concept for Exploited Apple CoreGraphics FlawOct 3 Apple Fixes CoreGraphics Flaw CVE-2026-86950 in iOS 26.7.1 After Meta Reports Targeted AttacksOct 8 Apple's CoreGraphics Zero-Day CVE-2026-86950 Has a CISA Deadline of October 13, Not the October 2 Being ReportedOct 10 CISA Gave Agencies Three Days for Five 2015-2023 Bugs, and Four Come With a Forensic Triage OrderOct 10 All 16 CISA Exploited-Flaw Listings in October Carry a Three-Day Deadline, and 13 Add a Forensic-Triage OrderOct 16 Apple Patches iPhone XR and XS for Exploited CoreGraphics Flaw 28 Days After Newer iPhones Got the FixOct 28
CVE-2026-35273	Oracle PeopleSoft Enterprise PeopleToolsOracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability	Known exploitedAdded Jun 12Ransomware	ShinyHunters Beat PeopleSoft WAF Rules by Encoding One Letter in the URLSep 29
CVE-2026-88771	Citrix NetScalerCitrix NetScaler Improper Input Validation Vulnerability	Known exploitedAdded Sep 27	Citrix Patches Eight NetScaler Flaws, Two Exploited for Remote Code ExecutionSep 29 NetScaler Exploitation Warnings Preceded Citrix's CVE-2026-88771 Disclosure by a DayOct 1 Armatura One Ships an Exposed ActiveMQ Listener and Five Other Flaws, CISA SaysOct 1 Johnson Controls EasyIO Neo Firmware V3.3b64 Fixes a Cleartext Login FlawOct 1 Three Exploited Edge Flaws Test CISA's Three-Day Patch DeadlineOct 2 Citrix Confirms Two NetScaler Zero-Days Exploited Since Early SeptemberOct 2 Citrix NetScaler Zero-Days Are Exploited Without Credentials, and Web Shells Survive the PatchOct 4 NetScaler CVE-2026-88779 Is Rated Denial of Service, but a Researcher Reports a Payload DownloadOct 5 Citrix's September 27 NetScaler Fix Does Not Cover CVE-2026-88779, Now on CISA's Exploited ListOct 6 NetScaler SAML Zero-Day CVE-2026-88779 Was Exploited Days After Two Others, and CISA's Deadline Is TodayOct 7 Citrix NetScaler Gets Two Exploited Flaws, Then a Third in a WeekOct 8 Citrix's Third NetScaler Zero-Day in Seven Days Crashes Appliances Already PatchedOct 9 Citrix Patches NetScaler CVE-2026-107406, a 9.5 Memory Overflow Reachable Only on SAML AppliancesOct 11 Citrix NetScaler Zero-Day Attack Copies nsconfig to a Public Web PathOct 13 FortiMail and NetScaler Flaws Were Exploited Before Fixes ShippedOct 15
CVE-2026-88772	Citrix NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	Known exploitedAdded Sep 27	Citrix Patches Eight NetScaler Flaws, Two Exploited for Remote Code ExecutionSep 29 NetScaler Exploitation Warnings Preceded Citrix's CVE-2026-88771 Disclosure by a DayOct 1 Three Exploited Edge Flaws Test CISA's Three-Day Patch DeadlineOct 2 Citrix Confirms Two NetScaler Zero-Days Exploited Since Early SeptemberOct 2 Citrix NetScaler Zero-Days Are Exploited Without Credentials, and Web Shells Survive the PatchOct 4 Citrix's September 27 NetScaler Fix Does Not Cover CVE-2026-88779, Now on CISA's Exploited ListOct 6 NetScaler SAML Zero-Day CVE-2026-88779 Was Exploited Days After Two Others, and CISA's Deadline Is TodayOct 7 Citrix NetScaler Gets Two Exploited Flaws, Then a Third in a WeekOct 8 Citrix's Third NetScaler Zero-Day in Seven Days Crashes Appliances Already PatchedOct 9 Citrix Patches NetScaler CVE-2026-107406, a 9.5 Memory Overflow Reachable Only on SAML AppliancesOct 11 Citrix NetScaler Zero-Day Attack Copies nsconfig to a Public Web PathOct 13 FortiMail and NetScaler Flaws Were Exploited Before Fixes ShippedOct 15
CVE-2023-46747	F5 BIG-IP Configuration UtilityF5 BIG-IP Configuration Utility Authentication Bypass Vulnerability	Known exploitedAdded Oct 31Ransomware	F5 BIG-IP APM Zero-Day CVE-2026-94127 Was Exploited Before Its HotfixSep 28
CVE-2022-29464	WSO2 Multiple ProductsWSO2 Multiple Products Unrestrictive Upload of File Vulnerability	Known exploitedAdded Apr 25Ransomware	CISA's WSO2 Catalog Entry Names the Wrong VulnerabilitySep 27
CVE-2026-65660	Microsoft SharePointMicrosoft SharePoint Code Injection Vulnerability	Known exploitedAdded Sep 25	CISA Gives Agencies 3 Days to Patch an Exploited SharePoint BugSep 26 Microsoft's SharePoint 'Spoofing' Bug Is Really an RCE FlawSep 27 SharePoint CVE-2026-65660 Was Patched as Spoofing, Then Exploited as Code ExecutionSep 29 OnePlus 15 Root Chain Needs No Permissions, and OnePlus Threatened Legal Action Over ItSep 29
CVE-2026-67279	MikroTik RouterOSMikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability	Known exploitedAdded Sep 25	CISA Adds a Fourth MikroTrick Bug to Its Exploited ListSep 26 CISA Confirms Which MikroTik Bug Unlocks Full Router TakeoverSep 27
CVE-2026-5430	WSO2 Multiple ProductsWSO2 Multiple Products Path Traversal Vulnerability	Known exploitedAdded Sep 24	CISA Adds WSO2 and Adobe Commerce Bugs to Its Exploited ListSep 25 CISA's WSO2 Catalog Entry Names the Wrong VulnerabilitySep 27
CVE-2026-71362	Adobe Commerce and Magento Adobe Commerce and Magento Incorrect Authorization Vulnerability	Known exploitedAdded Sep 24	CISA Adds WSO2 and Adobe Commerce Bugs to Its Exploited ListSep 25 CISA's WSO2 Catalog Entry Names the Wrong VulnerabilitySep 27
CVE-2026-94127	F5 BIG-IP APMF5 BIG-IP APM Heap-based Buffer Overflow Vulnerability	Known exploitedAdded Sep 22	Arista's Perfect 10.0 Flaw Still Missing Patches for Two TrainsSep 23 F5 BIG-IP APM Zero-Day CVE-2026-94127 Was Exploited Before Its HotfixSep 28 F5 BIG-IP APM Zero-Day CVE-2026-94127 Hits OAuth ServersOct 8 Citrix's Third NetScaler Zero-Day in Seven Days Crashes Appliances Already PatchedOct 9
CVE-2026-85102	Check Point Multiple ProductsCheck Point Multiple Products Improper Certificate Validation Vulnerability	Known exploitedAdded Sep 22	Arista's Perfect 10.0 Flaw Still Missing Patches for Two TrainsSep 23 Check Point Patches Two 9.8-Rated Flaws Under Attack, One Since July 23Sep 28
CVE-2026-93616	Check Point Multiple ProductsCheck Point Multiple Products Path Traversal Vulnerability	Known exploitedAdded Sep 22	Arista's Perfect 10.0 Flaw Still Missing Patches for Two TrainsSep 23 Check Point Patches Two 9.8-Rated Flaws Under Attack, One Since July 23Sep 28
CVE-2026-93952	Arista VeloCloud OrchestratorArista VeloCloud Orchestrator Improper Input Validation Vulnerability	Known exploitedAdded Sep 22	Arista's Perfect 10.0 Flaw Still Missing Patches for Two TrainsSep 23
CVE-2026-7273	Zyxel GS1900 Series SwitchesZyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability	Known exploitedAdded Sep 21	CISA Gives Agencies 3 Days on Zyxel's June-Patched FlawSep 21 996 Zyxel Switches Hacked Through a Bug Patched Since JuneSep 23 Zyxel Switch Flaw Hits 996 Devices in 48 CountriesSep 27 Zyxel GS1900 Switches Were Hit 62 Days After the Patch, 996 Confirmed CompromisedSep 29
CVE-2026-60004	Gitea GiteaGitea Code Injection Vulnerability	Known exploitedAdded Aug 25	Two Days After a Patch, Red Heron Scanned 1,386 Gitea ServersSep 20 996 Zyxel Switches Hacked Through a Bug Patched Since JuneSep 23
CVE-2025-48595	Android FrameworkAndroid Framework Integer Overflow Vulnerability	Known exploitedAdded Jun 2	Google Patches a Pixel Modem Bug That Needed No Tap to ExploitSep 20
CVE-2026-31431	Linux KernelLinux Kernel Incorrect Resource Transfer Between Spheres Vulnerability	Known exploitedAdded May 1	Hitachi Energy Discloses a 9.9 Flaw With No Patch VersionSep 20
CVE-2025-39682	Linux KernelLinux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability	Known exploitedAdded Sep 18	Three Linux Kernel Bugs Land on CISA's List With Mismatched ScoresSep 19 CISA's 3-Day Linux Kernel Deadline Hid a Scoring FightSep 22 CISA's Three Linux Kernel KEV Entries Carry Scores From 7.5 to 9.8, Depending on Who Rates ThemSep 30
CVE-2021-1905	Qualcomm Multiple ChipsetsQualcomm Multiple Chipsets Use-After-Free Vulnerability	Known exploitedAdded Nov 3	Flock Safety Cameras Carry a Universal Hard-Coded KeySep 18
CVE-2025-39964	Linux KernelLinux Kernel Race Condition Vulnerability	Known exploitedAdded Sep 18	CISA Gives Agencies a 3-Day Weekend Deadline for Two Kernel BugsSep 18 Three Linux Kernel Bugs Land on CISA's List With Mismatched ScoresSep 19 CISA's 3-Day Linux Kernel Deadline Hid a Scoring FightSep 22 CISA's Three Linux Kernel KEV Entries Carry Scores From 7.5 to 9.8, Depending on Who Rates ThemSep 30 Linux Kernel Nears 2,000 CVEs Per Release as AI Bug Reports Pile UpOct 2
CVE-2026-53266	Linux KernelLinux Kernel Out-of-Bounds Write Vulnerability	Known exploitedAdded Sep 18	CISA Gives Agencies a 3-Day Weekend Deadline for Two Kernel BugsSep 18 Three Linux Kernel Bugs Land on CISA's List With Mismatched ScoresSep 19 CISA's 3-Day Linux Kernel Deadline Hid a Scoring FightSep 22 CISA's Three Linux Kernel KEV Entries Carry Scores From 7.5 to 9.8, Depending on Who Rates ThemSep 30 Linux Kernel Nears 2,000 CVEs Per Release as AI Bug Reports Pile UpOct 2
CVE-2026-76460	Cisco Identity Services EngineCisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability	Known exploitedAdded Sep 16	Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreSep 17 Cisco Gives Federal Agencies Three Days to Patch a Perfect 10Sep 20 Cisco's Maximum-Severity ISE Flaw Gets a 3-Day DeadlineSep 22
CVE-2026-87886	Acronis BackupAcronis Backup Incorrect Default Permissions Vulnerability	Known exploitedAdded Sep 16	Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreSep 17
CVE-2026-58704	Google PixelGoogle Pixel Improper Authorization Vulnerability	Known exploitedAdded Sep 16	CISA Sets a 3-Day Deadline for an Exploited Pixel FlawSep 16 Google Patches a Pixel Modem Bug That Needed No Tap to ExploitSep 20