Exploited vulnerabilities

CVEs named in our security coverage, matched against CISA's catalog of flaws known to be exploited in the wild.

350 CVEs covered · Updated as we publish · Page 3 of 7

124 in CISA's known-exploited catalog

SearchVendor

Status

350 CVEs

CVE	Vendor / product	Exploited	Our coverage
CVE-2026-76461	Cisco Secure Email GatewayCisco Secure Email Gateway SQL Injection Vulnerability	Known exploitedAdded Sep 14	Cisco Patches a 9.8-Rated Bug Already Under AttackSep 15 Cisco Gives Federal Agencies Three Days to Patch a Perfect 10Sep 20 Cisco's Maximum-Severity ISE Flaw Gets a 3-Day DeadlineSep 22 Cisco Email Gateway Flaw CVE-2026-76461 Gives Root From One Crafted MessageOct 9 Exploited PAN-OS and Cisco Gateway Flaws Have No WorkaroundsOct 15 Cisco Secure Email Gateway CVE-2026-76519: One Crafted Attachment Reaches RootOct 18
CVE-2025-25249	Fortinet Multiple ProductsFortinet Multiple Products Heap-based Buffer Overflow Vulnerability	Known exploitedAdded Sep 9	Fortinet's January Patch Isn't Stopping an AI-Built RATSep 14 A Fortinet Bug Patched in 2025 Is Now Under AttackSep 17 CISA Adds Cisco FMC, Citrix NetScaler and FortiOS Flaws to Exploited ListSep 30
CVE-2026-87491	Google Chromium V8Google Chromium V8 Out of Bounds Write Vulnerability	Known exploitedAdded Sep 9	Chrome Patches a Second Exploited V8 Bug in Four DaysSep 14 BlueMoon Exploit Kit Spreads to Four Spy Groups in Six DaysSep 26 Chrome Bug Fixed in Chromium Was Used Against NGOs Before Chrome Shipped ItSep 29 CISA Adds Cisco FMC, Citrix NetScaler and FortiOS Flaws to Exploited ListSep 30
CVE-2026-85706	GitLab Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Path Traversal Vulnerability	Known exploitedAdded Sep 11	GitLab Patches a Perfect-10 Bug Attackers Found in a DaySep 13 GitLab Patches AI Gateway Sandbox Escape CVE-2026-90970, Rated 9.9Oct 3 GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex CompilerOct 14 GitLab Patches CVE-2026-110264, a CVSS 10.0 Unauthenticated RCE, in 19.5.1Oct 23
CVE-2026-19490	Citrix NetScalerCitrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability	Known exploitedAdded Sep 9	Citrix NetScaler Bug Lets Attackers Skip Login EntirelySep 13 CISA Adds Cisco FMC, Citrix NetScaler and FortiOS Flaws to Exploited ListSep 30
CVE-2026-18577	N-able N-centralN-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability	Known exploitedAdded Aug 3	N-able Denied Exploits Four Days Before Confirming ThemSep 13
CVE-2026-86218	N-able N-centralN-able N-central Static Code Injection Vulnerability	Known exploitedAdded Sep 8	N-able Denied Exploits Four Days Before Confirming ThemSep 13
CVE-2026-84869	ConnectWise ScreenConnectConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability	Known exploitedAdded Sep 11	ScreenConnect Flaw Let Malware Hop Between Remote Sessions on Its OwnSep 12 ConnectWise Fixes a 9.9-Rated Flaw in ScreenConnect's File TransferSep 14
CVE-2026-42016	JFrog ArtifactoryJFrog Artifactory Incorrect Authorization Vulnerability	Known exploitedAdded Sep 11	Three Chained JFrog Flaws Let Attackers Skip Authentication EntirelySep 12 Attackers Chain Two JFrog Artifactory Bugs to Forge Admin TokensSep 14 JFrog Artifactory: Two Bugs, Two Requests, Admin Access, Now All Three on CISA ListSep 30 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7
CVE-2026-42018	JFrog ArtifactoryJFrog Artifactory Improper Authentication Vulnerability	Known exploitedAdded Sep 11	Three Chained JFrog Flaws Let Attackers Skip Authentication EntirelySep 12 Attackers Chain Two JFrog Artifactory Bugs to Forge Admin TokensSep 14 JFrog Artifactory: Two Bugs, Two Requests, Admin Access, Now All Three on CISA ListSep 30 CISA Has Set a Three-Day Deadline on All 25 Exploited Flaws Since September 12, Against 21 Days in JanuaryOct 7
CVE-2026-82329	JFrog ArtifactoryJFrog Artifactory Improper Authentication Vulnerability	Known exploitedAdded Sep 2	Three Chained JFrog Flaws Let Attackers Skip Authentication EntirelySep 12 Attackers Chain Two JFrog Artifactory Bugs to Forge Admin TokensSep 14 Attackers Exploit a JFrog Artifactory Bug in Four DaysSep 17 JFrog Artifactory: Two Bugs, Two Requests, Admin Access, Now All Three on CISA ListSep 30
CVE-2026-20079	Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementCisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability	Known exploitedAdded Sep 9	CISA Sets Sept. 12 Deadline on Cisco's Perfect-10 Firewall BugSep 11 Sandworm and a Qilin Affiliate Both Hit the Same Cisco BugSep 13 Cisco Confirms Sandworm and Qilin Both Hit Its Firewall SoftwareSep 19 CISA Adds Cisco FMC, Citrix NetScaler and FortiOS Flaws to Exploited ListSep 30
CVE-2026-20316	Cisco Secure Firewall Management Center (FMC)Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability	Known exploitedAdded Jul 29Ransomware	CISA Sets Sept. 12 Deadline on Cisco's Perfect-10 Firewall BugSep 11 Sandworm and a Qilin Affiliate Both Hit the Same Cisco BugSep 13 Cisco Confirms Sandworm and Qilin Both Hit Its Firewall SoftwareSep 19
CVE-2026-67277	MikroTik RouterOSMikroTik RouterOS Missing Authentication for Critical Function Vulnerability	Known exploitedAdded Sep 10	CISA Adds Two of Six Exploited MikroTik RouterOS Flaws to KEVSep 11 MikroTik Patches RouterOS Flaws Attackers Exploited FirstSep 17 CISA Adds a Fourth MikroTrick Bug to Its Exploited ListSep 26 CISA Confirms Which MikroTik Bug Unlocks Full Router TakeoverSep 27
CVE-2026-86060	MikroTik RouterOSMikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability	Known exploitedAdded Sep 10	CISA Adds Two of Six Exploited MikroTik RouterOS Flaws to KEVSep 11 MikroTik Patches RouterOS Flaws Attackers Exploited FirstSep 17 CISA Adds a Fourth MikroTrick Bug to Its Exploited ListSep 26 CISA Confirms Which MikroTik Bug Unlocks Full Router TakeoverSep 27
CVE-2026-85046	Google Chromium V8Google Chromium V8 Type Confusion Vulnerability	Known exploitedAdded Sep 4	Chrome Patches Its Sixth Zero-Day of 2026Sep 10 Chrome Patches a Second Exploited V8 Bug in Four DaysSep 14 BlueMoon Exploit Kit Spreads to Four Spy Groups in Six DaysSep 26 Chrome Bug Fixed in Chromium Was Used Against NGOs Before Chrome Shipped ItSep 29
CVE-2026-11645	Google Chromium V8Google Chromium V8 Out-of-Bounds Read and Write Vulnerability	Known exploitedAdded Jun 9	Chrome Patches Its Sixth Zero-Day of 2026Sep 10 Chrome Patches a Second Exploited V8 Bug in Four DaysSep 14
CVE-2026-2441	Google ChromiumGoogle Chromium CSS Use-After-Free Vulnerability	Known exploitedAdded Feb 17	Chrome Patches Its Sixth Zero-Day of 2026Sep 10 Chrome Patches a Second Exploited V8 Bug in Four DaysSep 14
CVE-2026-3909	Google SkiaGoogle Skia Out-of-Bounds Write Vulnerability	Known exploitedAdded Mar 13	Chrome Patches Its Sixth Zero-Day of 2026Sep 10 Chrome Patches a Second Exploited V8 Bug in Four DaysSep 14
CVE-2026-3910	Google Chromium V8Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability	Known exploitedAdded Mar 13	Chrome Patches Its Sixth Zero-Day of 2026Sep 10 Chrome Patches a Second Exploited V8 Bug in Four DaysSep 14
CVE-2026-5281	Google DawnGoogle Dawn Use-After-Free Vulnerability	Known exploitedAdded Apr 1	Chrome Patches Its Sixth Zero-Day of 2026Sep 10 Chrome Patches a Second Exploited V8 Bug in Four DaysSep 14
CVE-2026-75650	Adobe Commerce and MagentoAdobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability	Known exploitedAdded Sep 8	Adobe Patches Actively Exploited Commerce Zero-DaySep 10 Magento Zero-Day Compromised a Store Within 50 MinutesSep 13 Adobe Patches a Perfect-10 Flaw in Commerce's Template EngineSep 26
CVE-2026-85880	Microsoft WindowsMicrosoft Windows Heap-Based Buffer Overflow Vulnerability	Known exploitedAdded Sep 8	September Patch Tuesday: Two Zero-Days, and a Number Nobody Agrees OnSep 9 BlueMoon Exploit Kit Spreads to Four Spy Groups in Six DaysSep 26 Microsoft's Record 966-Fix Patch Tuesday Has Two Exploited Bugs, Both LocalSep 28 Chrome Bug Fixed in Chromium Was Used Against NGOs Before Chrome Shipped ItSep 29
CVE-2026-81963	Microsoft WindowsMicrosoft Windows Link Following Vulnerability	Known exploitedAdded Sep 8	September Patch Tuesday: Two Zero-Days, and a Number Nobody Agrees OnSep 9 Microsoft's Record 966-Fix Patch Tuesday Has Two Exploited Bugs, Both LocalSep 28
CVE-2026-33096	—	Not in catalog	Anthropic's Claude Exploit Chains Hit Five Targets, Each With LimitsNov 2
CVE-2026-98432	—	Not in catalog	Linux TCP Flaw CVE-2026-98432 Still Unpatched on RHEL and UbuntuOct 31 Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItOct 31 Anthropic's Claude Exploit Chains Hit Five Targets, Each With LimitsNov 2 Go Team Weighs Turning Off Default MPTCP After Linux FlawNov 2
CVE-2026-58608	—	Not in catalog	Orange Tsai's Pwn2Own Edge Chain Ends at a telnet Handler, and the Write-Up Names No CVE and No Patched BuildOct 29
CVE-2026-89078	—	Not in catalog	Alpine's Two GitLab Upgrades Missed a Fix Hidden in RubyOct 29
CVE-2026-93577	—	Not in catalog	Alpine's Two GitLab Upgrades Missed a Fix Hidden in RubyOct 29
CVE-2026-101767	—	Not in catalog	Oracle E-Business Suite CVE-2026-101767: Probing Begins Seven Days After the October PatchOct 28 MuPDF and Foxit Build PDF AES-256 Keys From the Clock, V12 Finds, and Recovery Takes SecondsOct 29
CVE-2026-97631	—	Not in catalog	CVE-2026-97631: One ICMP Packet Can Corrupt EDK II Firmware During PXE Boot, and No Fix Has ShippedOct 28
CVE-2026-105481	—	Not in catalog	Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-106072	—	Not in catalog	Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-21715	—	Not in catalog	Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-48618	—	Not in catalog	Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-48930	—	Not in catalog	Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-48931	—	Not in catalog	Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-105777	—	Not in catalog	GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No WorkaroundOct 27
CVE-2026-16255	—	Not in catalog	GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No WorkaroundOct 27
CVE-2026-96651	—	Not in catalog	Plex2Shell Chains Four Plex Media Server Flaws Into Code Execution, 74 Days After the PatchOct 27
CVE-2026-17191	—	Not in catalog	July's VeloCloud Orchestrator Fixes Do Not Cover Exploited CVE-2026-114625Oct 26
CVE-2026-17192	—	Not in catalog	July's VeloCloud Orchestrator Fixes Do Not Cover Exploited CVE-2026-114625Oct 26
CVE-2026-115560	—	Not in catalog	PHP Has an Unpatched RCE, CVE-2026-115560, That Needs Three Conditions Including a Runtime Serialize-Handler SwitchOct 24 A TCL TV Root Toolkit Leans on a Mali Bug CISA Flagged in 2023, on a 2024 Patch LevelOct 24 PHP2Shell Patches Leave a Third PHP Flaw, CVE-2026-115560, UnfixedOct 25 PHP's CVE-2026-115560 Is Not Fixed by the PHP2Shell Releases, and Has No Patch DateOct 29 CISA Gives Agencies Three Days to Patch PHP2Shell After a Honeypot Caught Working ExploitationOct 29 A Custom PHP2Shell Build Rooted 25 PAN-OS Firewalls, Three Tied to a US Government Environment, Dream SaysOct 29
CVE-2026-112212	—	Not in catalog	GitLab Patches CVE-2026-110264, a CVSS 10.0 Unauthenticated RCE, in 19.5.1Oct 23 GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No WorkaroundOct 27
CVE-2026-12664	—	Not in catalog	GitLab Patches CVE-2026-110264, a CVSS 10.0 Unauthenticated RCE, in 19.5.1Oct 23 GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No WorkaroundOct 27
CVE-2026-105482	—	Not in catalog	Node.js Patches 10 CVEs, Including a Brotli Out-of-Bounds Write OpenAI's Codex Security FoundOct 22 Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-105483	—	Not in catalog	Node.js Patches 10 CVEs, Including a Brotli Out-of-Bounds Write OpenAI's Codex Security FoundOct 22 Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-106069	—	Not in catalog	Node.js Patches 10 CVEs, Including a Brotli Out-of-Bounds Write OpenAI's Codex Security FoundOct 22 Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-106073	—	Not in catalog	Node.js Patches 10 CVEs, Including a Brotli Out-of-Bounds Write OpenAI's Codex Security FoundOct 22 Node.js Fixes 10 CVEs, and Four Are Follow-Ups to Earlier Patches That Did Not HoldOct 27
CVE-2026-106074	—	Not in catalog	Node.js Patches 10 CVEs, Including a Brotli Out-of-Bounds Write OpenAI's Codex Security FoundOct 22