Exploited vulnerabilities

CVEs named in our security coverage, matched against CISA's catalog of flaws known to be exploited in the wild.

350 CVEs covered · Updated as we publish · Page 4 of 7

124 in CISA's known-exploited catalog

SearchVendor

Status

350 CVEs

CVE	Vendor / product	Exploited	Our coverage
CVE-2026-96889	—	Not in catalog	Next.js 16.4.1 Fixed Two Critical RCEs on October 14, and GitHub Indexed Them Eight Days LaterOct 22
CVE-2026-107891	—	Not in catalog	musl's regcomp Has Integer Overflows in Every Release Since 0.5.0, and the Fix Is 1.2.7, Not Yet OutOct 22
CVE-2026-40200	—	Not in catalog	musl's regcomp Has Integer Overflows in Every Release Since 0.5.0, and the Fix Is 1.2.7, Not Yet OutOct 22
CVE-2026-6042	—	Not in catalog	musl's regcomp Has Integer Overflows in Every Release Since 0.5.0, and the Fix Is 1.2.7, Not Yet OutOct 22
CVE-2026-109125	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-19630	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-35501	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-50106	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-73206	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-85555	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-94300	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-96405	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-96888	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-97206	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-97313	—	Not in catalog	BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkOct 22
CVE-2026-110264	—	Not in catalog	GitLab Patches a Second CVSS 10.0 Regex Overflow Nine Days After the FirstOct 22 GitLab Patches CVE-2026-110264, a CVSS 10.0 Unauthenticated RCE, in 19.5.1Oct 23 GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No WorkaroundOct 27 Tailworm Lists 11 Tailscale and headscale Findings; 7 Are Fixed in v1.104.4 and None Has a CVEOct 28 Alpine's Two GitLab Upgrades Missed a Fix Hidden in RubyOct 29
CVE-2026-15723	—	Not in catalog	GitLab Patches a Second CVSS 10.0 Regex Overflow Nine Days After the FirstOct 22 GitLab Patches CVE-2026-110264, a CVSS 10.0 Unauthenticated RCE, in 19.5.1Oct 23 GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No WorkaroundOct 27
CVE-2026-111943	—	Not in catalog	Eight eMudhra CA Keys Were Compromised, and Only One Outlet Says HowOct 20 Coolify 4.5.0 Encrypts Stored Secrets and Breaks Three Things Self-Hosters May Rely OnOct 25
CVE-2026-44484	—	Not in catalog	Stealthium Demo Rewrites an AI Model's Weights in GPU Memory, Not on DiskOct 20
CVE-2026-70242	—	Not in catalog	Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-70291	—	Not in catalog	Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-88156	—	Not in catalog	Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-94510	—	Not in catalog	Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-96207	—	Not in catalog	Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-97016	—	Not in catalog	Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-97749	—	Not in catalog	Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-70229	—	Not in catalog	Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17 Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-70187	—	Not in catalog	Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17
CVE-2026-70250	—	Not in catalog	Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17
CVE-2026-88117	—	Not in catalog	Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17
CVE-2026-88119	—	Not in catalog	Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17
CVE-2026-88120	—	Not in catalog	Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17
CVE-2026-88171	—	Not in catalog	Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17
CVE-2026-96934	—	Not in catalog	Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17
CVE-2021-21954	—	Not in catalog	Eufy HomeBase 2 Teardown Reaches a Root Shell on Firmware 3.4.2.2h, With the Case OpenOct 17
CVE-2026-88812	—	Not in catalog	Calif Publishes OpenBSD Root Exploit Built on a 37-Year-Old CounterOct 17
CVE-2026-93536	—	Not in catalog	Calif Publishes OpenBSD Root Exploit Built on a 37-Year-Old CounterOct 17
CVE-2026-93990	—	Not in catalog	Calif Publishes OpenBSD Root Exploit Built on a 37-Year-Old CounterOct 17
CVE-2026-14814	—	Not in catalog	GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex CompilerOct 14
CVE-2026-16301	—	Not in catalog	GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex CompilerOct 14
CVE-2026-81839	—	Not in catalog	GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex CompilerOct 14
CVE-2026-92883	—	Not in catalog	GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex CompilerOct 14
CVE-2026-96893	—	Not in catalog	GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex CompilerOct 14
CVE-2026-108398	—	Not in catalog	Microsoft's October Patch Tuesday Lists 1,413 CVEs by One Count and 1,415 by Another, With One Exploited Windows Shell BugOct 14 Microsoft Patch Tuesday Lists 1,411 Flaws and Floats Risk CohortsOct 15 Windows CVE-2026-96951 Strips Mark of the Web Warnings, and Microsoft Confirms It Was Exploited Before the October 13 FixOct 16 Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17 Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-92707	—	Not in catalog	Microsoft's October Patch Tuesday Lists 1,413 CVEs by One Count and 1,415 by Another, With One Exploited Windows Shell BugOct 14 Microsoft Patch Tuesday Lists 1,411 Flaws and Floats Risk CohortsOct 15 Windows CVE-2026-96951 Strips Mark of the Web Warnings, and Microsoft Confirms It Was Exploited Before the October 13 FixOct 16 Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEsOct 17 Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedOct 18
CVE-2026-102866	—	Not in catalog	Microsoft's October Patch Tuesday Lists 1,413 CVEs by One Count and 1,415 by Another, With One Exploited Windows Shell BugOct 14
CVE-2026-65674	—	Not in catalog	Microsoft's October Patch Tuesday Lists 1,413 CVEs by One Count and 1,415 by Another, With One Exploited Windows Shell BugOct 14
CVE-2026-70571	—	Not in catalog	Microsoft's October Patch Tuesday Lists 1,413 CVEs by One Count and 1,415 by Another, With One Exploited Windows Shell BugOct 14
CVE-2026-105445	—	Not in catalog	Docker Hub Account Conversion Handed Access Tokens to Another User for 25 Months, Rated CVSS 9.4Oct 14
CVE-2026-102255	—	Not in catalog	SonicWall SMA1000 CVSS 10.0 Flaw Draws 135 Attempts From Two IP AddressesOct 13