Exploited vulnerabilities

CVEs named in our security coverage, matched against CISA's catalog of flaws known to be exploited in the wild.

350 CVEs covered · Updated as we publish · Page 5 of 7

124 in CISA's known-exploited catalog

SearchVendor

Status

350 CVEs

CVE	Vendor / product	Exploited	Our coverage
CVE-2026-85097	—	Not in catalog	Bricksforge WordPress Plugin Upload Flaw CVE-2026-85097 Drew 63 Attacking IPs in a DayOct 13
CVE-2025-41450	—	Not in catalog	Danfoss Refrigeration Controllers Hit in Cyberattack on Hundreds of French SupermarketsOct 12
CVE-2026-28745	—	Not in catalog	Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1Oct 12
CVE-2026-29797	—	Not in catalog	Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1Oct 12
CVE-2026-32645	—	Not in catalog	Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1Oct 12
CVE-2026-33272	—	Not in catalog	Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1Oct 12
CVE-2026-33367	—	Not in catalog	Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1Oct 12
CVE-2026-39453	—	Not in catalog	Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1Oct 12
CVE-2026-39460	—	Not in catalog	Red Lion N-Tron 700 Switches: Seven CVEs, SNMP Admin Without a Password, Fix in 3.11.1Oct 12
CVE-2026-100730	—	Not in catalog	Six openPDC and openHistorian CVEs Land, and the Docker Image Gets No FixOct 12
CVE-2026-101022	—	Not in catalog	Six openPDC and openHistorian CVEs Land, and the Docker Image Gets No FixOct 12
CVE-2026-104629	—	Not in catalog	Six openPDC and openHistorian CVEs Land, and the Docker Image Gets No FixOct 12
CVE-2026-105278	—	Not in catalog	Six openPDC and openHistorian CVEs Land, and the Docker Image Gets No FixOct 12
CVE-2026-105281	—	Not in catalog	Six openPDC and openHistorian CVEs Land, and the Docker Image Gets No FixOct 12
CVE-2026-85479	—	Not in catalog	Six openPDC and openHistorian CVEs Land, and the Docker Image Gets No FixOct 12
CVE-2026-107406	—	Not in catalog	Citrix Patches NetScaler CVE-2026-107406, a 9.5 Memory Overflow Reachable Only on SAML AppliancesOct 11 Citrix NetScaler Zero-Day Attack Copies nsconfig to a Public Web PathOct 13
CVE-2025-27918	—	Not in catalog	AnyDesk Linux Root Exploit Is Public. The Fix Shipped in June With No CVEOct 11
CVE-2023-22621	—	Not in catalog	CISA Gave Agencies Three Days for Five 2015-2023 Bugs, and Four Come With a Forensic Triage OrderOct 10 CISA Adds Five Bugs, Up to 11 Years Old, to Its Exploited ListOct 11
CVE-2026-61500	—	Not in catalog	Rejetto HFS CVE-2026-61500, Found With Anthropic's Mythos, Was Probed One Day After DisclosureOct 9 Anthropic's Claude Haiku 4.5 Filed a Fake Murder Tip in July, and Philadelphia Police Heard in OctoberOct 10
CVE-2026-96940	—	Not in catalog	Exchange CVE-2026-96940 Lets Any Mailbox User Read Others' Mail, and Patched Servers Need V2Oct 9
CVE-2025-5352	—	Not in catalog	F5 BIG-IP APM Zero-Day CVE-2026-94127 Hits OAuth ServersOct 8
CVE-2016-10372	—	Not in catalog	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2016-20016	—	Not in catalog	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2023-26801	—	Not in catalog	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2023-41011	—	Not in catalog	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2024-3721	—	Not in catalog	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2025-34037	—	Not in catalog	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2026-87827	—	Not in catalog	Cling Botnet Hides Commands in the STUN Transaction ID and Spreads Through Realtek Flaw CVE-2021-35394Oct 8
CVE-2026-92392	—	Not in catalog	curl Will Ship 22 Vulnerability Fixes in 8.23.0 on October 14, One Rated HIGHOct 7 Curl's HIGH-Rated CVE-2026-92392 Needs a 135 KB Upload and a 23-Byte Payload Area to Reach Code ExecutionOct 21 PHP 8.5.12 Fixes Two Out-of-Memory RCE Bugs; 8.1 and Older Get No Official PatchOct 21
CVE-2021-22901	—	Not in catalog	curl Will Ship 22 Vulnerability Fixes in 8.23.0 on October 14, One Rated HIGHOct 7
CVE-2023-38545	—	Not in catalog	curl Will Ship 22 Vulnerability Fixes in 8.23.0 on October 14, One Rated HIGHOct 7
CVE-2026-80255	—	Not in catalog	curl Will Ship 22 Vulnerability Fixes in 8.23.0 on October 14, One Rated HIGHOct 7
CVE-2026-82208	—	Not in catalog	curl Will Ship 22 Vulnerability Fixes in 8.23.0 on October 14, One Rated HIGHOct 7
CVE-2026-82209	—	Not in catalog	curl Will Ship 22 Vulnerability Fixes in 8.23.0 on October 14, One Rated HIGHOct 7
CVE-2026-90970	—	Not in catalog	GitLab Patches AI Gateway Sandbox Escape CVE-2026-90970, Rated 9.9Oct 3
CVE-2026-93474	—	Not in catalog	Monta's EV Charging Platform Has No Patch for a 9.4 Authentication GapOct 1 Monta's EV Charging Platform Lets Anyone Impersonate a Station, CISA Advisory SaysOct 4
CVE-2026-95102	—	Not in catalog	Monta's EV Charging Platform Has No Patch for a 9.4 Authentication GapOct 1 Monta's EV Charging Platform Lets Anyone Impersonate a Station, CISA Advisory SaysOct 4
CVE-2026-97212	—	Not in catalog	Monta's EV Charging Platform Has No Patch for a 9.4 Authentication GapOct 1 Monta's EV Charging Platform Lets Anyone Impersonate a Station, CISA Advisory SaysOct 4
CVE-2026-97363	—	Not in catalog	Monta's EV Charging Platform Has No Patch for a 9.4 Authentication GapOct 1 Monta's EV Charging Platform Lets Anyone Impersonate a Station, CISA Advisory SaysOct 4
CVE-2026-101104	—	Not in catalog	Monta's EV Charging Platform Has No Patch for a 9.4 Authentication GapOct 1
CVE-2026-96613	—	Not in catalog	Monta's EV Charging Platform Has No Patch for a 9.4 Authentication GapOct 1
CVE-2026-64892	—	Not in catalog	Johnson Controls EasyIO Neo Firmware V3.3b64 Fixes a Cleartext Login FlawOct 1
CVE-2026-64893	—	Not in catalog	Johnson Controls EasyIO Neo Firmware V3.3b64 Fixes a Cleartext Login FlawOct 1
CVE-2026-94591	—	Not in catalog	Armatura One Ships an Exposed ActiveMQ Listener and Five Other Flaws, CISA SaysOct 1 Armatura One Access-Control Software Shipped With an ActiveMQ Bug Apache Fixed in 2023Oct 4
CVE-2026-94592	—	Not in catalog	Armatura One Ships an Exposed ActiveMQ Listener and Five Other Flaws, CISA SaysOct 1 Armatura One Access-Control Software Shipped With an ActiveMQ Bug Apache Fixed in 2023Oct 4
CVE-2026-94593	—	Not in catalog	Armatura One Ships an Exposed ActiveMQ Listener and Five Other Flaws, CISA SaysOct 1 Armatura One Access-Control Software Shipped With an ActiveMQ Bug Apache Fixed in 2023Oct 4
CVE-2026-94594	—	Not in catalog	Armatura One Ships an Exposed ActiveMQ Listener and Five Other Flaws, CISA SaysOct 1 Armatura One Access-Control Software Shipped With an ActiveMQ Bug Apache Fixed in 2023Oct 4
CVE-2026-53784	—	Not in catalog	Debian Takes rsync 3.5.0 Whole Instead of Backporting 33 CVE FixesOct 1
CVE-2026-53785	—	Not in catalog	Debian Takes rsync 3.5.0 Whole Instead of Backporting 33 CVE FixesOct 1
CVE-2026-53791	—	Not in catalog	Debian Takes rsync 3.5.0 Whole Instead of Backporting 33 CVE FixesOct 1