Exploited vulnerabilities

CVEs named in our security coverage, matched against CISA's catalog of flaws known to be exploited in the wild.

350 CVEs covered · Updated as we publish · Page 6 of 7

124 in CISA's known-exploited catalog

SearchVendor

Status

350 CVEs

CVE	Vendor / product	Exploited	Our coverage
CVE-2026-53793	—	Not in catalog	Debian Takes rsync 3.5.0 Whole Instead of Backporting 33 CVE FixesOct 1
CVE-2026-53795	—	Not in catalog	Debian Takes rsync 3.5.0 Whole Instead of Backporting 33 CVE FixesOct 1
CVE-2026-53802	—	Not in catalog	Debian Takes rsync 3.5.0 Whole Instead of Backporting 33 CVE FixesOct 1
CVE-2026-53803	—	Not in catalog	Debian Takes rsync 3.5.0 Whole Instead of Backporting 33 CVE FixesOct 1
CVE-2025-68700	—	Not in catalog	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30
CVE-2025-69286	—	Not in catalog	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30
CVE-2026-24770	—	Not in catalog	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30
CVE-2026-28797	—	Not in catalog	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30
CVE-2026-45312	—	Not in catalog	CISA Lists LiteLLM and Kestra Flaws, but Microsoft Saw Different CVEsSep 30
CVE-2026-88778	—	Not in catalog	Citrix Patches Eight NetScaler Flaws, Two Exploited for Remote Code ExecutionSep 29 NetScaler Exploitation Warnings Preceded Citrix's CVE-2026-88771 Disclosure by a DayOct 1 Citrix Confirms Two NetScaler Zero-Days Exploited Since Early SeptemberOct 2 Citrix NetScaler Zero-Days Are Exploited Without Credentials, and Web Shells Survive the PatchOct 4 NetScaler CVE-2026-88779 Is Rated Denial of Service, but a Researcher Reports a Payload DownloadOct 5 Citrix's September 27 NetScaler Fix Does Not Cover CVE-2026-88779, Now on CISA's Exploited ListOct 6 NetScaler SAML Zero-Day CVE-2026-88779 Was Exploited Days After Two Others, and CISA's Deadline Is TodayOct 7 Citrix NetScaler Gets Two Exploited Flaws, Then a Third in a WeekOct 8 Citrix's Third NetScaler Zero-Day in Seven Days Crashes Appliances Already PatchedOct 9 FortiMail and NetScaler Flaws Were Exploited Before Fixes ShippedOct 15
CVE-2026-88773	—	Not in catalog	Citrix Patches Eight NetScaler Flaws, Two Exploited for Remote Code ExecutionSep 29 Citrix Confirms Two NetScaler Zero-Days Exploited Since Early SeptemberOct 2 Citrix's September 27 NetScaler Fix Does Not Cover CVE-2026-88779, Now on CISA's Exploited ListOct 6 Citrix NetScaler Gets Two Exploited Flaws, Then a Third in a WeekOct 8 Citrix NetScaler Zero-Day Attack Copies nsconfig to a Public Web PathOct 13
CVE-2026-88774	—	Not in catalog	Citrix Patches Eight NetScaler Flaws, Two Exploited for Remote Code ExecutionSep 29 Citrix Confirms Two NetScaler Zero-Days Exploited Since Early SeptemberOct 2 Citrix's September 27 NetScaler Fix Does Not Cover CVE-2026-88779, Now on CISA's Exploited ListOct 6 Citrix NetScaler Gets Two Exploited Flaws, Then a Third in a WeekOct 8
CVE-2026-88775	—	Not in catalog	Citrix Patches Eight NetScaler Flaws, Two Exploited for Remote Code ExecutionSep 29 Citrix Confirms Two NetScaler Zero-Days Exploited Since Early SeptemberOct 2 Citrix's September 27 NetScaler Fix Does Not Cover CVE-2026-88779, Now on CISA's Exploited ListOct 6 Citrix NetScaler Gets Two Exploited Flaws, Then a Third in a WeekOct 8
CVE-2026-88777	—	Not in catalog	Citrix Patches Eight NetScaler Flaws, Two Exploited for Remote Code ExecutionSep 29
CVE-2026-18963	—	Not in catalog	Siemens' Edge Platform Still Carried a Keycloak Bug Fixed in AugustSep 28
CVE-2026-67278	—	Not in catalog	CISA Adds a Fourth MikroTrick Bug to Its Exploited ListSep 26
CVE-2026-67281	—	Not in catalog	CISA Adds a Fourth MikroTrick Bug to Its Exploited ListSep 26
CVE-2026-77967	—	Not in catalog	CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightSep 26
CVE-2026-79959	—	Not in catalog	CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightSep 26
CVE-2026-81630	—	Not in catalog	CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightSep 26
CVE-2026-82566	—	Not in catalog	CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightSep 26
CVE-2026-84399	—	Not in catalog	CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightSep 26
CVE-2026-84403	—	Not in catalog	CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightSep 26
CVE-2026-88956	—	Not in catalog	CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightSep 26
CVE-2026-48842	—	Not in catalog	A Four-Month-Old Roundcube Bug Reaches Active ExploitationSep 26 Roundcube Pre-Auth SQL Injection Now Under Active AttackSep 27
CVE-2026-93289	—	Not in catalog	Eufy Patches Three Bugs That Let a Vacuum Be HijackedSep 25
CVE-2026-93290	—	Not in catalog	Eufy Patches Three Bugs That Let a Vacuum Be HijackedSep 25
CVE-2026-93291	—	Not in catalog	Eufy Patches Three Bugs That Let a Vacuum Be HijackedSep 25
CVE-2025-13032	—	Not in catalog	A Double-Fetch Bug in Avast's Sandbox Reaches SYSTEMSep 25
CVE-2026-41679	—	Not in catalog	Paperclip Tops 80,000 Stars, Five Months After a Perfect 10Sep 25 Paperclip Fixed a 10.0 Flaw, Then Leaked API Keys AgainSep 26
CVE-2025-68788	—	Not in catalog	Windows File Notifications Leak Browsing History at 97.8% AccuracySep 25
CVE-2026-92973	—	Not in catalog	SourceHut Fixes a Build-Log XSS Bug Rated Only MediumSep 25
CVE-2026-32996	—	Not in catalog	Veeam's May Patch Beat September's Public Exploit by 4 MonthsSep 24
CVE-2026-88020	—	Not in catalog	OpenPLC Runtime v3 Gets No Fix for a Session-Hijack FlawSep 24
CVE-2025-62626	—	Not in catalog	AMD's Random Number Bug Is Older and Wider Than Its FixSep 24
CVE-2026-68490	—	Not in catalog	cPanel Patches a Root Exploit in Its Calendar ServiceSep 23
CVE-2026-87899	—	Not in catalog	cPanel Patches a Root Exploit in Its Calendar ServiceSep 23
CVE-2026-87900	—	Not in catalog	cPanel Patches a Root Exploit in Its Calendar ServiceSep 23
CVE-2026-87121	—	Not in catalog	lwIP's Fixes for Two Critical Bugs Predate CISA's AdvisorySep 22 lwIP Patches a 9.8-Severity Flaw in Its MQTT ClientSep 25
CVE-2026-91018	—	Not in catalog	lwIP's Fixes for Two Critical Bugs Predate CISA's AdvisorySep 22
CVE-2026-70756	—	Not in catalog	Oracle's September Update Fixes Six Perfect-10 BugsSep 21
CVE-2026-71133	—	Not in catalog	Oracle's September Update Fixes Six Perfect-10 BugsSep 21
CVE-2026-83020	—	Not in catalog	Oracle's September Update Fixes Six Perfect-10 BugsSep 21
CVE-2026-83021	—	Not in catalog	Oracle's September Update Fixes Six Perfect-10 BugsSep 21
CVE-2026-83059	—	Not in catalog	Oracle's September Update Fixes Six Perfect-10 BugsSep 21
CVE-2026-83099	—	Not in catalog	Oracle's September Update Fixes Six Perfect-10 BugsSep 21
CVE-2026-87230	—	Not in catalog	Oracle's September Update Fixes Six Perfect-10 BugsSep 21
CVE-2026-0628	—	Not in catalog	BragJack Hijacks AI Agents Built Into Five BrowsersSep 21
CVE-2026-55945	—	Not in catalog	BragJack Hijacks AI Agents Built Into Five BrowsersSep 21
CVE-2024-3980	—	Not in catalog	Hitachi Energy Discloses a 9.9 Flaw With No Patch VersionSep 20