CyberSecBulletin

Vulnerabilities exploited in the wild

1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.

ScoreVulnerabilityAddedFederal deadlineRansomware use
7.8 High severityCheck Point Multiple Products Incorrect Permission Assignment for Critical Resource
CVE-2026-123039
Nov 13, 2026Nov 16, 2026Not reported
8.6 High severityUnrealIRCd Improper Neutralization of Delimiters
CVE-2026-114713
Nov 13, 2026Nov 16, 2026Not reported
7.5 High severityCisco BroadWorks Improper Restriction of XML External Entity Reference
CVE-2026-20320
Nov 10, 2026Nov 24, 2026Not reported
8.8 High severityGoogle Chromium Use-After-Free
CVE-2026-125350
Nov 10, 2026Nov 24, 2026Not reported
6.5 Medium severityMicrosoft Office Outlook Missing User Interaction for Potentially Unsafe Action
CVE-2026-124194
Nov 10, 2026Nov 24, 2026Not reported
9.8 Critical severityBarracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel
CVE-2026-116606
Nov 10, 2026Nov 13, 2026Not reported
4.3 Medium severityOpenwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres
CVE-2026-111793
Nov 10, 2026Nov 24, 2026Not reported
7.2 High severityBarracuda Networks Multiple Products OS Command Injection
CVE-2026-111560
Nov 10, 2026Nov 13, 2026Not reported
9.8 Critical severityIBM Aspera Faspex Incorrect Authorization
CVE-2026-123218
Nov 9, 2026Nov 12, 2026Not reported
8.1 High severityOpenBSD OpenSSH Unexpected Status Code or Return Value
CVE-2026-123158
Nov 9, 2026Nov 12, 2026Not reported
9.8 Critical severitySignalWire FreeSwitch Code Injection
CVE-2026-116779
Nov 9, 2026Nov 12, 2026Not reported
9.8 Critical severityGPUStack Improper Authentication
CVE-2026-102895
Nov 9, 2026Nov 12, 2026Not reported
7.5 High severitySonicWall SonicOS SSLVPN Use of Single-factor Authentication
CVE-2026-19868
Nov 6, 2026Nov 20, 2026Not reported
5.5 Medium severityApple Multiple Products Improper Authentication
CVE-2024-27834
Nov 4, 2026Nov 18, 2026Not reported
8.1 High severityWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-119977
Nov 3, 2026Nov 6, 2026Not reported
4.3 Medium severityIvanti Connect Secure Generation of Predictable Numbers or Identifiers
CVE-2026-118527
Oct 30, 2026Nov 13, 2026Not reported
7.0 High severityIvanti Connect Secure Missing Authentication for Critical Function
CVE-2026-111357
Oct 30, 2026Nov 2, 2026Not reported
10.0 Critical severityGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound
CVE-2026-97229
Oct 29, 2026Nov 1, 2026Not reported
8.6 High severityCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference
CVE-2026-76418
Oct 29, 2026Nov 1, 2026Not reported
7.8 High severityLinux Kernel Missing Initialization of a Variable
CVE-2026-46300
Oct 28, 2026Oct 31, 2026Not reported
2.7 Low severityBroadcom VMWare ESX Insufficient Logging
CVE-2026-41709
Oct 28, 2026Nov 11, 2026Not reported
9.3 Critical severityAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type
CVE-2026-48356
Oct 27, 2026Nov 10, 2026Not reported
9.8 Critical severityGoogle Brotli Unchecked Return Value
CVE-2026-111497
Oct 27, 2026Nov 10, 2026Not reported
8.1 High severityPHP Stale Internal Request-State
CVE-2026-109619
Oct 26, 2026Oct 29, 2026Not reported
9.8 Critical severityPHP Memory Corruption
CVE-2026-109618
Oct 26, 2026Oct 29, 2026Not reported
9.9 Critical severityArista VeloCloud Orchestrator SQL Injection
CVE-2026-114625
Oct 23, 2026Oct 26, 2026Not reported
9.8 Critical severityCollabora Online – Built-in CODE Server OS Command Injection
CVE-2026-110447
Oct 23, 2026Oct 26, 2026Not reported
7.2 High severityPlex Media Server External Control of File Name or Path
CVE-2026-96656
Oct 20, 2026Oct 23, 2026Not reported
4.3 Medium severityPlex Media Server Server-Side Request Forgery (SSRF)
CVE-2026-96655
Oct 20, 2026Nov 3, 2026Not reported
6.5 Medium severityPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page
CVE-2026-96654
Oct 20, 2026Oct 23, 2026Not reported
4.3 Medium severityPlex Media Server Server-Side Request Forgery (SSRF)
CVE-2026-96652
Oct 20, 2026Nov 3, 2026Not reported
6.7 Medium severitySiemens Software Center Uncontrolled Search Path Element
CVE-2026-110936
Oct 20, 2026Nov 3, 2026Not reported
8.5 High severityEG Secure Solutions SiteGuard Server Edition OS Command Injection
CVE-2026-106931
Oct 20, 2026Oct 23, 2026Not reported
9.8 Critical severityBeyondTrust Remote Support Authentication Bypass by Spoofing
CVE-2026-102764
Oct 16, 2026Oct 19, 2026Not reported
6.5 Medium severityFortinet Multiple Products Path Traversal
CVE-2025-61624
Oct 16, 2026Oct 19, 2026Not reported
7.5 High severityAtlassian Multiple Products Files or Directories Accessible to External Parties
CVE-2026-21589
Oct 15, 2026Oct 18, 2026Not reported
9.8 Critical severityCisco Secure Email Gateway Relative Path Traversal
CVE-2026-76519
Oct 14, 2026Oct 17, 2026Not reported
10.0 Critical severityAhsay AhsayCBS Command Injection
CVE-2026-105134
Oct 14, 2026Oct 17, 2026Not reported
7.3 High severityAhsay AhsayCBS Improper Authentication
CVE-2026-105133
Oct 14, 2026Oct 17, 2026Not reported
7.2 High severityPalo Alto Networks PAN-OS Code Injection
CVE-2026-0322
Oct 14, 2026Oct 17, 2026Not reported

About this list

CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.

A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.