CyberSecBulletin

Vulnerabilities exploited in the wild

1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.

ScoreVulnerabilityAddedFederal deadlineRansomware use
9.8 Critical severityCitrix NetScaler Authentication Bypass Using an Alternate Path or Channel
CVE-2026-19490
Sep 9, 2026Sep 12, 2026Not reported
9.8 Critical severityFortinet Multiple Products Heap-based Buffer Overflow
CVE-2025-25249
Sep 9, 2026Sep 12, 2026Not reported
9.8 Critical severityN-able N-central Static Code Injection
CVE-2026-86218
Sep 8, 2026Sep 11, 2026Not reported
7.8 High severityMicrosoft Windows Heap-Based Buffer Overflow
CVE-2026-85880
Sep 8, 2026Sep 22, 2026Not reported
7.8 High severityMicrosoft Windows Link Following
CVE-2026-81963
Sep 8, 2026Sep 22, 2026Not reported
10.0 Critical severityAdobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-75650
Sep 8, 2026Sep 11, 2026Not reported
8.8 High severityGoogle Chromium V8 Type Confusion
CVE-2026-85046
Sep 4, 2026Sep 18, 2026Not reported
9.8 Critical severitySangoma Switchvox SQL Injection
CVE-2026-9586
Sep 2, 2026Sep 5, 2026Not reported
7.8 High severitySonicWall SMA1000 Appliances OS Command Injection
CVE-2026-83549
Sep 2, 2026Sep 5, 2026Not reported
10.0 Critical severitySonicWall SMA1000 Appliances Server-Side Request Forgery
CVE-2026-83548
Sep 2, 2026Sep 5, 2026Not reported
9.8 Critical severityJFrog Artifactory Improper Authentication
CVE-2026-82329
Sep 2, 2026Sep 5, 2026Not reported
8.2 High severityBerriAI LiteLLM Improper Authentication
CVE-2026-59822
Sep 2, 2026Sep 16, 2026Not reported
10.0 Critical severityKestra OSS OS Command Injection
CVE-2026-49869
Sep 2, 2026Sep 5, 2026Not reported
6.5 Medium severityKludex Starlette HTTP Request/Response Smuggling
CVE-2026-48710
Sep 2, 2026Sep 16, 2026Not reported
9.1 Critical severityPaperCut NG/MF Unsafe Reflection
CVE-2026-82078
Aug 31, 2026Sep 14, 2026Not reported
9.8 Critical severityPaperCut NG/MF Missing Authentication for Critical Function
CVE-2026-81578
Aug 31, 2026Sep 14, 2026Not reported
5.3 Medium severityJFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory
CVE-2026-66384
Aug 27, 2026Sep 10, 2026Not reported
7.8 High severityLinux Kernel Unspecified
CVE-2026-53362
Aug 27, 2026Aug 30, 2026Not reported
9.8 Critical severityownCloud Improper Authentication
CVE-2023-49105
Aug 27, 2026Aug 30, 2026Not reported
9.8 Critical severityCitrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-8452
Aug 26, 2026Aug 29, 2026Not reported
7.8 High severityLinux Kernel Out-of-Bounds Write
CVE-2022-0995
Aug 26, 2026Aug 29, 2026Not reported
9.8 Critical severityAjax.NET Professional Deserialization of Untrusted Data
CVE-2021-23758
Aug 26, 2026Sep 9, 2026Not reported
8.8 High severityMicrosoft SQL Server Remote Code Execution
CVE-2019-1068
Aug 26, 2026Aug 29, 2026Not reported
7.8 High severityRed Hat Automatic Bug Reporting Tool Privilege Escalation
CVE-2015-5287
Aug 26, 2026Sep 9, 2026Not reported
7.2 High severityRed Hat Libuser Race Condition
CVE-2015-3246
Aug 26, 2026Sep 9, 2026Not reported
9.8 Critical severityGitea Code Injection
CVE-2026-60004
Aug 25, 2026Aug 28, 2026Not reported
10.0 Critical severityOracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control
CVE-2026-21962
Aug 24, 2026Aug 27, 2026Not reported
8.9 High severityZimbra Collaboration Suite (ZCS) OS Command Injection
CVE-2026-73570
Aug 21, 2026Aug 24, 2026Not reported
9.0 Critical severityTrueConf Server Code Injection
CVE-2026-72530
Aug 20, 2026Sep 3, 2026Not reported
9.8 Critical severityTrueConf Server Missing Authentication for Critical Function
CVE-2026-72529
Aug 20, 2026Aug 23, 2026Not reported
9.3 Critical severityMLflow Server-Side Request Forgery
CVE-2026-64849
Aug 19, 2026Sep 2, 2026Not reported
9.8 Critical severityApple macOS Improper Authentication
CVE-2026-65400
Aug 18, 2026Aug 21, 2026Not reported
9.8 Critical severityBroadcom VMware vCenter Path Traversal
CVE-2026-59310
Aug 18, 2026Aug 21, 2026Known
9.1 Critical severityMicrosoft SharePoint Weak Authentication
CVE-2026-55040
Aug 18, 2026Aug 21, 2026Not reported
9.8 Critical severityMicrosoft Internet Key Exchange (IKE) Service Extensions Double Free
CVE-2026-33824
Aug 18, 2026Aug 21, 2026Not reported
8.8 High severityRay-Project Ray Code Injection
CVE-2025-62593
Aug 17, 2026Aug 20, 2026Not reported
10.0 Critical severityMetabase SQL Injection
CVE-2026-72898
Aug 11, 2026Aug 14, 2026Not reported
7.0 High severityMicrosoft Windows Ancillary Function Driver for WinSock Use-After-Free
CVE-2026-68820
Aug 11, 2026Aug 25, 2026Not reported
8.6 High severityCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection
CVE-2026-20349
Aug 11, 2026Aug 14, 2026Not reported
9.8 Critical severityProgress LoadMaster Command Injection
CVE-2026-8037
Aug 7, 2026Aug 10, 2026Not reported

About this list

CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.

A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.