CyberSecBulletin

Vulnerabilities exploited in the wild

1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.

ScoreVulnerabilityAddedFederal deadlineRansomware use
8.8 High severityGoogle Skia Out-of-Bounds Write
CVE-2026-3909
Mar 13, 2026Mar 27, 2026Not reported
8.8 High severityn8n Improper Control of Dynamically-Managed Code Resources
CVE-2025-68613
Mar 11, 2026Mar 25, 2026Not reported
7.5 High severityIvanti Endpoint Manager (EPM) Authentication Bypass
CVE-2026-1603
Mar 9, 2026Mar 23, 2026Not reported
9.8 Critical severitySolarWinds Web Help Desk Deserialization of Untrusted Data
CVE-2025-26399
Mar 9, 2026Mar 12, 2026Known
7.5 High severityOmnissa Workspace ONE Server-Side Request Forgery
CVE-2021-22054
Mar 9, 2026Mar 23, 2026Not reported
8.8 High severityApple Multiple products Use-After-Free
CVE-2023-43000
Mar 5, 2026Mar 26, 2026Not reported
7.8 High severityApple iOS and iPadOS Use-After-Free
CVE-2023-41974
Mar 5, 2026Mar 26, 2026Not reported
7.8 High severityApple Multiple Products Integer Overflow or Wraparound
CVE-2021-30952
Mar 5, 2026Mar 26, 2026Not reported
9.8 Critical severityRockwell Multiple Products Insufficient Protected Credentials
CVE-2021-22681
Mar 5, 2026Mar 26, 2026Not reported
9.8 Critical severityHikvision Multiple Products Improper Authentication
CVE-2017-7921
Mar 5, 2026Mar 26, 2026Not reported
8.1 High severityBroadcom VMware Aria Operations Command Injection
CVE-2026-22719
Mar 3, 2026Mar 24, 2026Not reported
7.8 High severityQualcomm Multiple Chipsets Memory Corruption
CVE-2026-21385
Mar 3, 2026Mar 24, 2026Not reported
10.0 Critical severityCisco Catalyst SD-WAN Controller and Manager Authentication Bypass
CVE-2026-20127
Feb 25, 2026Feb 27, 2026Not reported
7.8 High severityCisco SD-WAN Path Traversal
CVE-2022-20775
Feb 25, 2026Feb 27, 2026Not reported
8.8 High severitySoliton Systems K.K FileZen OS Command Injection
CVE-2026-25108
Feb 24, 2026Mar 17, 2026Not reported
6.1 Medium severityRoundCube Webmail Cross-site Scripting
CVE-2025-68461
Feb 20, 2026Mar 13, 2026Not reported
8.8 High severityRoundCube Webmail Deserialization of Untrusted Data
CVE-2025-49113
Feb 20, 2026Mar 13, 2026Not reported
10.0 Critical severityDell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials
CVE-2026-22769
Feb 18, 2026Feb 21, 2026Not reported
9.8 Critical severityGitLab Server-Side Request Forgery (SSRF)
CVE-2021-22175
Feb 18, 2026Mar 11, 2026Not reported
8.8 High severityGoogle Chromium CSS Use-After-Free
CVE-2026-2441
Feb 17, 2026Mar 10, 2026Not reported
7.2 High severityTeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type
CVE-2024-7694
Feb 17, 2026Mar 10, 2026Not reported
9.8 Critical severitySynacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery
CVE-2020-7796
Feb 17, 2026Mar 10, 2026Not reported
9.3 High severityMicrosoft Windows Video ActiveX Control Remote Code Execution
CVE-2008-0015
Feb 17, 2026Mar 10, 2026Not reported
9.8 Critical severityBeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection
CVE-2026-1731
Feb 13, 2026Feb 16, 2026Known
7.8 High severityApple Multiple Buffer Overflow
CVE-2026-20700
Feb 12, 2026Mar 5, 2026Not reported
9.8 Critical severitySolarWinds Web Help Desk Security Control Bypass
CVE-2025-40536
Feb 12, 2026Feb 15, 2026Not reported
7.5 High severityNotepad++ Download of Code Without Integrity Check
CVE-2025-15556
Feb 12, 2026Mar 5, 2026Not reported
9.8 Critical severityMicrosoft Configuration Manager SQL Injection
CVE-2024-43468
Feb 12, 2026Mar 5, 2026Not reported
7.8 High severityMicrosoft Windows Improper Privilege Management
CVE-2026-21533
Feb 10, 2026Mar 3, 2026Not reported
6.2 Medium severityMicrosoft Windows NULL Pointer Dereference
CVE-2026-21525
Feb 10, 2026Mar 3, 2026Not reported
7.8 High severityMicrosoft Windows Type Confusion
CVE-2026-21519
Feb 10, 2026Mar 3, 2026Not reported
7.8 High severityMicrosoft Office Word Reliance on Untrusted Inputs in a Security Decision
CVE-2026-21514
Feb 10, 2026Mar 3, 2026Not reported
8.8 High severityMicrosoft MSHTML Framework Protection Mechanism Failure
CVE-2026-21513
Feb 10, 2026Mar 3, 2026Not reported
8.8 High severityMicrosoft Windows Shell Protection Mechanism Failure
CVE-2026-21510
Feb 10, 2026Mar 3, 2026Not reported
9.8 Critical severitySmarterTools SmarterMail Missing Authentication for Critical Function
CVE-2026-24423
Feb 5, 2026Feb 26, 2026Known
9.8 Critical severityReact Native Community CLI OS Command Injection
CVE-2025-11953
Feb 5, 2026Feb 26, 2026Not reported
7.2 High severitySangoma FreePBX OS Command Injection
CVE-2025-64328
Feb 3, 2026Feb 24, 2026Not reported
9.8 Critical severitySolarWinds Web Help Desk Deserialization of Untrusted Data
CVE-2025-40551
Feb 3, 2026Feb 6, 2026Not reported
7.5 High severityGitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF)
CVE-2021-39935
Feb 3, 2026Feb 24, 2026Not reported
9.8 Critical severitySangoma FreePBX Improper Authentication
CVE-2019-19006
Feb 3, 2026Feb 24, 2026Not reported

About this list

CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.

A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.