Known Exploited Vulnerabilities
The CISA KEV catalog lists 1,779 CVEs with evidence of exploitation in the wild, newest first. Catalog version 2026.11.10. Source: sources and licenses.
| CVE | Vulnerability | Added | Federal due date | Ransomware |
|---|---|---|---|---|
| CVE-2026-111560 | Barracuda Networks Multiple Products OS Command Injection Vulnerability Barracuda Networks / Multiple Products | Nov 10, 2026 | Nov 13, 2026 | |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability Openwave Messaging Limited / Webtop Media Transcoder | Nov 10, 2026 | Nov 24, 2026 | |
| CVE-2026-116606 | Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability Barracuda Networks / Barracuda Email Security Gateway (ESG) | Nov 10, 2026 | Nov 13, 2026 | |
| CVE-2026-124194 | Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability Microsoft / Office | Nov 10, 2026 | Nov 24, 2026 | |
| CVE-2026-125350 | Google Chromium Use-After-Free Vulnerability Google / Chromium | Nov 10, 2026 | Nov 24, 2026 | |
| CVE-2026-20320 | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability Cisco / BroadWorks | Nov 10, 2026 | Nov 24, 2026 | |
| CVE-2026-102895 | GPUStack Improper Authentication Vulnerability GPUStack / GPUStack | Nov 9, 2026 | Nov 12, 2026 | |
| CVE-2026-116779 | SignalWire FreeSwitch Code Injection Vulnerability SignalWire / FreeSwitch | Nov 9, 2026 | Nov 12, 2026 | |
| CVE-2026-123158 | OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability OpenBSD / OpenSSH | Nov 9, 2026 | Nov 12, 2026 | |
| CVE-2026-123218 | IBM Aspera Faspex Incorrect Authorization Vulnerability IBM / Aspera Faspex | Nov 9, 2026 | Nov 12, 2026 | |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability SonicWall / SonicOS SSLVPN | Nov 6, 2026 | Nov 20, 2026 | |
| CVE-2024-27834 | Apple Multiple Products Improper Authentication Vulnerability Apple / Multiple Products | Nov 4, 2026 | Nov 18, 2026 | |
| CVE-2026-119977 | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability WordPress / WordPress Core | Nov 3, 2026 | Nov 6, 2026 | |
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Ivanti / Connect Secure | Oct 30, 2026 | Nov 2, 2026 | |
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Ivanti / Connect Secure | Oct 30, 2026 | Nov 13, 2026 | |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability Cisco / Secure Firewall ASA Software and Cisco Secure FTD Software | Oct 29, 2026 | Nov 1, 2026 | |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability GitLab / Community Edition and Enterprise Edition | Oct 29, 2026 | Nov 1, 2026 | |
| CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging Vulnerability Broadcom / VMware ESX | Oct 28, 2026 | Nov 11, 2026 | |
| CVE-2026-46300 | Linux Kernel Missing Initialization of a Variable Vulnerability Linux / Kernel | Oct 28, 2026 | Oct 31, 2026 | |
| CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability Google / Brotli | Oct 27, 2026 | Nov 10, 2026 | |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability Adobe / Commerce and Magento | Oct 27, 2026 | Nov 10, 2026 | |
| CVE-2026-109618 | PHP Memory Corruption Vulnerability PHP Group / PHP | Oct 26, 2026 | Oct 29, 2026 | |
| CVE-2026-109619 | PHP Stale Internal Request-State Vulnerability PHP Group / PHP | Oct 26, 2026 | Oct 29, 2026 | |
| CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora / Collabora Online – Built-in CODE Server | Oct 23, 2026 | Oct 26, 2026 | |
| CVE-2026-114625 | Arista VeloCloud Orchestrator SQL Injection Vulnerability Arista / VeloCloud Orchestrator | Oct 23, 2026 | Oct 26, 2026 | |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions / SiteGuard Server Edition | Oct 20, 2026 | Oct 23, 2026 | |
| CVE-2026-110936 | Siemens Software Center Uncontrolled Search Path Element Vulnerability Siemens / Software Center | Oct 20, 2026 | Nov 3, 2026 | |
| CVE-2026-96652 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex / Media Server | Oct 20, 2026 | Nov 3, 2026 | |
| CVE-2026-96654 | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability Plex / Media Server | Oct 20, 2026 | Oct 23, 2026 | |
| CVE-2026-96655 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex / Media Server | Oct 20, 2026 | Nov 3, 2026 | |
| CVE-2026-96656 | Plex Media Server External Control of File Name or Path Vulnerability Plex / Media Server | Oct 20, 2026 | Oct 23, 2026 | |
| CVE-2025-61624 | Fortinet Multiple Products Path Traversal Vulnerability Fortinet / Multiple Products | Oct 16, 2026 | Oct 19, 2026 | |
| CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust / Remote Support | Oct 16, 2026 | Oct 19, 2026 | |
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Atlassian / Multiple Products | Oct 15, 2026 | Oct 18, 2026 | |
| CVE-2026-0322 | Palo Alto Networks PAN-OS Code Injection Vulnerability Palo Alto Networks / PAN-OS | Oct 14, 2026 | Oct 17, 2026 | |
| CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication Vulnerability Ahsay / AhsayCBS | Oct 14, 2026 | Oct 17, 2026 | |
| CVE-2026-105134 | Ahsay AhsayCBS Command Injection Vulnerability Ahsay / AhsayCBS | Oct 14, 2026 | Oct 17, 2026 | |
| CVE-2026-76519 | Cisco Secure Email Gateway Relative Path Traversal Vulnerability Cisco / Secure Email Gateway | Oct 14, 2026 | Oct 17, 2026 | |
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Ivanti / Connect Secure | Oct 13, 2026 | Oct 16, 2026 | |
| CVE-2026-96951 | Microsoft Windows Command Injection Vulnerability Microsoft / Windows | Oct 13, 2026 | Oct 16, 2026 | |
| CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability ProFTPD / ProFTPD | Oct 8, 2026 | Oct 11, 2026 | |
| CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerability ISC / BIND | Oct 8, 2026 | Oct 11, 2026 | |
| CVE-2016-3081 | Apache Struts Command Injection Vulnerability Apache / Struts | Oct 8, 2026 | Oct 11, 2026 | |
| CVE-2021-3199 | ONLYOFFICE Docs Server Path Traversal Vulnerability ONLYOFFICE / Docs | Oct 8, 2026 | Oct 11, 2026 | |
| CVE-2023-22894 | Strapi Cleartext Storage of Sensitive Information Vulnerability Strapi / Strapi | Oct 8, 2026 | Oct 11, 2026 | |
| CVE-2026-88779 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix / NetScaler | Oct 4, 2026 | Oct 7, 2026 | |
| CVE-2026-102489 | Zammad GmbH Zammad Session Fixation Vulnerability Zammad GmbH / Zammad | Oct 2, 2026 | Oct 5, 2026 | |
| CVE-2026-102490 | Zammad GmbH Zammad Improper Privilege Management Vulnerability Zammad GmbH / Zammad | Oct 2, 2026 | Oct 5, 2026 | |
| CVE-2026-104286 | Fortinet FortiMail Path Traversal Vulnerability Fortinet / FortiMail | Oct 1, 2026 | Oct 4, 2026 | |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Cisco / Catalyst SD-WAN Manager | Sep 30, 2026 | Oct 3, 2026 | |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write Vulnerability Apple / Multiple Products | Sep 29, 2026 | Oct 13, 2026 | |
| CVE-2026-88771 | Citrix NetScaler Improper Input Validation Vulnerability Citrix / NetScaler | Sep 27, 2026 | Sep 30, 2026 | |
| CVE-2026-88772 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix / NetScaler | Sep 27, 2026 | Sep 30, 2026 | |
| CVE-2026-65660 | Microsoft SharePoint Code Injection Vulnerability Microsoft / SharePoint | Sep 25, 2026 | Sep 28, 2026 | |
| CVE-2026-67279 | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability MikroTik / RouterOS | Sep 25, 2026 | Sep 28, 2026 | |
| CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability WordPress / Core | Sep 25, 2026 | Sep 28, 2026 | |
| CVE-2026-5430 | WSO2 Multiple Products Path Traversal Vulnerability WSO2 / Multiple Products | Sep 24, 2026 | Sep 27, 2026 | |
| CVE-2026-71362 | Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe / Commerce and Magento | Sep 24, 2026 | Sep 27, 2026 | |
| CVE-2026-85102 | Check Point Multiple Products Improper Certificate Validation Vulnerability Check Point / Multiple Products | Sep 22, 2026 | Sep 25, 2026 | |
| CVE-2026-93616 | Check Point Multiple Products Path Traversal Vulnerability Check Point / Multiple Products | Sep 22, 2026 | Sep 25, 2026 | |
| CVE-2026-93952 | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability Arista / VeloCloud Orchestrator | Sep 22, 2026 | Sep 25, 2026 | |
| CVE-2026-94127 | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability F5 / BIG-IP APM | Sep 22, 2026 | Sep 25, 2026 | |
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Zyxel / GS1900 Series Switches | Sep 21, 2026 | Sep 24, 2026 | |
| CVE-2025-39682 | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability Linux / Kernel | Sep 18, 2026 | Sep 21, 2026 | |
| CVE-2025-39964 | Linux Kernel Race Condition Vulnerability Linux / Kernel | Sep 18, 2026 | Sep 21, 2026 | |
| CVE-2026-53266 | Linux Kernel Out-of-Bounds Write Vulnerability Linux / Kernel | Sep 18, 2026 | Sep 21, 2026 | |
| CVE-2026-58704 | Google Pixel Improper Authorization Vulnerability Google / Pixel | Sep 16, 2026 | Sep 19, 2026 | |
| CVE-2026-76460 | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability Cisco / Identity Services Engine | Sep 16, 2026 | Sep 19, 2026 | |
| CVE-2026-87886 | Acronis Backup Incorrect Default Permissions Vulnerability Acronis / Backup | Sep 16, 2026 | Sep 19, 2026 | |
| CVE-2026-76461 | Cisco Secure Email Gateway SQL Injection Vulnerability Cisco / Secure Email Gateway | Sep 14, 2026 | Sep 17, 2026 | |
| CVE-2026-42016 | JFrog Artifactory Incorrect Authorization Vulnerability JFrog / Artifactory | Sep 11, 2026 | Sep 25, 2026 | |
| CVE-2026-42018 | JFrog Artifactory Improper Authentication Vulnerability JFrog / Artifactory | Sep 11, 2026 | Sep 25, 2026 | |
| CVE-2026-84869 | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability ConnectWise / ScreenConnect | Sep 11, 2026 | Sep 14, 2026 | |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability GitLab / Community Edition and Enterprise Edition | Sep 11, 2026 | Sep 14, 2026 | |
| CVE-2026-67277 | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability MikroTik / RouterOS | Sep 10, 2026 | Sep 13, 2026 | |
| CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability MikroTik / RouterOS | Sep 10, 2026 | Sep 13, 2026 | |
| CVE-2025-25249 | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Fortinet / Multiple Products | Sep 9, 2026 | Sep 12, 2026 | |
| CVE-2026-19490 | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability Citrix / NetScaler | Sep 9, 2026 | Sep 12, 2026 | |
| CVE-2026-20079 | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Sep 9, 2026 | Sep 12, 2026 | |
| CVE-2026-87491 | Google Chromium V8 Out of Bounds Write Vulnerability Google / Chromium V8 | Sep 9, 2026 | Sep 23, 2026 | |
| CVE-2026-75650 | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability Adobe / Commerce and Magento | Sep 8, 2026 | Sep 11, 2026 | |
| CVE-2026-81963 | Microsoft Windows Link Following Vulnerability Microsoft / Windows | Sep 8, 2026 | Sep 22, 2026 | |
| CVE-2026-85880 | Microsoft Windows Heap-Based Buffer Overflow Vulnerability Microsoft / Windows | Sep 8, 2026 | Sep 22, 2026 | |
| CVE-2026-86218 | N-able N-central Static Code Injection Vulnerability N-able / N-central | Sep 8, 2026 | Sep 11, 2026 | |
| CVE-2026-85046 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Sep 4, 2026 | Sep 18, 2026 | |
| CVE-2026-48710 | Kludex Starlette HTTP Request/Response Smuggling Vulnerability Kludex / Starlette | Sep 2, 2026 | Sep 16, 2026 | |
| CVE-2026-49869 | Kestra OSS OS Command Injection Vulnerability Kestra / Kestra OSS | Sep 2, 2026 | Sep 5, 2026 | |
| CVE-2026-59822 | BerriAI LiteLLM Improper Authentication Vulnerability BerriAI / LiteLLM | Sep 2, 2026 | Sep 16, 2026 | |
| CVE-2026-82329 | JFrog Artifactory Improper Authentication Vulnerability JFrog / Artifactory | Sep 2, 2026 | Sep 5, 2026 | |
| CVE-2026-83548 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall / SMA1000 Appliances | Sep 2, 2026 | Sep 5, 2026 | |
| CVE-2026-83549 | SonicWall SMA1000 Appliances OS Command Injection Vulnerability SonicWall / SMA1000 Appliances | Sep 2, 2026 | Sep 5, 2026 | |
| CVE-2026-9586 | Sangoma Switchvox SQL Injection Vulnerability Sangoma / Switchvox | Sep 2, 2026 | Sep 5, 2026 | |
| CVE-2026-81578 | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability PaperCut / NG/MF | Aug 31, 2026 | Sep 14, 2026 | |
| CVE-2026-82078 | PaperCut NG/MF Unsafe Reflection Vulnerability PaperCut / NG/MF | Aug 31, 2026 | Sep 14, 2026 | |
| CVE-2023-49105 | ownCloud Improper Authentication Vulnerability ownCloud / ownCloud | Aug 27, 2026 | Aug 30, 2026 | |
| CVE-2026-53362 | Linux Kernel Unspecified Vulnerability Linux / Kernel | Aug 27, 2026 | Aug 30, 2026 | |
| CVE-2026-66384 | JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability JFrog / Artifactory | Aug 27, 2026 | Sep 10, 2026 | |
| CVE-2015-3246 | Red Hat Libuser Race Condition Vulnerability Red Hat / Libuser | Aug 26, 2026 | Sep 9, 2026 | |
| CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Red Hat / Automatic Bug Reporting Tool | Aug 26, 2026 | Sep 9, 2026 | |
| CVE-2019-1068 | Microsoft SQL Server Remote Code Execution Vulnerability Microsoft / SQL Server | Aug 26, 2026 | Aug 29, 2026 |
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses