Exploited vulnerabilities
1,762 vulnerabilities that CISA lists as exploited in the wild. Each page has CISA's required action, the affected and unaffected versions named in the CVE record, the weakness, EPSS and the advisories.
By year added to KEV
Most recently added
| CVE | Name | Vendor | Added |
|---|---|---|---|
| CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging Vulnerability | Broadcom | 28 Oct 2026 |
| CVE-2026-46300 | Linux Kernel Missing Initialization of a Variable Vulnerability | Linux | 28 Oct 2026 |
| CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability | 27 Oct 2026 | |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Adobe | 27 Oct 2026 |
| CVE-2026-109618 | PHP Memory Corruption Vulnerability | PHP | 26 Oct 2026 |
| CVE-2026-109619 | PHP Stale Internal Request-State Vulnerability | PHP | 26 Oct 2026 |
| CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | Collabora | 23 Oct 2026 |
| CVE-2026-114625 | Arista VeloCloud Orchestrator SQL Injection Vulnerability | Arista | 23 Oct 2026 |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | EG Secure Solutions | 20 Oct 2026 |
| CVE-2026-110936 | Siemens Software Center Uncontrolled Search Path Element Vulnerability | Siemens | 20 Oct 2026 |
| CVE-2026-96652 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Plex | 20 Oct 2026 |
| CVE-2026-96654 | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | Plex | 20 Oct 2026 |
| CVE-2026-96655 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Plex | 20 Oct 2026 |
| CVE-2026-96656 | Plex Media Server External Control of File Name or Path Vulnerability | Plex | 20 Oct 2026 |
| CVE-2025-61624 | Fortinet Multiple Products Path Traversal Vulnerability | Fortinet | 16 Oct 2026 |
| CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | BeyondTrust | 16 Oct 2026 |
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Atlassian | 15 Oct 2026 |
| CVE-2026-0322 | Palo Alto Networks PAN-OS Code Injection Vulnerability | Palo Alto Networks | 14 Oct 2026 |
| CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication Vulnerability | Ahsay | 14 Oct 2026 |
| CVE-2026-105134 | Ahsay AhsayCBS Command Injection Vulnerability | Ahsay | 14 Oct 2026 |
| CVE-2026-76519 | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | Cisco | 14 Oct 2026 |
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | Ivanti | 13 Oct 2026 |
| CVE-2026-96951 | Microsoft Windows Command Injection Vulnerability | Microsoft | 13 Oct 2026 |
| CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability | ProFTPD | 8 Oct 2026 |
| CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerability | ISC | 8 Oct 2026 |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026. About the data.