Vulnerabilities exploited right now (CISA KEV)

CISA's catalog lists vulnerabilities with evidence of active exploitation. If you run any of these products, they outrank any CVSS score.

Showing entries added in the last 30 days. Source: CISA Known Exploited Vulnerabilities Catalog (opens in a new window).

Recently added to the CISA KEV catalog
CVE	Vendor / product	Description	Added	Ransomware use
CVE-2026-118527 (opens in a new window)	Ivanti Connect Secure	Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability	2026-10-30	Unknown
CVE-2026-111357 (opens in a new window)	Ivanti Connect Secure	Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability	2026-10-30	Unknown
CVE-2026-97229 (opens in a new window)	GitLab Community Edition and Enterprise Edition	GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability	2026-10-29	Unknown
CVE-2026-76418 (opens in a new window)	Cisco Secure Firewall ASA Software and Cisco Secure FTD Software	Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability	2026-10-29	Unknown
CVE-2026-41709 (opens in a new window)	Broadcom VMware ESX	Broadcom VMWare ESX Insufficient Logging Vulnerability	2026-10-28	Unknown
CVE-2026-46300 (opens in a new window)	Linux Kernel	Linux Kernel Missing Initialization of a Variable Vulnerability	2026-10-28	Unknown
CVE-2026-48356 (opens in a new window)	Adobe Commerce and Magento	Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability	2026-10-27	Unknown
CVE-2026-111497 (opens in a new window)	Google Brotli	Google Brotli Unchecked Return Value Vulnerability	2026-10-27	Unknown
CVE-2026-109618 (opens in a new window)	PHP Group PHP	PHP Memory Corruption Vulnerability	2026-10-26	Unknown
CVE-2026-109619 (opens in a new window)	PHP Group PHP	PHP Stale Internal Request-State Vulnerability	2026-10-26	Unknown
CVE-2026-114625 (opens in a new window)	Arista VeloCloud Orchestrator	Arista VeloCloud Orchestrator SQL Injection Vulnerability	2026-10-23	Unknown
CVE-2026-110447 (opens in a new window)	Collabora Collabora Online – Built-in CODE Server	Collabora Online – Built-in CODE Server OS Command Injection Vulnerability	2026-10-23	Unknown
CVE-2026-106931 (opens in a new window)	EG Secure Solutions SiteGuard Server Edition	EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability	2026-10-20	Unknown
CVE-2026-96656 (opens in a new window)	Plex Media Server	Plex Media Server External Control of File Name or Path Vulnerability	2026-10-20	Unknown
CVE-2026-96655 (opens in a new window)	Plex Media Server	Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability	2026-10-20	Unknown
CVE-2026-96654 (opens in a new window)	Plex Media Server	Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability	2026-10-20	Unknown
CVE-2026-96652 (opens in a new window)	Plex Media Server	Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability	2026-10-20	Unknown
CVE-2026-110936 (opens in a new window)	Siemens Software Center	Siemens Software Center Uncontrolled Search Path Element Vulnerability	2026-10-20	Unknown
CVE-2026-102764 (opens in a new window)	BeyondTrust Remote Support	BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability	2026-10-16	Unknown
CVE-2025-61624 (opens in a new window)	Fortinet Multiple Products	Fortinet Multiple Products Path Traversal Vulnerability	2026-10-16	Unknown
CVE-2026-21589 (opens in a new window)	Atlassian Multiple Products	Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability	2026-10-15	Unknown
CVE-2026-105134 (opens in a new window)	Ahsay AhsayCBS	Ahsay AhsayCBS Command Injection Vulnerability	2026-10-14	Unknown
CVE-2026-76519 (opens in a new window)	Cisco Secure Email Gateway	Cisco Secure Email Gateway Relative Path Traversal Vulnerability	2026-10-14	Unknown
CVE-2026-105133 (opens in a new window)	Ahsay AhsayCBS	Ahsay AhsayCBS Improper Authentication Vulnerability	2026-10-14	Unknown
CVE-2026-0322 (opens in a new window)	Palo Alto Networks PAN-OS	Palo Alto Networks PAN-OS Code Injection Vulnerability	2026-10-14	Unknown
CVE-2026-104935 (opens in a new window)	Ivanti Connect Secure	Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability	2026-10-13	Unknown
CVE-2026-96951 (opens in a new window)	Microsoft Windows	Microsoft Windows Command Injection Vulnerability	2026-10-13	Unknown
CVE-2015-5477 (opens in a new window)	ISC BIND	ISC BIND Data Processing Errors Vulnerability	2026-10-08	Unknown
CVE-2016-3081 (opens in a new window)	Apache Struts	Apache Struts Command Injection Vulnerability	2026-10-08	Unknown
CVE-2023-22894 (opens in a new window)	Strapi Strapi	Strapi Cleartext Storage of Sensitive Information Vulnerability	2026-10-08	Unknown
CVE-2021-3199 (opens in a new window)	ONLYOFFICE Docs	ONLYOFFICE Docs Server Path Traversal Vulnerability	2026-10-08	Unknown
CVE-2015-3306 (opens in a new window)	ProFTPD ProFTPD	ProFTPD Improper Access Control Vulnerability	2026-10-08	Unknown
CVE-2026-88779 (opens in a new window)	Citrix NetScaler	Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	2026-10-04	Unknown

How to use KEV for patch prioritization – guide