Security Digest · page 1 of 8
Known exploited vulnerabilities
Every CVE CISA has added to its Known Exploited Vulnerabilities catalog since October 1, 2023 (748), newest first. If you run the product, these come first. Browse by vendor.
| Added | CVE | Product and flaw | CISA due |
|---|---|---|---|
| 2026-10-20 | CVE-2026-96656 | Plex Media Server Plex Media Server External Control of File Name or Path Vulnerability | 2026-10-23 |
| 2026-10-20 | CVE-2026-96655 | Plex Media Server Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-11-03 |
| 2026-10-20 | CVE-2026-96654 | Plex Media Server Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 2026-10-23 |
| 2026-10-20 | CVE-2026-96652 | Plex Media Server Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-11-03 |
| 2026-10-20 | CVE-2026-110936 | Siemens Software Center Siemens Software Center Uncontrolled Search Path Element Vulnerability | 2026-11-03 |
| 2026-10-20 | CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | 2026-10-23 |
| 2026-10-16 | CVE-2026-102764 | BeyondTrust Remote Support BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | 2026-10-19 |
| 2026-10-16 | CVE-2025-61624 | Fortinet Multiple Products Fortinet Multiple Products Path Traversal Vulnerability | 2026-10-19 |
| 2026-10-15 | CVE-2026-21589 | Atlassian Multiple Products Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 2026-10-18 |
| 2026-10-14 | CVE-2026-76519 | Cisco Secure Email Gateway Cisco Secure Email Gateway Relative Path Traversal Vulnerability | 2026-10-17 |
| 2026-10-14 | CVE-2026-105134 | Ahsay AhsayCBS Ahsay AhsayCBS Command Injection Vulnerability | 2026-10-17 |
| 2026-10-14 | CVE-2026-105133 | Ahsay AhsayCBS Ahsay AhsayCBS Improper Authentication Vulnerability | 2026-10-17 |
| 2026-10-14 | CVE-2026-0322 | Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Code Injection Vulnerability | 2026-10-17 |
| 2026-10-13 | CVE-2026-96951 | Microsoft Windows Microsoft Windows Command Injection Vulnerability | 2026-10-16 |
| 2026-10-13 | CVE-2026-104935 | Ivanti Connect Secure Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | 2026-10-16 |
| 2026-10-08 | CVE-2023-22894 | Strapi Strapi Strapi Cleartext Storage of Sensitive Information Vulnerability | 2026-10-11 |
| 2026-10-08 | CVE-2021-3199 | ONLYOFFICE Docs ONLYOFFICE Docs Server Path Traversal Vulnerability | 2026-10-11 |
| 2026-10-08 | CVE-2016-3081 | Apache Struts Apache Struts Command Injection Vulnerability | 2026-10-11 |
| 2026-10-08 | CVE-2015-5477 | ISC BIND ISC BIND Data Processing Errors Vulnerability | 2026-10-11 |
| 2026-10-08 | CVE-2015-3306 | ProFTPD ProFTPD ProFTPD Improper Access Control Vulnerability | 2026-10-11 |
| 2026-10-04 | CVE-2026-88779 | Citrix NetScaler Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-10-07 |
| 2026-10-02 | CVE-2026-102490 | Zammad GmbH Zammad Zammad GmbH Zammad Improper Privilege Management Vulnerability | 2026-10-05 |
| 2026-10-02 | CVE-2026-102489 | Zammad GmbH Zammad Zammad GmbH Zammad Session Fixation Vulnerability | 2026-10-05 |
| 2026-10-01 | CVE-2026-104286 | Fortinet FortiMail Fortinet FortiMail Path Traversal Vulnerability | 2026-10-04 |
| 2026-09-30 | CVE-2026-76504 | Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 2026-10-03 |
| 2026-09-29 | CVE-2026-86950 | Apple Multiple Products Apple Multiple Products Out-of-Bounds Write Vulnerability | 2026-10-13 |
| 2026-09-27 | CVE-2026-88772 | Citrix NetScaler Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-09-30 |
| 2026-09-27 | CVE-2026-88771 | Citrix NetScaler Citrix NetScaler Improper Input Validation Vulnerability | 2026-09-30 |
| 2026-09-25 | CVE-2026-87902 | WordPress Core WordPress Core Remote File Inclusion Vulnerability | 2026-09-28 |
| 2026-09-25 | CVE-2026-67279 | MikroTik RouterOS Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | 2026-09-28 |
| 2026-09-25 | CVE-2026-65660 | Microsoft SharePoint Microsoft SharePoint Code Injection Vulnerability | 2026-09-28 |
| 2026-09-24 | CVE-2026-71362 | Adobe Commerce and Magento Adobe Commerce and Magento Incorrect Authorization Vulnerability | 2026-09-27 |
| 2026-09-24 | CVE-2026-5430 | WSO2 Multiple Products WSO2 Multiple Products Path Traversal Vulnerability | 2026-09-27 |
| 2026-09-22 | CVE-2026-94127 | F5 BIG-IP APM F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | 2026-09-25 |
| 2026-09-22 | CVE-2026-93952 | Arista VeloCloud Orchestrator Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | 2026-09-25 |
| 2026-09-22 | CVE-2026-93616 | Check Point Multiple Products Check Point Multiple Products Path Traversal Vulnerability | 2026-09-25 |
| 2026-09-22 | CVE-2026-85102 | Check Point Multiple Products Check Point Multiple Products Improper Certificate Validation Vulnerability | 2026-09-25 |
| 2026-09-21 | CVE-2026-7273 | Zyxel GS1900 Series Switches Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 2026-09-24 |
| 2026-09-18 | CVE-2026-53266 | Linux Kernel Linux Kernel Out-of-Bounds Write Vulnerability | 2026-09-21 |
| 2026-09-18 | CVE-2025-39964 | Linux Kernel Linux Kernel Race Condition Vulnerability | 2026-09-21 |
| 2026-09-18 | CVE-2025-39682 | Linux Kernel Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | 2026-09-21 |
| 2026-09-16 | CVE-2026-87886 | Acronis Backup Acronis Backup Incorrect Default Permissions Vulnerability | 2026-09-19 |
| 2026-09-16 | CVE-2026-76460 | Cisco Identity Services Engine Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-19 |
| 2026-09-16 | CVE-2026-58704 | Google Pixel Google Pixel Improper Authorization Vulnerability | 2026-09-19 |
| 2026-09-14 | CVE-2026-76461 | Cisco Secure Email Gateway Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-17 |
| 2026-09-11 | CVE-2026-85706 | GitLab Community Edition and Enterprise Edition GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | 2026-09-14 |
| 2026-09-11 | CVE-2026-84869 | ConnectWise ScreenConnect ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | 2026-09-14 |
| 2026-09-11 | CVE-2026-42018 | JFrog Artifactory JFrog Artifactory Improper Authentication Vulnerability | 2026-09-25 |
| 2026-09-11 | CVE-2026-42016 | JFrog Artifactory JFrog Artifactory Incorrect Authorization Vulnerability | 2026-09-25 |
| 2026-09-10 | CVE-2026-86060 | MikroTik RouterOS MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | 2026-09-13 |
| 2026-09-10 | CVE-2026-67277 | MikroTik RouterOS MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | 2026-09-13 |
| 2026-09-09 | CVE-2026-87491 | Google Chromium V8 Google Chromium V8 Out of Bounds Write Vulnerability | 2026-09-23 |
| 2026-09-09 | CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-12 |
| 2026-09-09 | CVE-2026-19490 | Citrix NetScaler Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-12 |
| 2026-09-09 | CVE-2025-25249 | Fortinet Multiple Products Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | 2026-09-12 |
| 2026-09-08 | CVE-2026-86218 | N-able N-central N-able N-central Static Code Injection Vulnerability | 2026-09-11 |
| 2026-09-08 | CVE-2026-85880 | Microsoft Windows Microsoft Windows Heap-Based Buffer Overflow Vulnerability | 2026-09-22 |
| 2026-09-08 | CVE-2026-81963 | Microsoft Windows Microsoft Windows Link Following Vulnerability | 2026-09-22 |
| 2026-09-08 | CVE-2026-75650 | Adobe Commerce and Magento Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 2026-09-11 |
| 2026-09-04 | CVE-2026-85046 | Google Chromium V8 Google Chromium V8 Type Confusion Vulnerability | 2026-09-18 |
| 2026-09-02 | CVE-2026-9586 | Sangoma Switchvox Sangoma Switchvox SQL Injection Vulnerability | 2026-09-05 |
| 2026-09-02 | CVE-2026-83549 | SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances OS Command Injection Vulnerability | 2026-09-05 |
| 2026-09-02 | CVE-2026-83548 | SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | 2026-09-05 |
| 2026-09-02 | CVE-2026-82329 | JFrog Artifactory JFrog Artifactory Improper Authentication Vulnerability | 2026-09-05 |
| 2026-09-02 | CVE-2026-59822 | BerriAI LiteLLM BerriAI LiteLLM Improper Authentication Vulnerability | 2026-09-16 |
| 2026-09-02 | CVE-2026-49869 | Kestra Kestra OSS Kestra OSS OS Command Injection Vulnerability | 2026-09-05 |
| 2026-09-02 | CVE-2026-48710 | Kludex Starlette Kludex Starlette HTTP Request/Response Smuggling Vulnerability | 2026-09-16 |
| 2026-08-31 | CVE-2026-82078 | PaperCut NG/MF PaperCut NG/MF Unsafe Reflection Vulnerability | 2026-09-14 |
| 2026-08-31 | CVE-2026-81578 | PaperCut NG/MF PaperCut NG/MF Missing Authentication for Critical Function Vulnerability | 2026-09-14 |
| 2026-08-27 | CVE-2026-66384 | JFrog Artifactory JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability | 2026-09-10 |
| 2026-08-27 | CVE-2026-53362 | Linux Kernel Linux Kernel Unspecified Vulnerability | 2026-08-30 |
| 2026-08-27 | CVE-2023-49105 | ownCloud ownCloud ownCloud Improper Authentication Vulnerability | 2026-08-30 |
| 2026-08-26 | CVE-2026-8452 | Citrix NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-08-29 |
| 2026-08-26 | CVE-2022-0995 | Linux Kernel Linux Kernel Out-of-Bounds Write Vulnerability | 2026-08-29 |
| 2026-08-26 | CVE-2021-23758 | Ajax.NET Professional Ajax.NET Professional Ajax.NET Professional Deserialization of Untrusted Data Vulnerability | 2026-09-09 |
| 2026-08-26 | CVE-2019-1068 | Microsoft SQL Server Microsoft SQL Server Remote Code Execution Vulnerability | 2026-08-29 |
| 2026-08-26 | CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability | 2026-09-09 |
| 2026-08-26 | CVE-2015-3246 | Red Hat Libuser Red Hat Libuser Race Condition Vulnerability | 2026-09-09 |
| 2026-08-25 | CVE-2026-60004 | Gitea Gitea Gitea Code Injection Vulnerability | 2026-08-28 |
| 2026-08-24 | CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | 2026-08-27 |
| 2026-08-21 | CVE-2026-73570 | Synacor Zimbra Collaboration Suite (ZCS) Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | 2026-08-24 |
| 2026-08-20 | CVE-2026-72530 | TrueConf Server TrueConf Server Code Injection Vulnerability | 2026-09-03 |
| 2026-08-20 | CVE-2026-72529 | TrueConf Server TrueConf Server Missing Authentication for Critical Function Vulnerability | 2026-08-23 |
| 2026-08-19 | CVE-2026-64849 | MLflow MLflow MLflow Server-Side Request Forgery Vulnerability | 2026-09-02 |
| 2026-08-18 | CVE-2026-65400 | Apple macOS Apple macOS Improper Authentication Vulnerability | 2026-08-21 |
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability Ransomware | 2026-08-21 |
| 2026-08-18 | CVE-2026-55040 | Microsoft SharePoint Microsoft SharePoint Weak Authentication Vulnerability | 2026-08-21 |
| 2026-08-18 | CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | 2026-08-21 |
| 2026-08-17 | CVE-2025-62593 | Ray-Project Ray Ray-Project Ray Code Injection Vulnerability | 2026-08-20 |
| 2026-08-11 | CVE-2026-72898 | Metabase Metabase Metabase SQL Injection Vulnerability | 2026-08-14 |
| 2026-08-11 | CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | 2026-08-25 |
| 2026-08-11 | CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | 2026-08-14 |
| 2026-08-07 | CVE-2026-8037 | Progress LoadMaster Progress LoadMaster Command Injection Vulnerability | 2026-08-10 |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Ransomware | 2026-08-08 |
| 2026-08-04 | CVE-2026-9198 | IBM Langflow IBM Langflow Code Injection Vulnerability | 2026-08-07 |
| 2026-08-04 | CVE-2026-34486 | Apache Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | 2026-08-07 |
| 2026-08-04 | CVE-2026-18556 | N-able N-central N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-08-07 |
| 2026-08-03 | CVE-2026-18577 | N-able N-central N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-08-06 |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Ransomware | 2026-08-01 |
| 2026-07-27 | CVE-2026-16812 | Arista VeloCloud Orchestrator Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability | 2026-07-30 |