Exploited now
Every vulnerability that CISA confirms is being exploited in real attacks, newest first. If you run any of these products, patch them before anything else. The deadline is the date US federal agencies must fix them by, a good benchmark for everyone else.
12added this week
35in the last 30 days
0used by ransomware
Plexmost listed vendor (4 entries)
| Added | CVE | Product and vulnerability | US federal deadline |
|---|---|---|---|
| 13 Nov | CVE-2026-114713 | UnrealIRCdUnrealIRCd Improper Neutralization of Delimiters Vulnerability | Patch by 16 Nov |
| 13 Nov | CVE-2026-123039 | Check Point Multiple ProductsCheck Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability | Patch by 16 Nov |
| 10 Nov | CVE-2026-124194 | Microsoft OfficeMicrosoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | Patch by 24 Nov |
| 10 Nov | CVE-2026-111793 | Openwave Messaging Limited Webtop Media TranscoderOpenwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability | Patch by 24 Nov |
| 10 Nov | CVE-2026-20320 | Cisco BroadWorksCisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | Patch by 24 Nov |
| 10 Nov | CVE-2026-111560 | Barracuda Networks Multiple ProductsBarracuda Networks Multiple Products OS Command Injection Vulnerability | Deadline passed 13 Nov |
| 10 Nov | CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG)Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability | Deadline passed 13 Nov |
| 10 Nov | CVE-2026-125350 | Google ChromiumGoogle Chromium Use-After-Free Vulnerability | Patch by 24 Nov |
| 09 Nov | CVE-2026-102895 | GPUStackGPUStack Improper Authentication Vulnerability | Deadline passed 12 Nov |
| 09 Nov | CVE-2026-123158 | OpenBSD OpenSSHOpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability | Deadline passed 12 Nov |
| 09 Nov | CVE-2026-116779 | SignalWire FreeSwitchSignalWire FreeSwitch Code Injection Vulnerability | Deadline passed 12 Nov |
| 09 Nov | CVE-2026-123218 | IBM Aspera FaspexIBM Aspera Faspex Incorrect Authorization Vulnerability | Deadline passed 12 Nov |
| 06 Nov | CVE-2026-19868 | SonicWall SonicOS SSLVPNSonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | Patch by 20 Nov |
| 04 Nov | CVE-2024-27834 | Apple Multiple ProductsApple Multiple Products Improper Authentication Vulnerability | Patch by 18 Nov |
| 03 Nov | CVE-2026-119977 | WordPress CoreWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | Deadline passed 06 Nov |
| 30 Oct | CVE-2026-118527 | Ivanti Connect SecureIvanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Deadline passed 13 Nov |
| 30 Oct | CVE-2026-111357 | Ivanti Connect SecureIvanti Connect Secure Missing Authentication for Critical Function Vulnerability | Deadline passed 02 Nov |
| 29 Oct | CVE-2026-97229 | GitLab Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | Deadline passed 01 Nov |
| 29 Oct | CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | Deadline passed 01 Nov |
| 28 Oct | CVE-2026-41709 | Broadcom VMware ESXBroadcom VMWare ESX Insufficient Logging Vulnerability | Deadline passed 11 Nov |
| 28 Oct | CVE-2026-46300 | Linux KernelLinux Kernel Missing Initialization of a Variable Vulnerability | Deadline passed 31 Oct |
| 27 Oct | CVE-2026-48356 | Adobe Commerce and MagentoAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Deadline passed 10 Nov |
| 27 Oct | CVE-2026-111497 | Google BrotliGoogle Brotli Unchecked Return Value Vulnerability | Deadline passed 10 Nov |
| 26 Oct | CVE-2026-109618 | PHP Group PHPPHP Memory Corruption Vulnerability | Deadline passed 29 Oct |
| 26 Oct | CVE-2026-109619 | PHP Group PHPPHP Stale Internal Request-State Vulnerability | Deadline passed 29 Oct |
| 23 Oct | CVE-2026-114625 | Arista VeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection Vulnerability | Deadline passed 26 Oct |
| 23 Oct | CVE-2026-110447 | Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection Vulnerability | Deadline passed 26 Oct |
| 20 Oct | CVE-2026-106931 | EG Secure Solutions SiteGuard Server EditionEG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | Deadline passed 23 Oct |
| 20 Oct | CVE-2026-96656 | Plex Media ServerPlex Media Server External Control of File Name or Path Vulnerability | Deadline passed 23 Oct |
| 20 Oct | CVE-2026-96655 | Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Deadline passed 03 Nov |
| 20 Oct | CVE-2026-96654 | Plex Media ServerPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | Deadline passed 23 Oct |
| 20 Oct | CVE-2026-96652 | Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability | Deadline passed 03 Nov |
| 20 Oct | CVE-2026-110936 | Siemens Software CenterSiemens Software Center Uncontrolled Search Path Element Vulnerability | Deadline passed 03 Nov |
| 16 Oct | CVE-2026-102764 | BeyondTrust Remote SupportBeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | Deadline passed 19 Oct |
| 16 Oct | CVE-2025-61624 | Fortinet Multiple ProductsFortinet Multiple Products Path Traversal Vulnerability | Deadline passed 19 Oct |
| 15 Oct | CVE-2026-21589 | Atlassian Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Deadline passed 18 Oct |
| 14 Oct | CVE-2026-105134 | AhsayCBSAhsay AhsayCBS Command Injection Vulnerability | Deadline passed 17 Oct |
| 14 Oct | CVE-2026-76519 | Cisco Secure Email GatewayCisco Secure Email Gateway Relative Path Traversal Vulnerability | Deadline passed 17 Oct |
| 14 Oct | CVE-2026-105133 | AhsayCBSAhsay AhsayCBS Improper Authentication Vulnerability | Deadline passed 17 Oct |
| 14 Oct | CVE-2026-0322 | Palo Alto Networks PAN-OSPalo Alto Networks PAN-OS Code Injection Vulnerability | Deadline passed 17 Oct |
Source: CISA Known Exploited Vulnerabilities catalog. Updated every 30 minutes.
Get the next one as it happensPatchwire posts exploited bugs and critical patches to Telegram within minutes. Free, short and sourced.
Join t.me/patchwire_news