Exploits
Vulnerabilities with confirmed active exploitation in the wild - not just a high severity score - sourced from CISA's Known Exploited Vulnerabilities catalog and scored by real-world exploitation likelihood.
Refreshed daily from CISA's Known Exploited Vulnerabilities catalog, VulnCheck's KEV, and ENISA's EU Vulnerability Database, scored with EPSS (Exploit Prediction Scoring System) from FIRST.org - a model estimating the probability a vulnerability will actually be exploited, not just how severe it could theoretically be. The list keeps the 60 highest-priority entries; sort them By priority (most dangerous first - a decades-old flaw under active exploitation can outrank a brand-new one) or by Latest to see the most recently added first.
Apache Struts Remote Code Execution Vulnerability
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution. This is the exact vulnerability behind Equifax's 2017 breach - a financial services credit-reporting agency - which exposed roughly 147 million people's financial and personal data, one of the largest breaches ever tied to a single named CVE.
CVE-2017-5638 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects Apache Struts, most relevant to organizations in Financial Services.
Staying safe: Apply the vendor's security update as soon as possible. Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
CVE-2026-35273 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects Oracle PeopleSoft Enterprise PeopleTools, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Oracle PeopleSoft Enterprise PeopleTools is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
CVE-2026-0257 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects Palo Alto Networks PAN-OS, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations per vendor instructions, follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
CVE-2026-15409 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker trick the server into making requests on their behalf, often reaching internal systems that aren't meant to be exposed. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects SonicWall SMA1000 Appliances, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Restrict the affected service's own outbound network access to only what it legitimately needs - this flaw is exploited specifically to reach internal systems the service was never meant to contact.
Check Point Security Gateway Improper Authentication Vulnerability
Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVE-2026-50751 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects Check Point Security Gateway, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations per vendor instructions, follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
CVE-2026-45659 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker execute code by feeding the application specially-crafted data it wasn't built to safely handle. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects Microsoft SharePoint Server, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat any data this service has ever accepted from an untrusted source as potentially having triggered this, and review for signs of unexpected code execution, not just requests to the deserialization endpoint itself.
PTC Windchill and FlexPLM Improper Input Validation Vulnerability
PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
CVE-2026-12569 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects PTC Windchill and FlexPLM, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether PTC Windchill and FlexPLM is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
SonicWall SMA1000 Appliances Code Injection Vulnerability
SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
CVE-2026-15410 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects SonicWall SMA1000 Appliances, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether SonicWall SMA1000 Appliances is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
CVE-2026-20316 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects Cisco Secure Firewall Management Center (FMC), which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Cisco Secure Firewall Management Center (FMC) is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
PHP Memory Corruption Vulnerability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
CVE-2026-109618 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects PHP Group PHP, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
PHP Stale Internal Request-State Vulnerability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
CVE-2026-109619 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects PHP Group PHP, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Nx Console Embedded Malicious Code Vulnerability
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
CVE-2026-48027 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects Nx Nx Console, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations per vendor instructions, follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. More generally: confirm whether Nx Nx Console is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
CVE-2026-59310 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker read or write files outside the folders the application is supposed to be restricted to. CISA has also tied this vulnerability to known ransomware campaigns, which raises the stakes of leaving it unpatched. It affects Broadcom VMware vCenter, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Check whether any files outside the application's intended directories were read or modified, and review web server logs for unusual "../"-style path patterns in requests.
Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
CVE-2026-111497 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker crash or freeze the affected system, denying service to legitimate users. It affects Google Brotli, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Confirm your current availability monitoring would actually catch this specific pattern, and check whether the affected service has redundancy or failover in place.
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
CVE-2026-21589 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Atlassian Multiple Products, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Atlassian Multiple Products is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
CVE-2026-97229 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects GitLab Community Edition and Enterprise Edition, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether GitLab Community Edition and Enterprise Edition is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
CVE-2026-110447 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects Collabora Collabora Online – Built-in CODE Server, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
CVE-2026-104935 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. It affects Ivanti Connect Secure, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” . Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
ISC BIND Data Processing Errors Vulnerability
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
CVE-2015-5477 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker crash or freeze the affected system, denying service to legitimate users. It affects ISC BIND, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Confirm your current availability monitoring would actually catch this specific pattern, and check whether the affected service has redundancy or failover in place.
ProFTPD Improper Access Control Vulnerability
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVE-2015-3306 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects ProFTPD ProFTPD, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether ProFTPD ProFTPD is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Ivanti Sentry OS Command Injection Vulnerability
Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.
CVE-2026-10520 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects Ivanti Sentry, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
CVE-2026-34486 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Apache Tomcat, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Apache Tomcat is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
CVE-2026-85706 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker read or write files outside the folders the application is supposed to be restricted to. It affects GitLab Community Edition and Enterprise Edition, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Check whether any files outside the application's intended directories were read or modified, and review web server logs for unusual "../"-style path patterns in requests.
WordPress Core Interpretation Conflict Vulnerability
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
CVE-2026-63030 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects WordPress Core, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Apache Struts Command Injection Vulnerability
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
CVE-2016-3081 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker run arbitrary operating-system commands on the server. It affects Apache Struts, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Review shell/process execution logs on the affected system for unexpected commands, and treat any output the application has generated since as suspect until confirmed clean.
Splunk Enterprise Missing Authentication for Critical Function Vulnerability
Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.
CVE-2026-20253 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Splunk Enterprise, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Splunk Enterprise is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
CVE-2026-102764 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. It affects BeyondTrust Remote Support, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
WordPress Core Remote File Inclusion Vulnerability
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
CVE-2026-87902 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects WordPress Core, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
CVE-2026-105134 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker run arbitrary operating-system commands on the server. It affects Ahsay AhsayCBS, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Review shell/process execution logs on the affected system for unexpected commands, and treat any output the application has generated since as suspect until confirmed clean.
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
CVE-2026-105133 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. It affects Ahsay AhsayCBS, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
CVE-2026-39808 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker run arbitrary operating-system commands on the server. It affects Fortinet FortiSandbox, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Review shell/process execution logs on the affected system for unexpected commands, and treat any output the application has generated since as suspect until confirmed clean.
SolarWinds Orion Authentication Bypass Vulnerability
SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands. Orion is widely deployed for network monitoring across U.S. federal government agencies - CISA issued Emergency Directive 21-01 in December 2020 specifically instructing federal civilian agencies to disconnect or patch affected Orion instances after a separate supply-chain compromise of the same product was discovered.
CVE-2020-10148 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. It affects SolarWinds Orion, most relevant to organizations in Government & Public Sector.
Staying safe: Apply the vendor's security update as soon as possible. Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
Check Point Multiple Products Path Traversal Vulnerability
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
CVE-2026-93616 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker read or write files outside the folders the application is supposed to be restricted to. It affects Check Point Multiple Products, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Check whether any files outside the application's intended directories were read or modified, and review web server logs for unusual "../"-style path patterns in requests.
Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
CVE-2026-71362 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Adobe Commerce and Magento, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Adobe Commerce and Magento is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
CVE-2026-48356 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Adobe Commerce and Magento, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Adobe Commerce and Magento is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
CVE-2026-20079 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. It affects Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.
CVE-2026-20230 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker trick the server into making requests on their behalf, often reaching internal systems that aren't meant to be exposed. It affects Cisco Unified Communications Manager, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Restrict the affected service's own outbound network access to only what it legitimately needs - this flaw is exploited specifically to reach internal systems the service was never meant to contact.
Ubiquiti UniFi OS Improper Input Validation Vulnerability
Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
CVE-2026-34910 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker run arbitrary operating-system commands on the server. It affects Ubiquiti UniFi OS, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Review shell/process execution logs on the affected system for unexpected commands, and treat any output the application has generated since as suspect until confirmed clean.
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
CVE-2026-63077 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects JetBrains TeamCity, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.
CVE-2026-81578 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects PaperCut NG/MF, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether PaperCut NG/MF is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
CVE-2026-50522 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker execute code by feeding the application specially-crafted data it wasn't built to safely handle. It affects Microsoft SharePoint, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat any data this service has ever accepted from an untrusted source as potentially having triggered this, and review for signs of unexpected code execution, not just requests to the deserialization endpoint itself.
Ubiquiti UniFi OS Improper Access Control Vulnerability
Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
CVE-2026-34908 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Ubiquiti UniFi OS, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Ubiquiti UniFi OS is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
BerriAI LiteLLM Command Injection Vulnerability
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
CVE-2026-42271 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker run arbitrary operating-system commands on the server. It affects BerriAI LiteLLM, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations per vendor instructions, follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Review shell/process execution logs on the affected system for unexpected commands, and treat any output the application has generated since as suspect until confirmed clean.
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CVE-2021-23758 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects Ajax.NET Professional Ajax.NET Professional, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Citrix NetScaler Improper Input Validation Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
CVE-2026-88771 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Citrix NetScaler, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Citrix NetScaler is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
WordPress Core SQL Injection Vulnerability
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
CVE-2026-60137 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects WordPress Core, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Progress LoadMaster Command Injection Vulnerability
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
CVE-2026-8037 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker run arbitrary operating-system commands on the server. It affects Progress LoadMaster, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Review shell/process execution logs on the affected system for unexpected commands, and treat any output the application has generated since as suspect until confirmed clean.
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
CVE-2026-88772 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects Citrix NetScaler, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
CVE-2026-25089 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker run arbitrary operating-system commands on the server. It affects Fortinet FortiSandbox, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Review shell/process execution logs on the affected system for unexpected commands, and treat any output the application has generated since as suspect until confirmed clean.
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
CVE-2026-76460 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Cisco Identity Services Engine, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Cisco Identity Services Engine is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
CVE-2026-21962 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Check Point SmartConsole Improper Authentication Vulnerability
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
CVE-2026-16232 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. It affects Check Point SmartConsole, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
CVE-2026-48907 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Widget Factory Joomla Content Editor, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Widget Factory Joomla Content Editor is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
mediawiki mediawiki Improper Control of Generation of Code
A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVE-2026-8857 is in VulnCheck's Known Exploited Vulnerabilities catalog (Community), meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects mediawiki mediawiki, which is broadly deployed across essentially every industry.
Staying safe: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. More generally: confirm whether mediawiki mediawiki is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
geomywp geo_my_wordpress Improper Control of Filename for Include/Require Statement in PHP Program
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion can be…
CVE-2026-85200 is in VulnCheck's Known Exploited Vulnerabilities catalog (Community), meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw successful exploitation lets an attacker run their own code on the affected system - effectively taking full remote control of it. It affects ninjew GEO my WP, which is broadly deployed across essentially every industry.
Staying safe: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Treat this as the highest-urgency patch class: remote code execution hands an attacker full control with no further steps needed, so isolate internet-facing instances immediately if patching can't happen right away.
Ubiquiti UniFi OS Path Traversal Vulnerability
Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
CVE-2026-34909 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker read or write files outside the folders the application is supposed to be restricted to. It affects Ubiquiti UniFi OS, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Check whether any files outside the application's intended directories were read or modified, and review web server logs for unusual "../"-style path patterns in requests.
amirraminfar dozzle Server-Side Request Forgery (SSRF)
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that sends an HTTP POST to the supplied URL with attacker-controlled request headers, and returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx. This vulnerability is fixed in 10.5.2.
CVE-2026-45298 is in VulnCheck's Known Exploited Vulnerabilities catalog (Community), meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker trick the server into making requests on their behalf, often reaching internal systems that aren't meant to be exposed. It affects amirraminfar dozzle, which is broadly deployed across essentially every industry.
Staying safe: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Restrict the affected service's own outbound network access to only what it legitimately needs - this flaw is exploited specifically to reach internal systems the service was never meant to contact.
PaperCut NG/MF Unsafe Reflection Vulnerability
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
CVE-2026-82078 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects PaperCut NG/MF, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether PaperCut NG/MF is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
CVE-2026-0770 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Langflow Langflow, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Langflow Langflow is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Apple Multiple Products Improper Authentication Vulnerability
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
CVE-2024-27834 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw lets an attacker access the system without valid credentials, bypassing the login process entirely. It affects Apple Multiple Products, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… Rotate credentials and review authentication logs for signs of prior unauthorized access - this flaw may have already let someone in without ever needing a valid password.
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic…
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenti…
CVE-2026-58115 is in ENISA's EU Vulnerability Database (EUVD) as a confirmed actively-exploited vulnerability, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Siemens Siemens, most relevant to organizations in Critical Infrastructure / OT & ICS.
Staying safe: Apply the vendor's security update as soon as possible. More generally: confirm whether Siemens Siemens is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.
Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
CVE-2026-46300 is in CISA's Known Exploited Vulnerabilities catalog, meaning it isn't a theoretical risk - it has confirmed active exploitation in the wild, not just a high severity score. This specific flaw gives an attacker a way to compromise the system beyond its intended security boundaries. It affects Linux Kernel, which is broadly deployed across essentially every industry.
Staying safe: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see guidance) guidance and CISA’s “Forensics Triage Requirements” (see guidance). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's inter… More generally: confirm whether Linux Kernel is exposed to the internet or reachable by untrusted users, prioritize patching internet-facing instances first, and check available logs for indicators of prior exploitation before assuming a patch alone closes the incident.