Skip to main content
(844) 422-7000

Free tool

Search the vulnerabilities attackers are using right now

Every entry on CISA's Known Exploited Vulnerabilities list. A product only goes on this list once attackers are already using the hole, so if something you run is here, patch it now.

  1. CPCheck Point Multiple ProductsCVE-2026-123039 · added Nov 13, 2026
  2. UNUnrealIRCd UnrealIRCdCVE-2026-114713 · added Nov 13, 2026
  3. Cisco BroadWorksCVE-2026-20320 · added Nov 10, 2026
  4. Google ChromiumCVE-2026-125350 · added Nov 10, 2026
  5. MIMicrosoft OfficeCVE-2026-124194 · added Nov 10, 2026
  6. BNBarracuda Networks Barracuda Email Security Gateway (ESG)CVE-2026-116606 · added Nov 10, 2026
  7. OMOpenwave Messaging Limited Webtop Media TranscoderCVE-2026-111793 · added Nov 10, 2026
  8. BNBarracuda Networks Multiple ProductsCVE-2026-111560 · added Nov 10, 2026
  • 1,781vulnerabilities on the list
  • 36added in the last 30 days
  • 361known to be used in ransomware
  • 3 daysmedian federal deadline to patch in 2026

Newest 60 of 1,781

  1. CPNov 13, 2026newestCheck Point Multiple ProductsCheck Point Multiple Products Incorrect Permission Assignment for Critical Resource VulnerabilityCVE-2026-123039
  2. UNNov 13, 2026newestUnrealIRCd UnrealIRCdUnrealIRCd Improper Neutralization of Delimiters VulnerabilityCVE-2026-114713
  3. Nov 10, 20263 days agoCisco BroadWorksCisco BroadWorks Improper Restriction of XML External Entity Reference VulnerabilityCVE-2026-20320
  4. Nov 10, 20263 days agoGoogle ChromiumGoogle Chromium Use-After-Free VulnerabilityCVE-2026-125350
  5. MINov 10, 20263 days agoMicrosoft OfficeMicrosoft Office Outlook Missing User Interaction for Potentially Unsafe Action VulnerabilityCVE-2026-124194
  6. BNNov 10, 20263 days agoBarracuda Networks Barracuda Email Security Gateway (ESG)Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-116606
  7. OMNov 10, 20263 days agoOpenwave Messaging Limited Webtop Media TranscoderOpenwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres VulnerabilityCVE-2026-111793
  8. BNNov 10, 20263 days agoBarracuda Networks Multiple ProductsBarracuda Networks Multiple Products OS Command Injection VulnerabilityCVE-2026-111560
  9. IBNov 9, 20264 days agoIBM Aspera FaspexIBM Aspera Faspex Incorrect Authorization VulnerabilityCVE-2026-123218
  10. Nov 9, 20264 days agoOpenBSD OpenSSHOpenBSD OpenSSH Unexpected Status Code or Return Value VulnerabilityCVE-2026-123158
  11. SINov 9, 20264 days agoSignalWire FreeSwitchSignalWire FreeSwitch Code Injection VulnerabilityCVE-2026-116779
  12. GPNov 9, 20264 days agoGPUStack GPUStackGPUStack Improper Authentication VulnerabilityCVE-2026-102895
  13. Nov 6, 20267 days agoSonicWall SonicOS SSLVPNSonicWall SonicOS SSLVPN Use of Single-factor Authentication VulnerabilityCVE-2026-19868
  14. Nov 4, 20269 days agoApple Multiple ProductsApple Multiple Products Improper Authentication VulnerabilityCVE-2024-27834
  15. Nov 3, 202610 days agoWordPress WordPress CoreWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition VulnerabilityCVE-2026-119977
  16. IVOct 30, 202614 days agoIvanti Connect SecureIvanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityCVE-2026-118527
  17. IVOct 30, 202614 days agoIvanti Connect SecureIvanti Connect Secure Missing Authentication for Critical Function VulnerabilityCVE-2026-111357
  18. Oct 29, 202615 days agoGitLab Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityCVE-2026-97229
  19. Oct 29, 202615 days agoCisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityCVE-2026-76418
  20. Oct 28, 202616 days agoLinux KernelLinux Kernel Missing Initialization of a Variable VulnerabilityCVE-2026-46300
  21. Oct 28, 202616 days agoBroadcom VMware ESXBroadcom VMWare ESX Insufficient Logging VulnerabilityCVE-2026-41709
  22. ADOct 27, 202617 days agoAdobe Commerce and MagentoAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-48356
  23. Oct 27, 202617 days agoGoogle BrotliGoogle Brotli Unchecked Return Value VulnerabilityCVE-2026-111497
  24. PGOct 26, 202618 days agoPHP Group PHPPHP Stale Internal Request-State VulnerabilityCVE-2026-109619
  25. PGOct 26, 202618 days agoPHP Group PHPPHP Memory Corruption VulnerabilityCVE-2026-109618
  26. AROct 23, 202621 days agoArista VeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection VulnerabilityCVE-2026-114625
  27. COOct 23, 202621 days agoCollabora Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection VulnerabilityCVE-2026-110447
  28. Oct 20, 202624 days agoPlex Media ServerPlex Media Server External Control of File Name or Path VulnerabilityCVE-2026-96656
  29. Oct 20, 202624 days agoPlex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96655
  30. Oct 20, 202624 days agoPlex Media ServerPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityCVE-2026-96654
  31. Oct 20, 202624 days agoPlex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96652
  32. Oct 20, 202624 days agoSiemens Software CenterSiemens Software Center Uncontrolled Search Path Element VulnerabilityCVE-2026-110936
  33. ESOct 20, 202624 days agoEG Secure Solutions SiteGuard Server EditionEG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityCVE-2026-106931
  34. BEOct 16, 202628 days agoBeyondTrust Remote SupportBeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityCVE-2026-102764
  35. Oct 16, 202628 days agoFortinet Multiple ProductsFortinet Multiple Products Path Traversal VulnerabilityCVE-2025-61624
  36. Oct 15, 202629 days agoAtlassian Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityCVE-2026-21589
  37. Oct 14, 202630 days agoCisco Secure Email GatewayCisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519
  38. AHOct 14, 202630 days agoAhsay AhsayCBSAhsay AhsayCBS Command Injection VulnerabilityCVE-2026-105134
  39. AHOct 14, 202630 days agoAhsay AhsayCBSAhsay AhsayCBS Improper Authentication VulnerabilityCVE-2026-105133
  40. Oct 14, 202630 days agoPalo Alto Networks PAN-OSPalo Alto Networks PAN-OS Code Injection VulnerabilityCVE-2026-0322
  41. MIOct 13, 202631 days agoMicrosoft WindowsMicrosoft Windows Command Injection VulnerabilityCVE-2026-96951
  42. IVOct 13, 202631 days agoIvanti Connect SecureIvanti Connect Secure Authentication Bypass by Spoofing VulnerabilityCVE-2026-104935
  43. Oct 8, 202636 days agoStrapi StrapiStrapi Cleartext Storage of Sensitive Information VulnerabilityCVE-2023-22894
  44. Oct 8, 202636 days agoONLYOFFICE DocsONLYOFFICE Docs Server Path Traversal VulnerabilityCVE-2021-3199
  45. Oct 8, 202636 days agoApache StrutsApache Struts Command Injection VulnerabilityCVE-2016-3081
  46. ISOct 8, 202636 days agoISC BINDISC BIND Data Processing Errors VulnerabilityCVE-2015-5477
  47. PROct 8, 202636 days agoProFTPD ProFTPDProFTPD Improper Access Control VulnerabilityCVE-2015-3306
  48. Oct 4, 202640 days agoCitrix NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88779
  49. ZGOct 2, 202642 days agoZammad GmbH ZammadZammad GmbH Zammad Improper Privilege Management VulnerabilityCVE-2026-102490
  50. ZGOct 2, 202642 days agoZammad GmbH ZammadZammad GmbH Zammad Session Fixation VulnerabilityCVE-2026-102489
  51. Oct 1, 202643 days agoFortinet FortiMailFortinet FortiMail Path Traversal VulnerabilityCVE-2026-104286
  52. Sep 30, 202644 days agoCisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCVE-2026-76504
  53. Sep 29, 202645 days agoApple Multiple ProductsApple Multiple Products Out-of-Bounds Write VulnerabilityCVE-2026-86950
  54. Sep 27, 202647 days agoCitrix NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88772
  55. Sep 27, 202647 days agoCitrix NetScalerCitrix NetScaler Improper Input Validation VulnerabilityCVE-2026-88771
  56. Sep 25, 202649 days agoWordPress CoreWordPress Core Remote File Inclusion VulnerabilityCVE-2026-87902
  57. Sep 25, 202649 days agoMikroTik RouterOSMikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityCVE-2026-67279
  58. MISep 25, 202649 days agoMicrosoft SharePointMicrosoft SharePoint Code Injection VulnerabilityCVE-2026-65660
  59. ADSep 24, 202650 days agoAdobe Commerce and MagentoAdobe Commerce and Magento Incorrect Authorization VulnerabilityCVE-2026-71362
  60. WSSep 24, 202650 days agoWSO2 Multiple ProductsWSO2 Multiple Products Path Traversal VulnerabilityCVE-2026-5430

Source: CISA Known Exploited Vulnerabilities catalog, version 2026.11.13. We copy it into this page each time the site is updated.

3 days

to patch

When CISA adds a vulnerability to this list, federal agencies get a deadline to fix it. Of the 297 added in 2026, half came with a deadline of 3 days or less. Attackers don't wait for that deadline: by the time an entry shows up here, it is already being used against real networks.

We watch the list for you

Our managed IT customers don't need to search this page. We track the equipment and software we look after, and when something on their network shows up here, we patch it and tell them when it's done.

Talk to us about monitoring844-422-7000
CloudCentric · Mount Pleasant, SC · serving Charleston and the Lowcountry(844) 422-7000