zeroday-watch

zeroday-watchhttps://github.com/zohuyhieuzo03/zeroday-watchForum signals about exploited vulnerabilities, labelled by evidence.Sat, 24 Oct 2026 02:18:18 +0000[kev_exploited] Taking 'execute logging' a bit too seriously – CVE-2026-88771https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771hn:50200681kev_exploited[kev_exploited] CVE-2026-88771 https://news.ycombinator.com/item?id=50200681[kev_exploited] CVE-2026-114625: Arista VeloCloud Orchestrator - Arista VeloCloud Orchestrator SQL Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-114625kev:CVE-2026-114625kev_exploited[kev_exploited] CVE-2026-114625 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-110447: Collabora Collabora Online – Built-in CODE Server - Collabora Online – Built-in CODE Server OS Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-110447kev:CVE-2026-110447kev_exploited[kev_exploited] CVE-2026-110447 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition - EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-106931kev:CVE-2026-106931kev_exploited[kev_exploited] CVE-2026-106931 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-96656: Plex Media Server - Plex Media Server External Control of File Name or Path Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-96656kev:CVE-2026-96656kev_exploited[kev_exploited] CVE-2026-96656 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-96655: Plex Media Server - Plex Media Server Server-Side Request Forgery (SSRF) Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-96655kev:CVE-2026-96655kev_exploited[kev_exploited] CVE-2026-96655 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-96654: Plex Media Server - Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-96654kev:CVE-2026-96654kev_exploited[kev_exploited] CVE-2026-96654 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-96652: Plex Media Server - Plex Media Server Server-Side Request Forgery (SSRF) Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-96652kev:CVE-2026-96652kev_exploited[kev_exploited] CVE-2026-96652 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-110936: Siemens Software Center - Siemens Software Center Uncontrolled Search Path Element Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-110936kev:CVE-2026-110936kev_exploited[kev_exploited] CVE-2026-110936 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-102764: BeyondTrust Remote Support - BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-102764kev:CVE-2026-102764kev_exploited[kev_exploited] CVE-2026-102764 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2025-61624: Fortinet Multiple Products - Fortinet Multiple Products Path Traversal Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2025-61624kev:CVE-2025-61624kev_exploited[kev_exploited] CVE-2025-61624 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-21589: Atlassian Multiple Products - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-21589kev:CVE-2026-21589kev_exploited[kev_exploited] CVE-2026-21589 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-105134: Ahsay AhsayCBS - Ahsay AhsayCBS Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-105134kev:CVE-2026-105134kev_exploited[kev_exploited] CVE-2026-105134 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-76519: Cisco Secure Email Gateway - Cisco Secure Email Gateway Relative Path Traversal Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-76519kev:CVE-2026-76519kev_exploited[kev_exploited] CVE-2026-76519 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-105133: Ahsay AhsayCBS - Ahsay AhsayCBS Improper Authentication Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-105133kev:CVE-2026-105133kev_exploited[kev_exploited] CVE-2026-105133 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-0322: Palo Alto Networks PAN-OS - Palo Alto Networks PAN-OS Code Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-0322kev:CVE-2026-0322kev_exploited[kev_exploited] CVE-2026-0322 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-104935: Ivanti Connect Secure - Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-104935kev:CVE-2026-104935kev_exploited[kev_exploited] CVE-2026-104935 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-96951: Microsoft Windows - Microsoft Windows Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-96951kev:CVE-2026-96951kev_exploited[kev_exploited] CVE-2026-96951 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] Atlassian Jira, Confluence Pre-Auth Arbitrary File Read (CVE-2026-21589)https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/hn:50005577kev_exploited[kev_exploited] CVE-2026-21589 https://news.ycombinator.com/item?id=50005577[kev_exploited] CVE-2015-5477: ISC BIND - ISC BIND Data Processing Errors Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2015-5477kev:CVE-2015-5477kev_exploited[kev_exploited] CVE-2015-5477 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2016-3081: Apache Struts - Apache Struts Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2016-3081kev:CVE-2016-3081kev_exploited[kev_exploited] CVE-2016-3081 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2023-22894: Strapi Strapi - Strapi Cleartext Storage of Sensitive Information Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2023-22894kev:CVE-2023-22894kev_exploited[kev_exploited] CVE-2023-22894 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2021-3199: ONLYOFFICE Docs - ONLYOFFICE Docs Server Path Traversal Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2021-3199kev:CVE-2021-3199kev_exploited[kev_exploited] CVE-2021-3199 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2015-3306: ProFTPD ProFTPD - ProFTPD Improper Access Control Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2015-3306kev:CVE-2015-3306kev_exploited[kev_exploited] CVE-2015-3306 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] Ten days inside CVE-2026-88771: anatomy of a NetScaler exploitation wavehttps://huntback.io/blog/cve-88771-analysishn:49995889kev_exploited[kev_exploited] CVE-2026-88771 https://news.ycombinator.com/item?id=49995889[zero_day_reported] Citrix discloses third actively exploited NetScaler zero-day in less than a weekhttps://cyberscoop.com/citrix-netscaler-third-exploited-zero-day-vulnerability/hn:49972694zero_day_reported[zero_day_reported] https://news.ycombinator.com/item?id=49972694[kev_exploited] CVE-2026-88779: Citrix NetScaler - Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-88779kev:CVE-2026-88779kev_exploited[kev_exploited] CVE-2026-88779 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[zero_day_reported] Fortinet sounds the alarm over actively exploited FortiMail zero-dayhttps://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803hn:49933696zero_day_reported[zero_day_reported] https://news.ycombinator.com/item?id=49933696[kev_exploited] Zammad zero-days for RCE and root (CVE-2026-102489/102490)https://csirt.divd.nl/cases/DIVD-2026-00015/hn:49931836kev_exploited[kev_exploited] CVE-2026-102489 https://news.ycombinator.com/item?id=49931836[kev_exploited] CVE-2026-102490: Zammad GmbH Zammad - Zammad GmbH Zammad Improper Privilege Management Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-102490kev:CVE-2026-102490kev_exploited[kev_exploited] CVE-2026-102490 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-102489: Zammad GmbH Zammad - Zammad GmbH Zammad Session Fixation Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-102489kev:CVE-2026-102489kev_exploited[kev_exploited] CVE-2026-102489 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-86950: The Great Glyph Grift - An in-the-wild iOS bug with a possible WhatsApp zero-click pathhttps://calif.io/research/the-great-glyph-griftlobsters:yfttknkev_exploited[kev_exploited] CVE-2026-86950 https://lobste.rs/s/yfttkn/cve_2026_86950_great_glyph_grift_wild_ios[kev_exploited] CVE-2026-104286: Fortinet FortiMail - Fortinet FortiMail Path Traversal Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-104286kev:CVE-2026-104286kev_exploited[kev_exploited] CVE-2026-104286 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-86950: An in-the-wild iOS bug with a possible WhatsApp zero-click pathhttps://calif.io/research/the-great-glyph-grifthn:49915669kev_exploited[kev_exploited] CVE-2026-86950 https://news.ycombinator.com/item?id=49915669[kev_exploited] CVE-2026-76504: Cisco Catalyst SD-WAN Manager - Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-76504kev:CVE-2026-76504kev_exploited[kev_exploited] CVE-2026-76504 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-86950: Apple Multiple Products - Apple Multiple Products Out-of-Bounds Write Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-86950kev:CVE-2026-86950kev_exploited[kev_exploited] CVE-2026-86950 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] Taking 'execute logging' a bit too literally CVE-2026-88771https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771hn:49885574kev_exploited[kev_exploited] CVE-2026-88771 https://news.ycombinator.com/item?id=49885574[kev_exploited] Active, in-the-wild exploitation of CVE-2026-88771 with IoCshttps://twitter.com/LupovisDefence/status/2104595071362326680hn:49880305kev_exploited[kev_exploited] CVE-2026-88771 https://news.ycombinator.com/item?id=49880305[kev_exploited] Citrix NetScaler PreAuth Command Injection CVE-2026-88771https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/hn:49879330kev_exploited[kev_exploited] CVE-2026-88771 https://news.ycombinator.com/item?id=49879330[kev_exploited] CVE-2026-88772: Citrix NetScaler - Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-88772kev:CVE-2026-88772kev_exploited[kev_exploited] CVE-2026-88772 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-88771: Citrix NetScaler - Citrix NetScaler Improper Input Validation Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-88771kev:CVE-2026-88771kev_exploited[kev_exploited] CVE-2026-88771 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-67279: MikroTik RouterOS - Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-67279kev:CVE-2026-67279kev_exploited[kev_exploited] CVE-2026-67279 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-65660: Microsoft SharePoint - Microsoft SharePoint Code Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-65660kev:CVE-2026-65660kev_exploited[kev_exploited] CVE-2026-65660 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-87902: WordPress Core - WordPress Core Remote File Inclusion Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-87902kev:CVE-2026-87902kev_exploited[kev_exploited] CVE-2026-87902 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CISA active Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682)https://github.com/mc493/linux-kernel-zero-day-mitigation-zero-downtime-kernel-defense-hn:49833501kev_exploited[kev_exploited] CVE-2025-39682 CVE-2025-39964 CVE-2026-53266 https://news.ycombinator.com/item?id=49833501[kev_exploited] CVE-2026-5430: WSO2 Multiple Products - WSO2 Multiple Products Path Traversal Vulnerability https://nvd.nist.gov/vuln/detail/CVE-2026-5430kev:CVE-2026-5430kev_exploited[kev_exploited] CVE-2026-5430 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-71362: Adobe Commerce and Magento - Adobe Commerce and Magento Incorrect Authorization Vulnerability https://nvd.nist.gov/vuln/detail/CVE-2026-71362kev:CVE-2026-71362kev_exploited[kev_exploited] CVE-2026-71362 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] GitLab Critical Patch Release: 19.0.9, 18.11.12https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-9-released/gitlab:patch-release-gitlab-19-0-9-releasedkev_exploited[kev_exploited] CVE-2026-85706 CVE-2026-87719 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-9-released/[kev_exploited] CVE-2026-93952: Arista VeloCloud Orchestrator - Arista VeloCloud Orchestrator Improper Input Validation Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-93952kev:CVE-2026-93952kev_exploited[kev_exploited] CVE-2026-93952 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-94127: F5 BIG-IP APM - F5 BIG-IP APM Heap-based Buffer Overflow Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-94127kev:CVE-2026-94127kev_exploited[kev_exploited] CVE-2026-94127 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-93616: Check Point Multiple Products - Check Point Multiple Products Path Traversal Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-93616kev:CVE-2026-93616kev_exploited[kev_exploited] CVE-2026-93616 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-85102: Check Point Multiple Products - Check Point Multiple Products Improper Certificate Validation Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-85102kev:CVE-2026-85102kev_exploited[kev_exploited] CVE-2026-85102 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-7273: Zyxel GS1900 Series Switches - Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-7273kev:CVE-2026-7273kev_exploited[kev_exploited] CVE-2026-7273 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2025-39964: Linux Kernel - Linux Kernel Race Condition Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2025-39964kev:CVE-2025-39964kev_exploited[kev_exploited] CVE-2025-39964 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-53266: Linux Kernel - Linux Kernel Out-of-Bounds Write Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-53266kev:CVE-2026-53266kev_exploited[kev_exploited] CVE-2026-53266 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2025-39682: Linux Kernel - Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2025-39682kev:CVE-2025-39682kev_exploited[kev_exploited] CVE-2025-39682 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-58704: Google Pixel - Google Pixel Improper Authorization Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-58704kev:CVE-2026-58704kev_exploited[kev_exploited] CVE-2026-58704 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-76460: Cisco Identity Services Engine - Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-76460kev:CVE-2026-76460kev_exploited[kev_exploited] CVE-2026-76460 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-87886: Acronis Backup - Acronis Backup Incorrect Default Permissions Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-87886kev:CVE-2026-87886kev_exploited[kev_exploited] CVE-2026-87886 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] Artifactory: In-the-Wild Exploitation of CVE-2026-42016,CVE-2026-42018https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201hn:49691168kev_exploited[kev_exploited] CVE-2026-42016 CVE-2026-42018 https://news.ycombinator.com/item?id=49691168[kev_exploited] CVE-2026-76461: Cisco Secure Email Gateway - Cisco Secure Email Gateway SQL Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-76461kev:CVE-2026-76461kev_exploited[kev_exploited] CVE-2026-76461 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-84869: ConnectWise ScreenConnect - ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-84869kev:CVE-2026-84869kev_exploited[kev_exploited] CVE-2026-84869 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-42016: JFrog Artifactory - JFrog Artifactory Incorrect Authorization Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-42016kev:CVE-2026-42016kev_exploited[kev_exploited] CVE-2026-42016 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-42018: JFrog Artifactory - JFrog Artifactory Improper Authentication Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-42018kev:CVE-2026-42018kev_exploited[kev_exploited] CVE-2026-42018 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-85706: GitLab Community Edition and Enterprise Edition - GitLab Community Edition and Enterprise Edition Path Traversal Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-85706kev:CVE-2026-85706kev_exploited[kev_exploited] CVE-2026-85706 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-86060: MikroTik RouterOS - MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-86060kev:CVE-2026-86060kev_exploited[kev_exploited] CVE-2026-86060 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-67277: MikroTik RouterOS - MikroTik RouterOS Missing Authentication for Critical Function Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-67277kev:CVE-2026-67277kev_exploited[kev_exploited] CVE-2026-67277 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/gitlab:patch-release-gitlab-19-3-2-releasedkev_exploited[kev_exploited] CVE-2024-11222 CVE-2025-14871 CVE-2026-1168 CVE-2026-12910 CVE-2026-13210 CVE-2026-16794 CVE-2026-19619 CVE-2026-3855 CVE-2026-7514 CVE-2026-78252 CVE-2026-79708 CVE-2026-8030 CVE-2026-82837 CVE-2026-85706 CVE-2026-86340 CVE-2026-86341 CVE-2026-87719 CVE-2026-88765 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/[kev_exploited] CVE-2026-19490: Citrix NetScaler - Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-19490kev:CVE-2026-19490kev_exploited[kev_exploited] CVE-2026-19490 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2025-25249: Fortinet Multiple Products - Fortinet Multiple Products Heap-based Buffer Overflow Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2025-25249kev:CVE-2025-25249kev_exploited[kev_exploited] CVE-2025-25249 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-87491: Google Chromium V8 - Google Chromium V8 Out of Bounds Write Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-87491kev:CVE-2026-87491kev_exploited[kev_exploited] CVE-2026-87491 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-20079: Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management - Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-20079kev:CVE-2026-20079kev_exploited[kev_exploited] CVE-2026-20079 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-75650: Adobe Commerce and Magento - Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-75650kev:CVE-2026-75650kev_exploited[kev_exploited] CVE-2026-75650 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-81963: Microsoft Windows - Microsoft Windows Link Following Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-81963kev:CVE-2026-81963kev_exploited[kev_exploited] CVE-2026-81963 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-86218: N-able N-central - N-able N-central Static Code Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-86218kev:CVE-2026-86218kev_exploited[kev_exploited] CVE-2026-86218 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-85880: Microsoft Windows - Microsoft Windows Heap-Based Buffer Overflow Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-85880kev:CVE-2026-85880kev_exploited[kev_exploited] CVE-2026-85880 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] Ask HN: Why is HN censoring this post about CVE-2026-85046?https://news.ycombinator.com/item?id=49587543hn:49587543kev_exploited[kev_exploited] CVE-2026-85046 https://news.ycombinator.com/item?id=49587543[kev_exploited] CVE-2026-85046: Google Chromium V8 - Google Chromium V8 Type Confusion Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-85046kev:CVE-2026-85046kev_exploited[kev_exploited] CVE-2026-85046 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-59822: BerriAI LiteLLM - BerriAI LiteLLM Improper Authentication Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-59822kev:CVE-2026-59822kev_exploited[kev_exploited] CVE-2026-59822 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-48710: Kludex Starlette - Kludex Starlette HTTP Request/Response Smuggling Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-48710kev:CVE-2026-48710kev_exploited[kev_exploited] CVE-2026-48710 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-49869: Kestra Kestra OSS - Kestra OSS OS Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-49869kev:CVE-2026-49869kev_exploited[kev_exploited] CVE-2026-49869 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-82329: JFrog Artifactory - JFrog Artifactory Improper Authentication Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-82329kev:CVE-2026-82329kev_exploited[kev_exploited] CVE-2026-82329 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-9586: Sangoma Switchvox - Sangoma Switchvox SQL Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-9586kev:CVE-2026-9586kev_exploited[kev_exploited] CVE-2026-9586 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-83548: SonicWall SMA1000 Appliances - SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-83548kev:CVE-2026-83548kev_exploited[kev_exploited] CVE-2026-83548 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-83549: SonicWall SMA1000 Appliances - SonicWall SMA1000 Appliances OS Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-83549kev:CVE-2026-83549kev_exploited[kev_exploited] CVE-2026-83549 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-82078: PaperCut NG/MF - PaperCut NG/MF Unsafe Reflection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-82078kev:CVE-2026-82078kev_exploited[kev_exploited] CVE-2026-82078 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-81578: PaperCut NG/MF - PaperCut NG/MF Missing Authentication for Critical Function Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-81578kev:CVE-2026-81578kev_exploited[kev_exploited] CVE-2026-81578 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2023-49105: ownCloud ownCloud - ownCloud Improper Authentication Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2023-49105kev:CVE-2023-49105kev_exploited[kev_exploited] CVE-2023-49105 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-53362: Linux Kernel - Linux Kernel Unspecified Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-53362kev:CVE-2026-53362kev_exploited[kev_exploited] CVE-2026-53362 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-66384: JFrog Artifactory - JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-66384kev:CVE-2026-66384kev_exploited[kev_exploited] CVE-2026-66384 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2021-23758: Ajax.NET Professional Ajax.NET Professional - Ajax.NET Professional Deserialization of Untrusted Data Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2021-23758kev:CVE-2021-23758kev_exploited[kev_exploited] CVE-2021-23758 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2015-3246: Red Hat Libuser - Red Hat Libuser Race Condition Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2015-3246kev:CVE-2015-3246kev_exploited[kev_exploited] CVE-2015-3246 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2015-5287: Red Hat Automatic Bug Reporting Tool - Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2015-5287kev:CVE-2015-5287kev_exploited[kev_exploited] CVE-2015-5287 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2022-0995: Linux Kernel - Linux Kernel Out-of-Bounds Write Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2022-0995kev:CVE-2022-0995kev_exploited[kev_exploited] CVE-2022-0995 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-8452: Citrix NetScaler ADC and NetScaler Gateway - Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-8452kev:CVE-2026-8452kev_exploited[kev_exploited] CVE-2026-8452 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2019-1068: Microsoft SQL Server - Microsoft SQL Server Remote Code Execution Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2019-1068kev:CVE-2019-1068kev_exploited[kev_exploited] CVE-2019-1068 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-60004: Gitea Gitea - Gitea Code Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-60004kev:CVE-2026-60004kev_exploited[kev_exploited] CVE-2026-60004 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in - Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-21962kev:CVE-2026-21962kev_exploited[kev_exploited] CVE-2026-21962 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-73570: Synacor Zimbra Collaboration Suite (ZCS) - Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-73570kev:CVE-2026-73570kev_exploited[kev_exploited] CVE-2026-73570 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-72530: TrueConf Server - TrueConf Server Code Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-72530kev:CVE-2026-72530kev_exploited[kev_exploited] CVE-2026-72530 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-72529: TrueConf Server - TrueConf Server Missing Authentication for Critical Function Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-72529kev:CVE-2026-72529kev_exploited[kev_exploited] CVE-2026-72529 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-64849: MLflow MLflow - MLflow Server-Side Request Forgery Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-64849kev:CVE-2026-64849kev_exploited[kev_exploited] CVE-2026-64849 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions - Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-33824kev:CVE-2026-33824kev_exploited[kev_exploited] CVE-2026-33824 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-59310: Broadcom VMware vCenter - Broadcom VMware vCenter Path Traversal Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-59310kev:CVE-2026-59310kev_exploited[kev_exploited] CVE-2026-59310 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-55040: Microsoft SharePoint - Microsoft SharePoint Weak Authentication Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-55040kev:CVE-2026-55040kev_exploited[kev_exploited] CVE-2026-55040 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-65400: Apple macOS - Apple macOS Improper Authentication Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-65400kev:CVE-2026-65400kev_exploited[kev_exploited] CVE-2026-65400 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2025-62593: Ray-Project Ray - Ray-Project Ray Code Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2025-62593kev:CVE-2025-62593kev_exploited[kev_exploited] CVE-2025-62593 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] You're Back in the Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/hn:49295904kev_exploited[kev_exploited] CVE-2026-8452 https://news.ycombinator.com/item?id=49295904[kev_exploited] CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) - Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-20349kev:CVE-2026-20349kev_exploited[kev_exploited] CVE-2026-20349 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock - Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-68820kev:CVE-2026-68820kev_exploited[kev_exploited] CVE-2026-68820 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-72898: Metabase Metabase - Metabase SQL Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-72898kev:CVE-2026-72898kev_exploited[kev_exploited] CVE-2026-72898 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-65400: Apple macOS Screen Sharing authentication bypasshttps://support.apple.com/en-us/148170hn:49247537kev_exploited[kev_exploited] CVE-2026-65400 https://news.ycombinator.com/item?id=49247537[kev_exploited] CVE-2026-8037: Progress LoadMaster - Progress LoadMaster Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-8037kev:CVE-2026-8037kev_exploited[kev_exploited] CVE-2026-8037 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-63077: JetBrains TeamCity - JetBrains TeamCity Deserialization of Untrusted Data Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-63077kev:CVE-2026-63077kev_exploited[kev_exploited] CVE-2026-63077 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-18556: N-able N-central - N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-18556kev:CVE-2026-18556kev_exploited[kev_exploited] CVE-2026-18556 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-34486: Apache Tomcat - Apache Tomcat Missing Encryption of Sensitive Data Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-34486kev:CVE-2026-34486kev_exploited[kev_exploited] CVE-2026-34486 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-9198: IBM Langflow - IBM Langflow Code Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-9198kev:CVE-2026-9198kev_exploited[kev_exploited] CVE-2026-9198 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-18577: N-able N-central - N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-18577kev:CVE-2026-18577kev_exploited[kev_exploited] CVE-2026-18577 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[zero_day_reported] Cisco FMC static credential vulnerability exploited as a zero-dayhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjhhn:49107382zero_day_reported[zero_day_reported] https://news.ycombinator.com/item?id=49107382[kev_exploited] CVE-2026-20316: Cisco Secure Firewall Management Center (FMC) - Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-20316kev:CVE-2026-20316kev_exploited[kev_exploited] CVE-2026-20316 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2025-68686: Fortinet FortiOS - Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2025-68686kev:CVE-2025-68686kev_exploited[kev_exploited] CVE-2025-68686 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] CVE-2026-16812: Arista VeloCloud Orchestrator - Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-16812kev:CVE-2026-16812kev_exploited[kev_exploited] CVE-2026-16812 https://www.cisa.gov/known-exploited-vulnerabilities-catalog[kev_exploited] Frag Gap (CVE-2026-53362, CVE-2026-53366)https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/lobsters:uibzl8kev_exploited[kev_exploited] CVE-2026-53362 CVE-2026-53366 https://lobste.rs/s/uibzl8/frag_gap_cve_2026_53362_cve_2026_53366