Is it exploited?
Vulnerabilities under active attack
Every vulnerability with evidence of exploitation in the wild — 1,762 of them. Not a list of everything that has a CVE number. A list of what someone has already used against someone.
- CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability Broadcom · VMware ESX
- CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability Linux · Kernel
- CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability Adobe · Commerce and Magento
- CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability Google · Brotli
- CVE-2026-109618 PHP Memory Corruption Vulnerability PHP Group · PHP
- CVE-2026-109619 PHP Stale Internal Request-State Vulnerability PHP Group · PHP
- CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability Arista · VeloCloud Orchestrator
- CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora · Collabora Online – Built-in CODE Server
- CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions · SiteGuard Server Edition
- CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability Plex · Media Server
- CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex · Media Server
- CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability Plex · Media Server
- CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex · Media Server
- CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability Siemens · Software Center
- CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust · Remote Support
- CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability Fortinet · Multiple Products
- CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Atlassian · Multiple Products
- CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability Ahsay · AhsayCBS
- CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability Cisco · Secure Email Gateway
- CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability Ahsay · AhsayCBS
- CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability Palo Alto Networks · PAN-OS
- CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Ivanti · Connect Secure
- CVE-2026-96951 Microsoft Windows Command Injection Vulnerability Microsoft · Windows
- CVE-2015-5477 ISC BIND Data Processing Errors Vulnerability ISC · BIND
- CVE-2016-3081 Apache Struts Command Injection Vulnerability Apache · Struts
- CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Vulnerability Strapi · Strapi
- CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal Vulnerability ONLYOFFICE · Docs
- CVE-2015-3306 ProFTPD Improper Access Control Vulnerability ProFTPD · ProFTPD
- CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix · NetScaler
- CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability Zammad GmbH · Zammad
- CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability Zammad GmbH · Zammad
- CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability Fortinet · FortiMail
- CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Cisco · Catalyst SD-WAN Manager
- CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability Apple · Multiple Products
- CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix · NetScaler
- CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability Citrix · NetScaler
- CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability MikroTik · RouterOS
- CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability Microsoft · SharePoint
- CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability WordPress · Core
- CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability WSO2 · Multiple Products
- CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe · Commerce and Magento
- CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability Arista · VeloCloud Orchestrator
- CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability F5 · BIG-IP APM
- CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability Check Point · Multiple Products
- CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability Check Point · Multiple Products
- CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Zyxel · GS1900 Series Switches
- CVE-2025-39964 Linux Kernel Race Condition Vulnerability Linux · Kernel
- CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability Linux · Kernel
- CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability Linux · Kernel
- CVE-2026-58704 Google Pixel Improper Authorization Vulnerability Google · Pixel
- CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability Cisco · Identity Services Engine
- CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability Acronis · Backup
- CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability Cisco · Secure Email Gateway
- CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability ConnectWise · ScreenConnect
- CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability JFrog · Artifactory
- CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability JFrog · Artifactory
- CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability GitLab · Community Edition and Enterprise Edition
- CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability MikroTik · RouterOS
- CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability MikroTik · RouterOS
- CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability Citrix · NetScaler
- CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Fortinet · Multiple Products
- CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability Google · Chromium V8
- CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
- CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability Adobe · Commerce and Magento
- CVE-2026-81963 Microsoft Windows Link Following Vulnerability Microsoft · Windows
- CVE-2026-86218 N-able N-central Static Code Injection Vulnerability N-able · N-central
- CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Microsoft · Windows
- CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability Google · Chromium V8
- CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability BerriAI · LiteLLM
- CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability Kludex · Starlette
- CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability Kestra · Kestra OSS
- CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability JFrog · Artifactory
- CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability Sangoma · Switchvox
- CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall · SMA1000 Appliances
- CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability SonicWall · SMA1000 Appliances
- CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability PaperCut · NG/MF
- CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability PaperCut · NG/MF
- CVE-2023-49105 ownCloud Improper Authentication Vulnerability ownCloud · ownCloud
- CVE-2026-53362 Linux Kernel Unspecified Vulnerability Linux · Kernel
- CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability JFrog · Artifactory
- CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability Ajax.NET Professional · Ajax.NET Professional
- CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability Red Hat · Libuser
- CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Red Hat · Automatic Bug Reporting Tool
- CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability Linux · Kernel
- CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix · NetScaler ADC and NetScaler Gateway
- CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability Microsoft · SQL Server
- CVE-2026-60004 Gitea Code Injection Vulnerability Gitea · Gitea
- CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in
- CVE-2026-73570 Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability Synacor · Zimbra Collaboration Suite (ZCS)
- CVE-2026-72530 TrueConf Server Code Injection Vulnerability TrueConf · Server
- CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability TrueConf · Server
- CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability MLflow · MLflow
- CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability Microsoft · Internet Key Exchange (IKE) Service Extensions
- CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability Broadcom · VMware vCenter
- CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability Microsoft · SharePoint
- CVE-2026-65400 Apple macOS Improper Authentication Vulnerability Apple · macOS
- CVE-2025-62593 Ray-Project Ray Code Injection Vulnerability Ray-Project · Ray
- CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
- CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability Microsoft · Windows Ancillary Function Driver for WinSock
- CVE-2026-72898 Metabase SQL Injection Vulnerability Metabase · Metabase
- CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability Progress · LoadMaster
- CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability JetBrains · TeamCity
- CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability N-able · N-central
- CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Apache · Tomcat
- CVE-2026-9198 IBM Langflow Code Injection Vulnerability IBM · Langflow
- CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability N-able · N-central
- CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Cisco · Secure Firewall Management Center (FMC)
- CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Fortinet · FortiOS
- CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability Arista · VeloCloud Orchestrator
- CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability Check Point · SmartConsole
- CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint
- CVE-2026-60137 WordPress Core SQL Injection Vulnerability WordPress · Core
- CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability WordPress · Core
- CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability Langflow · Langflow
- CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability DD-WRT · DD-WRT
- CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint
- CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet · FortiSandbox
- CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet · FortiSandbox
- CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle · E-Business Suite
- CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability KNX Association · KNX Protocol Connection Authorization Option 1
Nothing on this page matches that filter.