CISA KEV 2026-10-27 CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-27 CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-26 CVE-2026-109618 PHP Memory Corruption Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-26 CVE-2026-109619 PHP Stale Internal Request-State Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-23 CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-23 CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-20 CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-20 CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-20 CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-20 CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-20 CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-20 CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-16 CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-16 CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-15 CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-14 CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-14 CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-14 CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-14 CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-13 CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-13 CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-08 CVE-2015-5477 ISC BIND Data Processing Errors Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-08 CVE-2016-3081 Apache Struts Command Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-08 CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-08 CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-08 CVE-2015-3306 ProFTPD Improper Access Control Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-04 CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-02 CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-02 CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-10-01 CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-30 CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-29 CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-27 CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-27 CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-25 CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-25 CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-25 CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-24 CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-24 CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-22 CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-22 CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-22 CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-22 CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-21 CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-18 CVE-2025-39964 Linux Kernel Race Condition Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-18 CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-18 CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-16 CVE-2026-58704 Google Pixel Improper Authorization Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-16 CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-16 CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-14 CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-11 CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-11 CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-11 CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-11 CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-10 CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-10 CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-09 CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-09 CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA KEV 2026-09-09 CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability
KNOWN EXPLOITED · ZERO-DAY STATUS NOT ASSESSED ↗ CISA Advisories 2026-10-27 Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-300-02.json"><strong>V
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-27 EPICS Base <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-300-01.json"><strong>V
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-27 CISA Adds Two Known Exploited Vulnerabilities to Catalog <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog"&g
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-26 CISA Adds Two Known Exploited Vulnerabilities to Catalog <div class="OutlineElement Ltr SCXW42064574 BCX8"> <p class="text-align-justify">CISA has added two new vulnerabilitie
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-23 CISA Adds One Known Exploited Vulnerability to Catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-23 CISA Adds One Known Exploited Vulnerability to Catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-22 Siemens SIMATIC S7 Webserver API <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-10.json"><strong>V
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-22 Siemens APOGEE, TALON and Desigo PXC/PXM Products <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-08.json"><strong>V
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-22 Managing AI Token Consumption for Operational Resilience <p>CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance, <a href="https
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-22 Siemens RUGGEDCOM CROSSBOW <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-12.json"><strong>V
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-22 Siemens RUGGEDCOM APE1808 Devices <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-18.json"><strong>V
PRIMARY-SOURCE REPORT ↗ CISA Advisories 2026-10-22 Siemens Industrial Edge App Publisher <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-02.json"><strong>V
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-27 Introducing the Cloudflare PHP Capture the Flag challenge We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security res
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-26 Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-22 Localizing compliance at scale: achieving South Korea’s ISMS certification Cloudflare has achieved South Korea's ISMS certification following an audit across 80 controls. Learn how we localized user consen
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-21 Introducing full transaction detection for Cloudflare WAF Cloudflare's web application firewall can now correlate an HTTP request with its response. Full transaction detection helps every
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-21 Cloudflare deploys protections against php2shell vulnerability Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public d
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-20 8 eMudhra certificates are compromised. Here's what you need to know Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releas
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-19 Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have,
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-16 Continuous accountability for Verified bots Identity alone doesn't guarantee a bot will behave responsibly. We are introducing a system to continuously evaluate whether Verif
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-07 Building an evidence-grounded agentic security operations harness on Cloudflare Cloudflare Managed Defense uses a team of specialized AI agents built on Workers and global network telemetry to analyze security
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-02 Follow the thread: a new dashboard to investigate account abuse Fraudsters are increasingly using AI to bypass stateless security checks. Cloudflare's new Account Abuse Protection dashboard uses
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-02 Protected Quick Tunnels: simple accountless authentication for your next dev project Quick Tunnels now support email authentication. Add --allowed-mail to one cloudflared command, and only the addresses or domains y
PRIMARY-SOURCE REPORT ↗ Cloudflare Security 2026-10-01 One year later: Sovereign AI and the fight for choice AI sovereignty is not a zero-sum game, but many governments now believe it is. Cloudflare's answer: more local open-source models,
PRIMARY-SOURCE REPORT ↗