6 new exploited flaws this week

The CISA KEV catalog lists vulnerabilities that are being exploited in real attacks, not ones that might be. It is the list to start from when deciding what to patch first.

This week

• CVE-2023-22894 Medium4.9

  Strapi · Strapi

  Strapi Cleartext Storage of Sensitive Information Vulnerability

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2021-3199 Critical9.8

  ONLYOFFICE · Docs

  ONLYOFFICE Docs Server Path Traversal Vulnerability

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2016-3081 High8.1

  Apache · Struts

  Apache Struts Command Injection Vulnerability

  77 days after exploitation was first evidenced

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2015-5477 High7.5

  ISC · BIND

  ISC BIND Data Processing Errors Vulnerability

  4085 days after exploitation was first evidenced

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2015-3306 Critical10.0

  ProFTPD · ProFTPD

  ProFTPD Improper Access Control Vulnerability

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2026-88779 High7.5

  Citrix · NetScaler

  Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

  Added Oct 4, 2026Fix by Oct 7, 2026

Added earlier

• CVE-2026-102490 High7.8

  Zammad GmbH · Zammad

  Zammad GmbH Zammad Improper Privilege Management Vulnerability

  Added Oct 2, 2026Fix by Oct 5, 2026
• CVE-2026-102489 Critical9.8

  Zammad GmbH · Zammad

  Zammad GmbH Zammad Session Fixation Vulnerability

  Added Oct 2, 2026Fix by Oct 5, 2026
• CVE-2026-104286 Critical9.8

  Fortinet · FortiMail

  Fortinet FortiMail Path Traversal Vulnerability

  Added Oct 1, 2026Fix by Oct 4, 2026
• CVE-2026-76504 Critical9.8

  Cisco · Catalyst SD-WAN Manager

  Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

  Added Sep 30, 2026Fix by Oct 3, 2026
• CVE-2026-86950 High8.8

  Apple · Multiple Products

  Apple Multiple Products Out-of-Bounds Write Vulnerability

  Added Sep 29, 2026Fix by Oct 13, 2026
• CVE-2026-88772 High8.1

  Citrix · NetScaler

  Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

  Added Sep 27, 2026Fix by Sep 30, 2026
• CVE-2026-88771 Critical9.8

  Citrix · NetScaler

  Citrix NetScaler Improper Input Validation Vulnerability

  Added Sep 27, 2026Fix by Sep 30, 2026
• CVE-2026-87902 High8.1

  WordPress · Core

  WordPress Core Remote File Inclusion Vulnerability

  Added Sep 25, 2026Fix by Sep 28, 2026
• CVE-2026-67279 Medium6.5

  MikroTik · RouterOS

  Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

  20 days after exploitation was first evidenced

  Added Sep 25, 2026Fix by Sep 28, 2026
• CVE-2026-65660 High8.8

  Microsoft · SharePoint

  Microsoft SharePoint Code Injection Vulnerability

  Added Sep 25, 2026Fix by Sep 28, 2026
• CVE-2026-71362 Critical9.1

  Adobe · Commerce and Magento

  Adobe Commerce and Magento Incorrect Authorization Vulnerability

  21 days after exploitation was first evidenced

  Added Sep 24, 2026Fix by Sep 27, 2026
• CVE-2026-5430 Critical10.0

  WSO2 · Multiple Products

  WSO2 Multiple Products Path Traversal Vulnerability

  9 days after exploitation was first evidenced

  Added Sep 24, 2026Fix by Sep 27, 2026
• CVE-2026-94127 Critical9.8

  F5 · BIG-IP APM

  F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

  Added Sep 22, 2026Fix by Sep 25, 2026
• CVE-2026-93952 Critical10.0

  Arista · VeloCloud Orchestrator

  Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

  Added Sep 22, 2026Fix by Sep 25, 2026
• CVE-2026-93616 Critical9.8

  Check Point · Multiple Products

  Check Point Multiple Products Path Traversal Vulnerability

  Added Sep 22, 2026Fix by Sep 25, 2026
• CVE-2026-85102 Critical9.8

  Check Point · Multiple Products

  Check Point Multiple Products Improper Certificate Validation Vulnerability

  Added Sep 22, 2026Fix by Sep 25, 2026
• CVE-2026-7273 High8.8

  Zyxel · GS1900 Series Switches

  Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

  Added Sep 21, 2026Fix by Sep 24, 2026
• CVE-2026-53266 High8.8

  Linux · Kernel

  Linux Kernel Out-of-Bounds Write Vulnerability

  Added Sep 18, 2026Fix by Sep 21, 2026
• CVE-2025-39964 High7.8

  Linux · Kernel

  Linux Kernel Race Condition Vulnerability

  Added Sep 18, 2026Fix by Sep 21, 2026
• CVE-2025-39682 Critical9.8

  Linux · Kernel

  Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

  Added Sep 18, 2026Fix by Sep 21, 2026
• CVE-2026-87886 High7.8

  Acronis · Backup

  Acronis Backup Incorrect Default Permissions Vulnerability

  Added Sep 16, 2026Fix by Sep 19, 2026
• CVE-2026-76460 Critical10.0

  Cisco · Identity Services Engine

  Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

  Added Sep 16, 2026Fix by Sep 19, 2026
• CVE-2026-58704 High8.8

  Google · Pixel

  Google Pixel Improper Authorization Vulnerability

  Added Sep 16, 2026Fix by Sep 19, 2026
• CVE-2026-76461 Critical9.8

  Cisco · Secure Email Gateway

  Cisco Secure Email Gateway SQL Injection Vulnerability

  Added Sep 14, 2026Fix by Sep 17, 2026
• CVE-2026-85706 Critical10.0

  GitLab · Community Edition and Enterprise Edition

  GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

  Added Sep 11, 2026Fix by Sep 14, 2026
• CVE-2026-84869 Critical9.9

  ConnectWise · ScreenConnect

  ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

  Added Sep 11, 2026Fix by Sep 14, 2026
• CVE-2026-42018 High7.5

  JFrog · Artifactory

  JFrog Artifactory Improper Authentication Vulnerability

  Added Sep 11, 2026Fix by Sep 25, 2026
• CVE-2026-42016 High8.1

  JFrog · Artifactory

  JFrog Artifactory Incorrect Authorization Vulnerability

  Added Sep 11, 2026Fix by Sep 25, 2026
• CVE-2026-86060 Critical9.8

  MikroTik · RouterOS

  MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

  Added Sep 10, 2026Fix by Sep 13, 2026
• CVE-2026-67277 High8.2

  MikroTik · RouterOS

  MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

  Added Sep 10, 2026Fix by Sep 13, 2026
• CVE-2026-87491 High8.8

  Google · Chromium V8

  Google Chromium V8 Out of Bounds Write Vulnerability

  Added Sep 9, 2026Fix by Sep 23, 2026
• CVE-2026-20079 Critical10.0

  Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management

  Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

  Added Sep 9, 2026Fix by Sep 12, 2026
• CVE-2026-19490 Critical9.8

  Citrix · NetScaler

  Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

  Added Sep 9, 2026Fix by Sep 12, 2026
• CVE-2025-25249 High8.1

  Fortinet · Multiple Products

  Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

  Added Sep 9, 2026Fix by Sep 12, 2026
• CVE-2026-86218 Critical9.8

  N-able · N-central

  N-able N-central Static Code Injection Vulnerability

  Added Sep 8, 2026Fix by Sep 11, 2026
• CVE-2026-85880 High7.8

  Microsoft · Windows

  Microsoft Windows Heap-Based Buffer Overflow Vulnerability

  Added Sep 8, 2026Fix by Sep 22, 2026
• CVE-2026-81963 High7.8

  Microsoft · Windows

  Microsoft Windows Link Following Vulnerability

  Added Sep 8, 2026Fix by Sep 22, 2026
• CVE-2026-75650 Critical10.0

  Adobe · Commerce and Magento

  Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

  Added Sep 8, 2026Fix by Sep 11, 2026
• CVE-2026-85046 High8.8

  Google · Chromium V8

  Google Chromium V8 Type Confusion Vulnerability

  Added Sep 4, 2026Fix by Sep 18, 2026
• CVE-2026-9586 Critical9.8

  Sangoma · Switchvox

  Sangoma Switchvox SQL Injection Vulnerability

  Added Sep 2, 2026Fix by Sep 5, 2026
• CVE-2026-83549 High7.8

  SonicWall · SMA1000 Appliances

  SonicWall SMA1000 Appliances OS Command Injection Vulnerability

  Added Sep 2, 2026Fix by Sep 5, 2026
• CVE-2026-83548 Critical10.0

  SonicWall · SMA1000 Appliances

  SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

  Added Sep 2, 2026Fix by Sep 5, 2026
• CVE-2026-82329 Critical9.8

  JFrog · Artifactory

  JFrog Artifactory Improper Authentication Vulnerability

  Added Sep 2, 2026Fix by Sep 5, 2026
• CVE-2026-59822 High8.2

  BerriAI · LiteLLM

  BerriAI LiteLLM Improper Authentication Vulnerability

  56 days after exploitation was first evidenced

  Added Sep 2, 2026Fix by Sep 16, 2026
• CVE-2026-49869 Critical10.0

  Kestra · Kestra OSS

  Kestra OSS OS Command Injection Vulnerability

  7 days after exploitation was first evidenced

  Added Sep 2, 2026Fix by Sep 5, 2026
• CVE-2026-48710 Medium6.5

  Kludex · Starlette

  Kludex Starlette HTTP Request/Response Smuggling Vulnerability

  99 days after exploitation was first evidenced

  Added Sep 2, 2026Fix by Sep 16, 2026
• CVE-2026-82078 Critical9.1

  PaperCut · NG/MF

  PaperCut NG/MF Unsafe Reflection Vulnerability

  Added Aug 31, 2026Fix by Sep 14, 2026
• CVE-2026-81578 Critical9.8

  PaperCut · NG/MF

  PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

  Added Aug 31, 2026Fix by Sep 14, 2026
• CVE-2026-66384 Medium5.3

  JFrog · Artifactory

  JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

  Added Aug 27, 2026Fix by Sep 10, 2026
• CVE-2026-53362 High7.8

  Linux · Kernel

  Linux Kernel Unspecified Vulnerability

  Added Aug 27, 2026Fix by Aug 30, 2026
• CVE-2023-49105 Critical9.8

  ownCloud · ownCloud

  ownCloud Improper Authentication Vulnerability

  Added Aug 27, 2026Fix by Aug 30, 2026
• CVE-2026-8452 Critical9.8

  Citrix · NetScaler ADC and NetScaler Gateway

  Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

  9 days after exploitation was first evidenced

  Added Aug 26, 2026Fix by Aug 29, 2026
• CVE-2022-0995 High7.8

  Linux · Kernel

  Linux Kernel Out-of-Bounds Write Vulnerability

  Added Aug 26, 2026Fix by Aug 29, 2026
• CVE-2021-23758 High8.1

  Ajax.NET Professional · Ajax.NET Professional

  Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

  Added Aug 26, 2026Fix by Sep 9, 2026

What the KEV catalog is

Data from CISA’s Known Exploited Vulnerabilities catalog, a US Government work in the public domain. The deadlines shown are binding on US federal agencies (BOD 22-01); for everyone else they are a sound priority reference.

CVE database