10 new exploited flaws this week

The CISA KEV catalog lists vulnerabilities that are being exploited in real attacks, not ones that might be. It is the list to start from when deciding what to patch first.

This week

• CVE-2026-97229 Critical10.0

  GitLab · Community Edition and Enterprise Edition

  GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

  Added Oct 29, 2026Fix by Nov 1, 2026
• CVE-2026-76418

  Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software

  Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

  Added Oct 29, 2026Fix by Nov 1, 2026
• CVE-2026-46300 High7.8

  Linux · Kernel

  Linux Kernel Missing Initialization of a Variable Vulnerability

  86 days after exploitation was first evidenced

  Added Oct 28, 2026Fix by Oct 31, 2026
• CVE-2026-41709 Low2.7

  Broadcom · VMware ESX

  Broadcom VMWare ESX Insufficient Logging Vulnerability

  Added Oct 28, 2026Fix by Nov 11, 2026
• CVE-2026-48356 Critical9.3

  Adobe · Commerce and Magento

  Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

  Added Oct 27, 2026Fix by Nov 10, 2026
• CVE-2026-111497

  Google · Brotli

  Google Brotli Unchecked Return Value Vulnerability

  Added Oct 27, 2026Fix by Nov 10, 2026
• CVE-2026-109619 High8.1

  PHP Group · PHP

  PHP Stale Internal Request-State Vulnerability

  Added Oct 26, 2026Fix by Oct 29, 2026
• CVE-2026-109618 Critical9.8

  PHP Group · PHP

  PHP Memory Corruption Vulnerability

  Added Oct 26, 2026Fix by Oct 29, 2026
• CVE-2026-114625 Critical9.9

  Arista · VeloCloud Orchestrator

  Arista VeloCloud Orchestrator SQL Injection Vulnerability

  Added Oct 23, 2026Fix by Oct 26, 2026
• CVE-2026-110447

  Collabora · Collabora Online – Built-in CODE Server

  Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

  9 days after exploitation was first evidenced

  Added Oct 23, 2026Fix by Oct 26, 2026

Added earlier

• CVE-2026-96656 High7.2

  Plex · Media Server

  Plex Media Server External Control of File Name or Path Vulnerability

  Added Oct 20, 2026Fix by Oct 23, 2026
• CVE-2026-96655 Medium4.3

  Plex · Media Server

  Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

  Added Oct 20, 2026Fix by Nov 3, 2026
• CVE-2026-96654 Medium6.5

  Plex · Media Server

  Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

  Added Oct 20, 2026Fix by Oct 23, 2026
• CVE-2026-96652 Medium4.3

  Plex · Media Server

  Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

  Added Oct 20, 2026Fix by Nov 3, 2026
• CVE-2026-110936 Medium6.7

  Siemens · Software Center

  Siemens Software Center Uncontrolled Search Path Element Vulnerability

  Added Oct 20, 2026Fix by Nov 3, 2026
• CVE-2026-106931 High7.8

  EG Secure Solutions · SiteGuard Server Edition

  EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

  Added Oct 20, 2026Fix by Oct 23, 2026
• CVE-2026-102764

  BeyondTrust · Remote Support

  BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

  Added Oct 16, 2026Fix by Oct 19, 2026
• CVE-2025-61624 Medium6.0

  Fortinet · Multiple Products

  Fortinet Multiple Products Path Traversal Vulnerability

  Added Oct 16, 2026Fix by Oct 19, 2026
• CVE-2026-21589 High7.5

  Atlassian · Multiple Products

  Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

  8 days after exploitation was first evidenced

  Added Oct 15, 2026Fix by Oct 18, 2026
• CVE-2026-76519 Critical9.8

  Cisco · Secure Email Gateway

  Cisco Secure Email Gateway Relative Path Traversal Vulnerability

  Added Oct 14, 2026Fix by Oct 17, 2026
• CVE-2026-105134 Critical10.0

  Ahsay · AhsayCBS

  Ahsay AhsayCBS Command Injection Vulnerability

  Added Oct 14, 2026Fix by Oct 17, 2026
• CVE-2026-105133 High7.3

  Ahsay · AhsayCBS

  Ahsay AhsayCBS Improper Authentication Vulnerability

  Added Oct 14, 2026Fix by Oct 17, 2026
• CVE-2026-0322

  Palo Alto Networks · PAN-OS

  Palo Alto Networks PAN-OS Code Injection Vulnerability

  Added Oct 14, 2026Fix by Oct 17, 2026
• CVE-2026-96951 High8.8

  Microsoft · Windows

  Microsoft Windows Command Injection Vulnerability

  Added Oct 13, 2026Fix by Oct 16, 2026
• CVE-2026-104935 High8.6

  Ivanti · Connect Secure

  Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

  Added Oct 13, 2026Fix by Oct 16, 2026
• CVE-2023-22894 Medium4.9

  Strapi · Strapi

  Strapi Cleartext Storage of Sensitive Information Vulnerability

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2021-3199 Critical9.8

  ONLYOFFICE · Docs

  ONLYOFFICE Docs Server Path Traversal Vulnerability

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2016-3081 High8.1

  Apache · Struts

  Apache Struts Command Injection Vulnerability

  77 days after exploitation was first evidenced

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2015-5477 High7.5

  ISC · BIND

  ISC BIND Data Processing Errors Vulnerability

  4085 days after exploitation was first evidenced

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2015-3306 Critical10.0

  ProFTPD · ProFTPD

  ProFTPD Improper Access Control Vulnerability

  Added Oct 8, 2026Fix by Oct 11, 2026
• CVE-2026-88779 High7.5

  Citrix · NetScaler

  Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

  Added Oct 4, 2026Fix by Oct 7, 2026
• CVE-2026-102490 High7.8

  Zammad GmbH · Zammad

  Zammad GmbH Zammad Improper Privilege Management Vulnerability

  Added Oct 2, 2026Fix by Oct 5, 2026
• CVE-2026-102489 Critical9.8

  Zammad GmbH · Zammad

  Zammad GmbH Zammad Session Fixation Vulnerability

  Added Oct 2, 2026Fix by Oct 5, 2026
• CVE-2026-104286 Critical9.8

  Fortinet · FortiMail

  Fortinet FortiMail Path Traversal Vulnerability

  Added Oct 1, 2026Fix by Oct 4, 2026
• CVE-2026-76504 Critical9.8

  Cisco · Catalyst SD-WAN Manager

  Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

  Added Sep 30, 2026Fix by Oct 3, 2026
• CVE-2026-86950 High8.8

  Apple · Multiple Products

  Apple Multiple Products Out-of-Bounds Write Vulnerability

  Added Sep 29, 2026Fix by Oct 13, 2026
• CVE-2026-88772 High8.1

  Citrix · NetScaler

  Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

  Added Sep 27, 2026Fix by Sep 30, 2026
• CVE-2026-88771 Critical9.8

  Citrix · NetScaler

  Citrix NetScaler Improper Input Validation Vulnerability

  Added Sep 27, 2026Fix by Sep 30, 2026
• CVE-2026-87902 High8.1

  WordPress · Core

  WordPress Core Remote File Inclusion Vulnerability

  Added Sep 25, 2026Fix by Sep 28, 2026
• CVE-2026-67279 Medium6.5

  MikroTik · RouterOS

  Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

  20 days after exploitation was first evidenced

  Added Sep 25, 2026Fix by Sep 28, 2026
• CVE-2026-65660 High8.8

  Microsoft · SharePoint

  Microsoft SharePoint Code Injection Vulnerability

  Added Sep 25, 2026Fix by Sep 28, 2026
• CVE-2026-71362 Critical9.1

  Adobe · Commerce and Magento

  Adobe Commerce and Magento Incorrect Authorization Vulnerability

  21 days after exploitation was first evidenced

  Added Sep 24, 2026Fix by Sep 27, 2026
• CVE-2026-5430 Critical10.0

  WSO2 · Multiple Products

  WSO2 Multiple Products Path Traversal Vulnerability

  9 days after exploitation was first evidenced

  Added Sep 24, 2026Fix by Sep 27, 2026
• CVE-2026-94127 Critical9.8

  F5 · BIG-IP APM

  F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

  Added Sep 22, 2026Fix by Sep 25, 2026
• CVE-2026-93952 Critical10.0

  Arista · VeloCloud Orchestrator

  Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

  Added Sep 22, 2026Fix by Sep 25, 2026
• CVE-2026-93616 Critical9.8

  Check Point · Multiple Products

  Check Point Multiple Products Path Traversal Vulnerability

  Added Sep 22, 2026Fix by Sep 25, 2026
• CVE-2026-85102 Critical9.8

  Check Point · Multiple Products

  Check Point Multiple Products Improper Certificate Validation Vulnerability

  Added Sep 22, 2026Fix by Sep 25, 2026
• CVE-2026-7273 High8.8

  Zyxel · GS1900 Series Switches

  Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

  Added Sep 21, 2026Fix by Sep 24, 2026
• CVE-2026-53266 High8.8

  Linux · Kernel

  Linux Kernel Out-of-Bounds Write Vulnerability

  Added Sep 18, 2026Fix by Sep 21, 2026
• CVE-2025-39964 High7.8

  Linux · Kernel

  Linux Kernel Race Condition Vulnerability

  Added Sep 18, 2026Fix by Sep 21, 2026
• CVE-2025-39682 Critical9.8

  Linux · Kernel

  Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

  Added Sep 18, 2026Fix by Sep 21, 2026
• CVE-2026-87886 High7.8

  Acronis · Backup

  Acronis Backup Incorrect Default Permissions Vulnerability

  Added Sep 16, 2026Fix by Sep 19, 2026
• CVE-2026-76460 Critical10.0

  Cisco · Identity Services Engine

  Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

  Added Sep 16, 2026Fix by Sep 19, 2026
• CVE-2026-58704 High8.8

  Google · Pixel

  Google Pixel Improper Authorization Vulnerability

  Added Sep 16, 2026Fix by Sep 19, 2026
• CVE-2026-76461 Critical9.8

  Cisco · Secure Email Gateway

  Cisco Secure Email Gateway SQL Injection Vulnerability

  Added Sep 14, 2026Fix by Sep 17, 2026
• CVE-2026-85706 Critical10.0

  GitLab · Community Edition and Enterprise Edition

  GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

  Added Sep 11, 2026Fix by Sep 14, 2026
• CVE-2026-84869 Critical9.9

  ConnectWise · ScreenConnect

  ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

  Added Sep 11, 2026Fix by Sep 14, 2026
• CVE-2026-42018 High7.5

  JFrog · Artifactory

  JFrog Artifactory Improper Authentication Vulnerability

  Added Sep 11, 2026Fix by Sep 25, 2026
• CVE-2026-42016 High8.1

  JFrog · Artifactory

  JFrog Artifactory Incorrect Authorization Vulnerability

  Added Sep 11, 2026Fix by Sep 25, 2026
• CVE-2026-86060 Critical9.8

  MikroTik · RouterOS

  MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

  Added Sep 10, 2026Fix by Sep 13, 2026

What the KEV catalog is

Data from CISA’s Known Exploited Vulnerabilities catalog, a US Government work in the public domain. The deadlines shown are binding on US federal agencies (BOD 22-01); for everyone else they are a sound priority reference.

CVE database