CyphrQLatest Exploited Vulnerabilities
Every vulnerability CISA confirmed as exploited in the wild over the last six months, newest first.
173 vulnerabilities added to CISA's Known Exploited Vulnerabilities catalogue in the last six months: each one is confirmed as exploited in the wild. Listed by the date CISA added it, which can be later than disclosure; a vulnerability can be serious before it appears here. Catalogue version 2026.10.23, released 23 October 2026. Each CVE links to its NVD record.
October 2026 26 added
| Added | CVE | Vendor and product | Vulnerability | Ransomware use |
|---|---|---|---|---|
| 23 October 2026 | CVE-2026-114625 | Arista VeloCloud Orchestrator | Arista VeloCloud Orchestrator SQL Injection Vulnerability | – |
| 23 October 2026 | CVE-2026-110447 | Collabora Collabora Online – Built-in CODE Server | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | – |
| 20 October 2026 | CVE-2026-96656 | Plex Media Server | Plex Media Server External Control of File Name or Path Vulnerability | – |
| 20 October 2026 | CVE-2026-96655 | Plex Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | – |
| 20 October 2026 | CVE-2026-96654 | Plex Media Server | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | – |
| 20 October 2026 | CVE-2026-96652 | Plex Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | – |
| 20 October 2026 | CVE-2026-110936 | Siemens Software Center | Siemens Software Center Uncontrolled Search Path Element Vulnerability | – |
| 20 October 2026 | CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | – |
| 16 October 2026 | CVE-2026-102764 | BeyondTrust Remote Support | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | – |
| 16 October 2026 | CVE-2025-61624 | Fortinet Multiple Products | Fortinet Multiple Products Path Traversal Vulnerability | – |
| 15 October 2026 | CVE-2026-21589 | Atlassian Multiple Products | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | – |
| 14 October 2026 | CVE-2026-76519 | Cisco Secure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | – |
| 14 October 2026 | CVE-2026-105134 | Ahsay AhsayCBS | Ahsay AhsayCBS Command Injection Vulnerability | – |
| 14 October 2026 | CVE-2026-105133 | Ahsay AhsayCBS | Ahsay AhsayCBS Improper Authentication Vulnerability | – |
| 14 October 2026 | CVE-2026-0322 | Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability | – |
| 13 October 2026 | CVE-2026-96951 | Microsoft Windows | Microsoft Windows Command Injection Vulnerability | – |
| 13 October 2026 | CVE-2026-104935 | Ivanti Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | – |
| 8 October 2026 | CVE-2023-22894 | Strapi Strapi | Strapi Cleartext Storage of Sensitive Information Vulnerability | – |
| 8 October 2026 | CVE-2021-3199 | ONLYOFFICE Docs | ONLYOFFICE Docs Server Path Traversal Vulnerability | – |
| 8 October 2026 | CVE-2016-3081 | Apache Struts | Apache Struts Command Injection Vulnerability | – |
| 8 October 2026 | CVE-2015-5477 | ISC BIND | ISC BIND Data Processing Errors Vulnerability | – |
| 8 October 2026 | CVE-2015-3306 | ProFTPD ProFTPD | ProFTPD Improper Access Control Vulnerability | – |
| 4 October 2026 | CVE-2026-88779 | Citrix NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | – |
| 2 October 2026 | CVE-2026-102490 | Zammad GmbH Zammad | Zammad GmbH Zammad Improper Privilege Management Vulnerability | – |
| 2 October 2026 | CVE-2026-102489 | Zammad GmbH Zammad | Zammad GmbH Zammad Session Fixation Vulnerability | – |
| 1 October 2026 | CVE-2026-104286 | Fortinet FortiMail | Fortinet FortiMail Path Traversal Vulnerability | – |
September 2026 43 added
| Added | CVE | Vendor and product | Vulnerability | Ransomware use |
|---|---|---|---|---|
| 30 September 2026 | CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | – |
| 29 September 2026 | CVE-2026-86950 | Apple Multiple Products | Apple Multiple Products Out-of-Bounds Write Vulnerability | – |
| 27 September 2026 | CVE-2026-88772 | Citrix NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | – |
| 27 September 2026 | CVE-2026-88771 | Citrix NetScaler | Citrix NetScaler Improper Input Validation Vulnerability | – |
| 25 September 2026 | CVE-2026-87902 | WordPress Core | WordPress Core Remote File Inclusion Vulnerability | – |
| 25 September 2026 | CVE-2026-67279 | MikroTik RouterOS | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | – |
| 25 September 2026 | CVE-2026-65660 | Microsoft SharePoint | Microsoft SharePoint Code Injection Vulnerability | – |
| 24 September 2026 | CVE-2026-71362 | Adobe Commerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | – |
| 24 September 2026 | CVE-2026-5430 | WSO2 Multiple Products | WSO2 Multiple Products Path Traversal Vulnerability | – |
| 22 September 2026 | CVE-2026-94127 | F5 BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | – |
| 22 September 2026 | CVE-2026-93952 | Arista VeloCloud Orchestrator | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | – |
| 22 September 2026 | CVE-2026-93616 | Check Point Multiple Products | Check Point Multiple Products Path Traversal Vulnerability | – |
| 22 September 2026 | CVE-2026-85102 | Check Point Multiple Products | Check Point Multiple Products Improper Certificate Validation Vulnerability | – |
| 21 September 2026 | CVE-2026-7273 | Zyxel GS1900 Series Switches | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | – |
| 18 September 2026 | CVE-2026-53266 | Linux Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | – |
| 18 September 2026 | CVE-2025-39964 | Linux Kernel | Linux Kernel Race Condition Vulnerability | – |
| 18 September 2026 | CVE-2025-39682 | Linux Kernel | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | – |
| 16 September 2026 | CVE-2026-87886 | Acronis Backup | Acronis Backup Incorrect Default Permissions Vulnerability | – |
| 16 September 2026 | CVE-2026-76460 | Cisco Identity Services Engine | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | – |
| 16 September 2026 | CVE-2026-58704 | Google Pixel | Google Pixel Improper Authorization Vulnerability | – |
| 14 September 2026 | CVE-2026-76461 | Cisco Secure Email Gateway | Cisco Secure Email Gateway SQL Injection Vulnerability | – |
| 11 September 2026 | CVE-2026-85706 | GitLab Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | – |
| 11 September 2026 | CVE-2026-84869 | ConnectWise ScreenConnect | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | – |
| 11 September 2026 | CVE-2026-42018 | JFrog Artifactory | JFrog Artifactory Improper Authentication Vulnerability | – |
| 11 September 2026 | CVE-2026-42016 | JFrog Artifactory | JFrog Artifactory Incorrect Authorization Vulnerability | – |
| 10 September 2026 | CVE-2026-86060 | MikroTik RouterOS | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | – |
| 10 September 2026 | CVE-2026-67277 | MikroTik RouterOS | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | – |
| 9 September 2026 | CVE-2026-87491 | Google Chromium V8 | Google Chromium V8 Out of Bounds Write Vulnerability | – |
| 9 September 2026 | CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | – |
| 9 September 2026 | CVE-2026-19490 | Citrix NetScaler | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | – |
| 9 September 2026 | CVE-2025-25249 | Fortinet Multiple Products | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | – |
| 8 September 2026 | CVE-2026-86218 | N-able N-central | N-able N-central Static Code Injection Vulnerability | – |
| 8 September 2026 | CVE-2026-85880 | Microsoft Windows | Microsoft Windows Heap-Based Buffer Overflow Vulnerability | – |
| 8 September 2026 | CVE-2026-81963 | Microsoft Windows | Microsoft Windows Link Following Vulnerability | – |
| 8 September 2026 | CVE-2026-75650 | Adobe Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | – |
| 4 September 2026 | CVE-2026-85046 | Google Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | – |
| 2 September 2026 | CVE-2026-9586 | Sangoma Switchvox | Sangoma Switchvox SQL Injection Vulnerability | – |
| 2 September 2026 | CVE-2026-83549 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances OS Command Injection Vulnerability | – |
| 2 September 2026 | CVE-2026-83548 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | – |
| 2 September 2026 | CVE-2026-82329 | JFrog Artifactory | JFrog Artifactory Improper Authentication Vulnerability | – |
| 2 September 2026 | CVE-2026-59822 | BerriAI LiteLLM | BerriAI LiteLLM Improper Authentication Vulnerability | – |
| 2 September 2026 | CVE-2026-49869 | Kestra Kestra OSS | Kestra OSS OS Command Injection Vulnerability | – |
| 2 September 2026 | CVE-2026-48710 | Kludex Starlette | Kludex Starlette HTTP Request/Response Smuggling Vulnerability | – |
August 2026 31 added
| Added | CVE | Vendor and product | Vulnerability | Ransomware use |
|---|---|---|---|---|
| 31 August 2026 | CVE-2026-82078 | PaperCut NG/MF | PaperCut NG/MF Unsafe Reflection Vulnerability | – |
| 31 August 2026 | CVE-2026-81578 | PaperCut NG/MF | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability | – |
| 27 August 2026 | CVE-2026-66384 | JFrog Artifactory | JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability | – |
| 27 August 2026 | CVE-2026-53362 | Linux Kernel | Linux Kernel Unspecified Vulnerability | – |
| 27 August 2026 | CVE-2023-49105 | ownCloud ownCloud | ownCloud Improper Authentication Vulnerability | – |
| 26 August 2026 | CVE-2026-8452 | Citrix NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | – |
| 26 August 2026 | CVE-2022-0995 | Linux Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | – |
| 26 August 2026 | CVE-2021-23758 | Ajax.NET Professional Ajax.NET Professional | Ajax.NET Professional Deserialization of Untrusted Data Vulnerability | – |
| 26 August 2026 | CVE-2019-1068 | Microsoft SQL Server | Microsoft SQL Server Remote Code Execution Vulnerability | – |
| 26 August 2026 | CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool | Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability | – |
| 26 August 2026 | CVE-2015-3246 | Red Hat Libuser | Red Hat Libuser Race Condition Vulnerability | – |
| 25 August 2026 | CVE-2026-60004 | Gitea Gitea | Gitea Code Injection Vulnerability | – |
| 24 August 2026 | CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | – |
| 21 August 2026 | CVE-2026-73570 | Synacor Zimbra Collaboration Suite (ZCS) | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | – |
| 20 August 2026 | CVE-2026-72530 | TrueConf Server | TrueConf Server Code Injection Vulnerability | – |
| 20 August 2026 | CVE-2026-72529 | TrueConf Server | TrueConf Server Missing Authentication for Critical Function Vulnerability | – |
| 19 August 2026 | CVE-2026-64849 | MLflow MLflow | MLflow Server-Side Request Forgery Vulnerability | – |
| 18 August 2026 | CVE-2026-65400 | Apple macOS | Apple macOS Improper Authentication Vulnerability | – |
| 18 August 2026 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability | Known |
| 18 August 2026 | CVE-2026-55040 | Microsoft SharePoint | Microsoft SharePoint Weak Authentication Vulnerability | – |
| 18 August 2026 | CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions | Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | – |
| 17 August 2026 | CVE-2025-62593 | Ray-Project Ray | Ray-Project Ray Code Injection Vulnerability | – |
| 11 August 2026 | CVE-2026-72898 | Metabase Metabase | Metabase SQL Injection Vulnerability | – |
| 11 August 2026 | CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | – |
| 11 August 2026 | CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | – |
| 7 August 2026 | CVE-2026-8037 | Progress LoadMaster | Progress LoadMaster Command Injection Vulnerability | – |
| 5 August 2026 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability | Known |
| 4 August 2026 | CVE-2026-9198 | IBM Langflow | IBM Langflow Code Injection Vulnerability | – |
| 4 August 2026 | CVE-2026-34486 | Apache Tomcat | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | – |
| 4 August 2026 | CVE-2026-18556 | N-able N-central | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | – |
| 3 August 2026 | CVE-2026-18577 | N-able N-central | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | – |
July 2026 26 added
| Added | CVE | Vendor and product | Vulnerability | Ransomware use |
|---|---|---|---|---|
| 29 July 2026 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | Known |
| 27 July 2026 | CVE-2026-16812 | Arista VeloCloud Orchestrator | Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability | – |
| 27 July 2026 | CVE-2025-68686 | Fortinet FortiOS | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | – |
| 22 July 2026 | CVE-2026-50522 | Microsoft SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | – |
| 22 July 2026 | CVE-2026-16232 | Check Point SmartConsole | Check Point SmartConsole Improper Authentication Vulnerability | – |
| 21 July 2026 | CVE-2026-63030 | WordPress Core | WordPress Core Interpretation Conflict Vulnerability | – |
| 21 July 2026 | CVE-2026-60137 | WordPress Core | WordPress Core SQL Injection Vulnerability | – |
| 21 July 2026 | CVE-2026-0770 | Langflow Langflow | Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability | – |
| 21 July 2026 | CVE-2021-27137 | DD-WRT DD-WRT | DD-WRT Stack-Based Buffer Overflow Vulnerability | – |
| 16 July 2026 | CVE-2026-58644 | Microsoft SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | – |
| 16 July 2026 | CVE-2026-39808 | Fortinet FortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability | – |
| 16 July 2026 | CVE-2026-25089 | Fortinet FortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability | – |
| 15 July 2026 | CVE-2026-46817 | Oracle E-Business Suite | Oracle E-Business Suite Improper Privilege Management Vulnerability | – |
| 15 July 2026 | CVE-2023-4346 | KNX Association KNX Protocol Connection Authorization Option 1 | KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability | – |
| 14 July 2026 | CVE-2026-56164 | Microsoft SharePoint Server | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | – |
| 14 July 2026 | CVE-2026-56155 | Microsoft Active Directory Federation Services | Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | – |
| 14 July 2026 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability | Known |
| 14 July 2026 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | Known |
| 13 July 2026 | CVE-2008-4128 | Cisco IOS | Cisco IOS Cross-Site Request Forgery Vulnerability | – |
| 10 July 2026 | CVE-2026-56291 | Balbooa Forms | Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | – |
| 10 July 2026 | CVE-2026-48939 | iCagenda iCagenda | iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability | – |
| 7 July 2026 | CVE-2026-56290 | Joomlack Page Builder | Joomlack Page Builder Improper Access Control Vulnerability | – |
| 7 July 2026 | CVE-2026-55255 | Langflow Langflow | Langflow Authorization Bypass Through User-Controlled Key Vulnerability | – |
| 7 July 2026 | CVE-2026-48908 | JoomShaper SP Page Builder | JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability | – |
| 7 July 2026 | CVE-2026-48282 | Adobe ColdFusion | Adobe ColdFusion Path Traversal Vulnerability | – |
| 1 July 2026 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability | Known |
June 2026 23 added
| Added | CVE | Vendor and product | Vulnerability | Ransomware use |
|---|---|---|---|---|
| 29 June 2026 | CVE-2026-48558 | SimpleHelp SimpleHelp | SimpleHelp Authentication Bypass Vulnerability | – |
| 25 June 2026 | CVE-2026-20230 | Cisco Unified Communications Manager | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | – |
| 25 June 2026 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability | Known |
| 23 June 2026 | CVE-2026-34910 | Ubiquiti UniFi OS | Ubiquiti UniFi OS Improper Input Validation Vulnerability | – |
| 23 June 2026 | CVE-2026-34909 | Ubiquiti UniFi OS | Ubiquiti UniFi OS Path Traversal Vulnerability | – |
| 23 June 2026 | CVE-2026-34908 | Ubiquiti UniFi OS | Ubiquiti UniFi OS Improper Access Control Vulnerability | – |
| 23 June 2026 | CVE-2025-67038 | Lantronix EDS5000 | Lantronix EDS5000 Code Injection Vulnerability | – |
| 18 June 2026 | CVE-2026-20253 | Splunk Enterprise | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | – |
| 16 June 2026 | CVE-2026-48907 | Widget Factory Joomla Content Editor | Widget Factory Joomla Content Editor Improper Access Control Vulnerability | – |
| 15 June 2026 | CVE-2026-54420 | LiteSpeed cPanel Plugin | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | – |
| 15 June 2026 | CVE-2026-20262 | Cisco Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | – |
| 12 June 2026 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | Known |
| 11 June 2026 | CVE-2026-10520 | Ivanti Sentry | Ivanti Sentry OS Command Injection Vulnerability | – |
| 9 June 2026 | CVE-2026-7473 | Arista Extensible Operating System | Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability | – |
| 9 June 2026 | CVE-2026-20245 | Cisco Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | – |
| 9 June 2026 | CVE-2026-11645 | Google Chromium V8 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | – |
| 8 June 2026 | CVE-2026-50751 | Check Point Security Gateway | Check Point Security Gateway Improper Authentication Vulnerability | Known |
| 8 June 2026 | CVE-2026-42271 | BerriAI LiteLLM | BerriAI LiteLLM Command Injection Vulnerability | – |
| 5 June 2026 | CVE-2026-28318 | SolarWinds Serv-U | SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | – |
| 3 June 2026 | CVE-2026-45247 | Mirasvit Mirasvit Full Page Cache Warmer | Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability | – |
| 2 June 2026 | CVE-2025-48595 | Android Framework | Android Framework Integer Overflow Vulnerability | – |
| 2 June 2026 | CVE-2022-0492 | Linux Kernel | Linux Kernel Improper Authentication Vulnerability | – |
| 1 June 2026 | CVE-2024-21182 | Oracle WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | – |
May 2026 21 added
| Added | CVE | Vendor and product | Vulnerability | Ransomware use |
|---|---|---|---|---|
| 29 May 2026 | CVE-2026-0257 | Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | Known |
| 27 May 2026 | CVE-2026-8398 | Daemon Daemon Tools Lite | Daemon Tools Lite Embedded Malicious Code Vulnerability | – |
| 27 May 2026 | CVE-2026-48027 | Nx Nx Console | Nx Console Embedded Malicious Code Vulnerability | Known |
| 27 May 2026 | CVE-2026-45321 | TanStack TanStack | TanStack Unspecified Vulnerability | Known |
| 26 May 2026 | CVE-2026-48172 | LiteSpeed cPanel Plugin | LiteSpeed cPanel Plugin Privilege Escalation Vulnerability | – |
| 22 May 2026 | CVE-2026-9082 | Drupal Core | Drupal Core SQL Injection Vulnerability | – |
| 21 May 2026 | CVE-2026-34926 | Trend Micro Apex One | Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability | – |
| 21 May 2026 | CVE-2025-34291 | Langflow Langflow | Langflow Origin Validation Error Vulnerability | – |
| 20 May 2026 | CVE-2026-45498 | Microsoft Defender | Microsoft Defender Denial of Service Vulnerability | – |
| 20 May 2026 | CVE-2026-41091 | Microsoft Defender | Microsoft Defender Link Following Vulnerability | – |
| 20 May 2026 | CVE-2010-0806 | Microsoft Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | – |
| 20 May 2026 | CVE-2010-0249 | Microsoft Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | – |
| 20 May 2026 | CVE-2009-3459 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | – |
| 20 May 2026 | CVE-2009-1537 | Microsoft DirectX | Microsoft DirectX NULL Byte Overwrite Vulnerability | – |
| 20 May 2026 | CVE-2008-4250 | Microsoft Windows | Microsoft Windows Buffer Overflow Vulnerability | – |
| 15 May 2026 | CVE-2026-42897 | Microsoft Microsoft | Microsoft Exchange Server Cross-Site Scripting Vulnerability | – |
| 14 May 2026 | CVE-2026-20182 | Cisco Catalyst SD-WAN | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | – |
| 8 May 2026 | CVE-2026-42208 | BerriAI LiteLLM | BerriAI LiteLLM SQL Injection Vulnerability | – |
| 7 May 2026 | CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | – |
| 6 May 2026 | CVE-2026-0300 | Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability | – |
| 1 May 2026 | CVE-2026-31431 | Linux Kernel | Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability | – |
April 2026 3 added
| Added | CVE | Vendor and product | Vulnerability | Ransomware use |
|---|---|---|---|---|
| 30 April 2026 | CVE-2026-41940 | WebPros cPanel & WHM and WP2 (WordPress Squared) | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability | Known |
| 28 April 2026 | CVE-2026-32202 | Microsoft Windows | Microsoft Windows Protection Mechanism Failure Vulnerability | – |
| 28 April 2026 | CVE-2024-1708 | ConnectWise ScreenConnect | ConnectWise ScreenConnect Path Traversal Vulnerability | Known |