Vulnerabilities

Which flaws attackers are using right now, how likely the rest are to be used, and how bad each one would be. For a ranked to-do list, see Patch this first.

How bad would it be?

CVSS: a score out of 10 for the damage if the flaw is used. A high score doesn't mean anyone is using it.

How likely is it to be used?

EPSS, from FIRST: the estimated chance it's exploited in the next 30 days, updated daily.

Is it already being used?

KEV: CISA's list of flaws seen in real attacks. If one you run is on it, patch it first.

Newly exploited

Added to CISA's Known Exploited Vulnerabilities list in the last 30 days: 33 of the 1762 on it. The deadlines are for US government agencies, and a good benchmark for anyone.

CVE-2026-41709 · Broadcom VMware ESX

Broadcom VMWare ESX Insufficient Logging Vulnerability

Due in 12 days Chance of use: 0.8% 1 story on SentryFeed
CVE-2026-46300 · Linux Kernel

Linux Kernel Missing Initialization of a Variable Vulnerability

Due tomorrow Chance of use: 16%
CVE-2026-111497 · Google Brotli

Google Brotli Unchecked Return Value Vulnerability

Due in 11 days Chance of use: 83% 5 stories on SentryFeed
CVE-2026-48356 · Adobe Commerce and Magento

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Due in 11 days Chance of use: 45%
CVE-2026-109618 · PHP Group PHP

PHP Memory Corruption Vulnerability

Deadline passed 1 day ago Chance of use: over 99% 5 stories on SentryFeed
CVE-2026-109619 · PHP Group PHP

PHP Stale Internal Request-State Vulnerability

Deadline passed 1 day ago Chance of use: over 99% 4 stories on SentryFeed
CVE-2026-110447 · Collabora Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Deadline passed 4 days ago Chance of use: 73% 2 stories on SentryFeed
CVE-2026-114625 · Arista VeloCloud Orchestrator

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Deadline passed 4 days ago Chance of use: 1.0%
CVE-2026-106931 · EG Secure Solutions SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Deadline passed 7 days ago Chance of use: 2.5%
CVE-2026-110936 · Siemens Software Center

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Due in 4 days Chance of use: 1.0% 1 story on SentryFeed
CVE-2026-96652 · Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Due in 4 days Chance of use: 1.8% 1 story on SentryFeed
CVE-2026-96654 · Plex Media Server

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Deadline passed 7 days ago Chance of use: 1.9%
CVE-2026-96655 · Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Due in 4 days Chance of use: 1.6%
CVE-2026-96656 · Plex Media Server

Plex Media Server External Control of File Name or Path Vulnerability

Deadline passed 7 days ago Chance of use: 1.8%
CVE-2025-61624 · Fortinet Multiple Products

Fortinet Multiple Products Path Traversal Vulnerability

Deadline passed 11 days ago Chance of use: 1.3% 1 story on SentryFeed
CVE-2026-102764 · BeyondTrust Remote Support

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

Deadline passed 11 days ago Chance of use: 19% 1 story on SentryFeed
CVE-2026-21589 · Atlassian Multiple Products

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Deadline passed 12 days ago Chance of use: 99% 4 stories on SentryFeed
CVE-2026-0322 · Palo Alto Networks PAN-OS

Palo Alto Networks PAN-OS Code Injection Vulnerability

Deadline passed 13 days ago Chance of use: 1.7% 2 stories on SentryFeed
CVE-2026-105133 · Ahsay AhsayCBS

Ahsay AhsayCBS Improper Authentication Vulnerability

Deadline passed 13 days ago Chance of use: 79% 2 stories on SentryFeed
CVE-2026-105134 · Ahsay AhsayCBS

Ahsay AhsayCBS Command Injection Vulnerability

Deadline passed 13 days ago Chance of use: 82% 1 story on SentryFeed
CVE-2026-76519 · Cisco Secure Email Gateway

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Deadline passed 13 days ago Chance of use: 2.2%
CVE-2026-104935 · Ivanti Connect Secure

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Deadline passed 14 days ago Chance of use: 87% 2 stories on SentryFeed
CVE-2026-96951 · Microsoft Windows

Microsoft Windows Command Injection Vulnerability

Deadline passed 14 days ago Chance of use: 9.8%
CVE-2015-3306 · ProFTPD ProFTPD

ProFTPD Improper Access Control Vulnerability

Deadline passed 19 days ago Chance of use: 99% 1 story on SentryFeed
CVE-2015-5477 · ISC BIND

ISC BIND Data Processing Errors Vulnerability

Deadline passed 19 days ago Chance of use: over 99%
CVE-2016-3081 · Apache Struts

Apache Struts Command Injection Vulnerability

Deadline passed 19 days ago Chance of use: 97%
CVE-2021-3199 · ONLYOFFICE Docs

ONLYOFFICE Docs Server Path Traversal Vulnerability

Deadline passed 19 days ago Chance of use: 30%
CVE-2023-22894 · Strapi Strapi

Strapi Cleartext Storage of Sensitive Information Vulnerability

Deadline passed 19 days ago Chance of use: 4.1%
CVE-2026-88779 · Citrix NetScaler

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Deadline passed 23 days ago Chance of use: 11% 1 story on SentryFeed
CVE-2026-102489 · Zammad GmbH Zammad

Zammad GmbH Zammad Session Fixation Vulnerability

Deadline passed 25 days ago Chance of use: 22%
CVE-2026-102490 · Zammad GmbH Zammad

Zammad GmbH Zammad Improper Privilege Management Vulnerability

Deadline passed 25 days ago Chance of use: 11%
CVE-2026-104286 · Fortinet FortiMail

Fortinet FortiMail Path Traversal Vulnerability

Deadline passed 26 days ago Chance of use: 4.6% 1 story on SentryFeed
CVE-2026-76504 · Cisco Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Deadline passed 27 days ago Chance of use: 39% 1 story on SentryFeed

In this week's news, most likely to be used

CVEs named in the last 7 days of security stories, ranked by EPSS.

CVE	Chance of use in 30 days	Rated	On CISA's list	In the story
CVE-2026-109618	over 99%	9.2 of 10	Yes	CISA confirms PHP2Shell vulnerabilities now exploited in attacks
CVE-2026-109619	over 99%	9.2 of 10	Yes	PHP2Shell security flaws now sucessfully exploited in the wild
CVE-2026-35273	97%	9.8 of 10	Yes	ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
CVE-2026-20127	89%	10.0 of 10	Yes	Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-111497	83%	9.2 of 10	Yes	Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
CVE-2026-110447	73%	9.2 of 10	Yes	CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
CVE-2026-86950	26%	8.8 of 10	Yes	Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
CVE-2026-97229	18%	10.0 of 10	No	Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
CVE-2026-112900	1.3%	9.2 of 10	No	Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
CVE-2026-83519	1.1%	9.8 of 10	No	Windows Error Reporting: remote code execution flaw
CVE-2026-102870	0.9%	8.8 of 10	No	ASP.NET Core: remote code execution flaw
CVE-2026-70007	0.8%	8.8 of 10	No	.NET Framework: remote code execution flaw
CVE-2026-41709	0.8%	2.7 of 10	Yes	China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
CVE-2026-78905	0.6%	8.8 of 10	No	Chrome and Edge: type confusion in ANGLE
CVE-2026-78904	0.6%	9.6 of 10	No	Chrome and Edge: type confusion in ANGLE

Exploited flaws from CISA's KEV catalogue. Chance of exploitation from EPSS by FIRST. Descriptions and scores from the NVD. This product uses the NVD API but is not endorsed or certified by the NVD.