Live mirror of the federal catalog of vulnerabilities actively exploited in the wild. When a federal RFP names tech with an open KEV entry, the procurement is implicitly urgent: agencies are racing against active exploitation.
21% of total
across 704 products
| CVE | Vendor / Product | Vulnerability | Added | RW |
|---|---|---|---|---|
| CVE-2026-96656 | Plex Media Server | Plex Media Server External Control of File Name or Path Vulnerability | 2026-10-20 | - |
| CVE-2026-96655 | Plex Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-10-20 | - |
| CVE-2026-96654 | Plex Media Server | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 2026-10-20 | - |
| CVE-2026-96652 | Plex Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 2026-10-20 | - |
| CVE-2026-110936 | Siemens Software Center | Siemens Software Center Uncontrolled Search Path Element Vulnerability | 2026-10-20 | - |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | 2026-10-20 | - |
| CVE-2026-102764 | BeyondTrust Remote Support | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | 2026-10-16 | - |
| CVE-2025-61624 | Fortinet Multiple Products | Fortinet Multiple Products Path Traversal Vulnerability | 2026-10-16 | - |
| CVE-2026-21589 | Atlassian Multiple Products | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 2026-10-15 | - |
| CVE-2026-76519 | Cisco Secure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | 2026-10-14 | - |
| CVE-2026-105134 | Ahsay AhsayCBS | Ahsay AhsayCBS Command Injection Vulnerability | 2026-10-14 | - |
| CVE-2026-105133 | Ahsay AhsayCBS | Ahsay AhsayCBS Improper Authentication Vulnerability | 2026-10-14 | - |
| CVE-2026-0322 | Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability | 2026-10-14 | - |
| CVE-2026-96951 | Microsoft Windows | Microsoft Windows Command Injection Vulnerability | 2026-10-13 | - |
| CVE-2026-104935 | Ivanti Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | 2026-10-13 | - |
| CVE-2023-22894 | Strapi Strapi | Strapi Cleartext Storage of Sensitive Information Vulnerability | 2026-10-08 | - |
| CVE-2021-3199 | ONLYOFFICE Docs | ONLYOFFICE Docs Server Path Traversal Vulnerability | 2026-10-08 | - |
| CVE-2016-3081 | Apache Struts | Apache Struts Command Injection Vulnerability | 2026-10-08 | - |
| CVE-2015-5477 | ISC BIND | ISC BIND Data Processing Errors Vulnerability | 2026-10-08 | - |
| CVE-2015-3306 | ProFTPD ProFTPD | ProFTPD Improper Access Control Vulnerability | 2026-10-08 | - |
| CVE-2026-88779 | Citrix NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-10-04 | - |
| CVE-2026-102490 | Zammad GmbH Zammad | Zammad GmbH Zammad Improper Privilege Management Vulnerability | 2026-10-02 | - |
| CVE-2026-102489 | Zammad GmbH Zammad | Zammad GmbH Zammad Session Fixation Vulnerability | 2026-10-02 | - |
| CVE-2026-104286 | Fortinet FortiMail | Fortinet FortiMail Path Traversal Vulnerability | 2026-10-01 | - |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | 2026-09-30 | - |
| CVE-2026-86950 | Apple Multiple Products | Apple Multiple Products Out-of-Bounds Write Vulnerability | 2026-09-29 | - |
| CVE-2026-88772 | Citrix NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-09-27 | - |
| CVE-2026-88771 | Citrix NetScaler | Citrix NetScaler Improper Input Validation Vulnerability | 2026-09-27 | - |
| CVE-2026-87902 | WordPress Core | WordPress Core Remote File Inclusion Vulnerability | 2026-09-25 | - |
| CVE-2026-67279 | MikroTik RouterOS | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | 2026-09-25 | - |
| CVE-2026-65660 | Microsoft SharePoint | Microsoft SharePoint Code Injection Vulnerability | 2026-09-25 | - |
| CVE-2026-71362 | Adobe Commerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 2026-09-24 | - |
| CVE-2026-5430 | WSO2 Multiple Products | WSO2 Multiple Products Path Traversal Vulnerability | 2026-09-24 | - |
| CVE-2026-94127 | F5 BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | 2026-09-22 | - |
| CVE-2026-93952 | Arista VeloCloud Orchestrator | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | 2026-09-22 | - |
| CVE-2026-93616 | Check Point Multiple Products | Check Point Multiple Products Path Traversal Vulnerability | 2026-09-22 | - |
| CVE-2026-85102 | Check Point Multiple Products | Check Point Multiple Products Improper Certificate Validation Vulnerability | 2026-09-22 | - |
| CVE-2026-7273 | Zyxel GS1900 Series Switches | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 2026-09-21 | - |
| CVE-2026-53266 | Linux Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | 2026-09-18 | - |
| CVE-2025-39964 | Linux Kernel | Linux Kernel Race Condition Vulnerability | 2026-09-18 | - |
| CVE-2025-39682 | Linux Kernel | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | 2026-09-18 | - |
| CVE-2026-87886 | Acronis Backup | Acronis Backup Incorrect Default Permissions Vulnerability | 2026-09-16 | - |
| CVE-2026-76460 | Cisco Identity Services Engine | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-16 | - |
| CVE-2026-58704 | Google Pixel | Google Pixel Improper Authorization Vulnerability | 2026-09-16 | - |
| CVE-2026-76461 | Cisco Secure Email Gateway | Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-14 | - |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | 2026-09-11 | - |
| CVE-2026-84869 | ConnectWise ScreenConnect | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | 2026-09-11 | - |
| CVE-2026-42018 | JFrog Artifactory | JFrog Artifactory Improper Authentication Vulnerability | 2026-09-11 | - |
| CVE-2026-42016 | JFrog Artifactory | JFrog Artifactory Incorrect Authorization Vulnerability | 2026-09-11 | - |
| CVE-2026-86060 | MikroTik RouterOS | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | 2026-09-10 | - |
Source: CISA Known Exploited Vulnerabilities Catalog via cisagov/kev-data. Refreshed daily. Catalog version as of 2026-10-20.