Advertisement
CVE-2026-104935: Ivanti Connect Secure RCE via Auth Bypass
CISA confirms active exploitation of CVE-2026-104935 in Ivanti Connect Secure, an auth bypass leading to remote code execution.
CVE-2021-3199: ONLYOFFICE Docs RCE via Path Traversal
Actively exploited path traversal vulnerability [CVE-2021-3199] in ONLYOFFICE Docs Server enables remote code execution when JWT is used. Immediate patching is critical.
CVE-2023-22894: Strapi Cleartext Storage Exploited
CISA confirms active exploitation of CVE-2023-22894, a Strapi cleartext storage vulnerability exposing sensitive user data, potentially chained for RCE.
CVE-2016-3081: Apache Struts RCE via Command Injection — Patch Now
CISA confirms active exploitation of CVE-2016-3081, an Apache Struts command injection flaw leading to remote code execution.
CVE-2015-5477: Remote DoS in ISC BIND via TKEY Queries
CISA confirms active exploitation of CVE-2015-5477, a remote Denial of Service vulnerability in ISC BIND affecting critical DNS infrastructure.
CVE-2026-88779: NetScaler DoS Exploit – Patch Now
CISA confirms active exploitation of CVE-2026-88779 in Citrix NetScaler ADC and Gateway, leading to Denial of Service. Immediate action required.
Advertisement
CVE-2026-102489: Zammad Session Fixation Leads to RCE – Patch Now
CISA confirms active exploitation of CVE-2026-102489 in Zammad, a session fixation vulnerability enabling remote code execution.
CVE-2026-102490: Zammad Privilege Escalation Exploit in Wild
CVE-2026-102490 allows local Zammad users to escalate privileges to root. CISA confirms active exploitation; patch immediately.
Fortinet FortiMail Path Traversal (CVE-2026-104286) Under Active Attack
CISA confirms active exploitation of CVE-2026-104286, an unauthenticated path traversal vulnerability in Fortinet FortiMail, allowing arbitrary file writes.
CVE-2026-67279: Unauthenticated Mikrotik RouterOS Exec Request Vulnerability
CISA added CVE-2026-67279, an improper workflow vulnerability in Mikrotik RouterOS, to its KEV catalog, indicating active exploitation.
CVE-2026-85880: Windows ALPC Heap Overflow Exploited
CISA confirms active exploitation of CVE-2026-85880, a heap-based buffer overflow in Microsoft Windows ALPC leading to local privilege escalation.
N-able N-central RCE via CVE-2026-86218 Under Active Exploitation
CISA confirms active exploitation of CVE-2026-86218, a pre-authentication remote code execution flaw in N-able N-central, urging immediate mitigation.
CVE-2026-81963: Windows Update Stack Privilege Escalation
CISA adds CVE-2026-81963 to the KEV catalog after confirming active exploitation of a Windows Update Stack privilege escalation flaw.
CVE-2026-75650: Adobe Commerce RCE via Template Engine Flaw
CISA warns of active exploitation of CVE-2026-75650, a critical RCE vulnerability in Adobe Commerce and Magento Open Source platforms.
CVE-2026-83548: SonicWall SMA1000 SSRF Under Active Exploitation
A critical server-side request forgery (SSRF) vulnerability, CVE-2026-83548, in SonicWall SMA1000 Appliances is under active exploitation.
CVE-2026-9586: Sangoma Switchvox RCE via SQL Injection
Sangoma Switchvox is affected by CVE-2026-9586, an unauthenticated remote SQL injection vulnerability enabling RCE, with active exploitation confirmed.
CVE-2026-49869: Kestra OSS OS Command Injection Exploited
CISA has added CVE-2026-49869, an OS command injection in Kestra OSS, to its KEV catalog, confirming active exploitation by unauthenticated attackers.
CVE-2026-59822: BerriAI LiteLLM Authentication Bypass
BerriAI LiteLLM is vulnerable to an improper authentication flaw (CVE-2026-59822) actively exploited to bypass authentication.
CVE-2021-23758: Ajax.NET RCE via Deserialization of Untrusted Data
CVE-2021-23758 in Ajax.NET Professional allows remote code execution via untrusted data deserialization, with CISA confirming active exploitation.
CVE-2026-66384: JFrog Artifactory Path Traversal Exploit
CISA warns of active exploitation of CVE-2026-66384 in JFrog Artifactory, allowing authenticated users to write data outside intended paths. Patch immediately.
CVE-2026-53362: Linux Kernel IPv6 Privilege Escalation
CISA adds CVE-2026-53362 to KEV, confirming active exploitation of a Linux Kernel privilege escalation vulnerability via IPv6. Patch now.
CVE-2026-60004: Gitea Code Injection Under Active Exploitation
CISA confirms active exploitation of CVE-2026-60004, a Gitea code injection vulnerability allowing shell command execution with repository write access.
CVE-2026-72529: Critical RCE in TrueConf Server via Missing Auth
CISA warns of active exploitation of CVE-2026-72529 in TrueConf Server, allowing remote attackers to execute arbitrary scripts via port 4307/TCP.
CVE-2026-72530: TrueConf Server Remote Code Execution
CISA confirms active exploitation of CVE-2026-72530, a TrueConf Server code injection flaw leading to remote code execution. Immediate patching is critical.