KEV changelog

New KEV entries

Everything CISA added to the Known Exploited Vulnerabilities catalog in the last 30 days. Every entry here is exploited in the wild — that is the catalog's entry criterion, not our assessment.

Added: 33 Ransomware-linked: 0 Covered by our reporting: 19 RSS

Oct 30, 2026 (2)

CVE-2026-118527 exploited federal due 2026-11-13

Ivanti — Connect Secure

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Our coverage: Ivanti Connect Secure CVE-2026-118527 Exploited in the Wild
CVE-2026-111357 exploited federal due 2026-11-02

Ivanti — Connect Secure

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Our coverage: CVE-2026-111357: Ivanti Connect Secure Missing Auth Vuln Exploited

Oct 29, 2026 (2)

CVE-2026-97229 exploited federal due 2026-11-01

GitLab — Community Edition and Enterprise Edition

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

Our coverage: CVE-2026-97229: GitLab RCE via Integer Overflow — Patch Now
CVE-2026-76418 exploited federal due 2026-11-01

Cisco — Secure Firewall ASA Software and Cisco Secure FTD Software

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Our coverage: CVE-2026-76418: Cisco Firewall DoS - Patch Now

Oct 28, 2026 (2)

CVE-2026-46300 exploited federal due 2026-10-31

Linux — Kernel

Linux Kernel Missing Initialization of a Variable Vulnerability

Our coverage: CVE-2026-46300: Fragnesia Flaw Enables Linux Root Privilege Escalation CVE-2026-46300: Fragnesia Linux Kernel LPE Grants Root Access CVE-2026-46300: Linux Fragnesia Kernel Privilege Escalation Analysis
CVE-2026-41709 exploited federal due 2026-11-11

Broadcom — VMware ESX

Broadcom VMWare ESX Insufficient Logging Vulnerability

Our coverage: CVE-2026-41709: Broadcom VMware ESX Active Exploitation

Oct 27, 2026 (2)

CVE-2026-48356 exploited federal due 2026-11-10

Adobe — Commerce and Magento

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-111497 exploited federal due 2026-11-10

Google — Brotli

Google Brotli Unchecked Return Value Vulnerability

Oct 26, 2026 (2)

CVE-2026-109619 exploited federal due 2026-10-29

PHP Group — PHP

PHP Stale Internal Request-State Vulnerability

Our coverage: PHP RCE Flaws CVE-2026-109618/109619 Actively Exploited PHP2Shell Exploitation Roots Palo Alto Firewalls
CVE-2026-109618 exploited federal due 2026-10-29

PHP Group — PHP

PHP Memory Corruption Vulnerability

Our coverage: PHP RCE Flaws CVE-2026-109618/109619 Actively Exploited PHP2Shell Exploitation Roots Palo Alto Firewalls

Oct 23, 2026 (2)

CVE-2026-114625 exploited federal due 2026-10-26

Arista — VeloCloud Orchestrator

Arista VeloCloud Orchestrator SQL Injection Vulnerability
CVE-2026-110447 exploited federal due 2026-10-26

Collabora — Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Oct 20, 2026 (6)

CVE-2026-96656 exploited federal due 2026-10-23

Plex — Media Server

Plex Media Server External Control of File Name or Path Vulnerability
CVE-2026-96655 exploited federal due 2026-11-03

Plex — Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-96654 exploited federal due 2026-10-23

Plex — Media Server

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
CVE-2026-96652 exploited federal due 2026-11-03

Plex — Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-110936 exploited federal due 2026-11-03

Siemens — Software Center

Siemens Software Center Uncontrolled Search Path Element Vulnerability
CVE-2026-106931 exploited federal due 2026-10-23

EG Secure Solutions — SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Oct 16, 2026 (2)

CVE-2026-102764 exploited federal due 2026-10-19

BeyondTrust — Remote Support

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

Our coverage: CVE-2026-102764: ARMORY CASTLE Exploits BeyondTrust Zero-Day
CVE-2025-61624 exploited federal due 2026-10-19

Fortinet — Multiple Products

Fortinet Multiple Products Path Traversal Vulnerability

Our coverage: PEERSTITCH Malware Deployed via FortiManager and FortiOS Exploits

Oct 15, 2026 (1)

CVE-2026-21589 exploited federal due 2026-10-18

Atlassian — Multiple Products

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Our coverage: Atlassian Arbitrary File Access Exploitation Scans Observed

Oct 14, 2026 (4)

CVE-2026-76519 exploited federal due 2026-10-17

Cisco — Secure Email Gateway

Cisco Secure Email Gateway Relative Path Traversal Vulnerability
CVE-2026-105134 exploited federal due 2026-10-17

Ahsay — AhsayCBS

Ahsay AhsayCBS Command Injection Vulnerability
CVE-2026-105133 exploited federal due 2026-10-17

Ahsay — AhsayCBS

Ahsay AhsayCBS Improper Authentication Vulnerability
CVE-2026-0322 exploited federal due 2026-10-17

Palo Alto Networks — PAN-OS

Palo Alto Networks PAN-OS Code Injection Vulnerability

Oct 13, 2026 (2)

CVE-2026-96951 exploited federal due 2026-10-16

Microsoft — Windows

Microsoft Windows Command Injection Vulnerability

Our coverage: Microsoft Patch Tuesday: 1,400+ Flaws, One Zero-Day
CVE-2026-104935 exploited federal due 2026-10-16

Ivanti — Connect Secure

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Our coverage: CVE-2026-104935: Ivanti Connect Secure RCE via Auth Bypass Q3 Vulnerability Trends: 70K CVEs, Ivanti RCE, and UAT-6275

Oct 8, 2026 (5)

CVE-2023-22894 exploited federal due 2026-10-11

Strapi — Strapi

Strapi Cleartext Storage of Sensitive Information Vulnerability

Our coverage: CVE-2023-22894: Strapi Cleartext Storage Exploited
CVE-2021-3199 exploited federal due 2026-10-11

ONLYOFFICE — Docs

ONLYOFFICE Docs Server Path Traversal Vulnerability

Our coverage: CVE-2021-3199: ONLYOFFICE Docs RCE via Path Traversal
CVE-2016-3081 exploited federal due 2026-10-11

Apache — Struts

Apache Struts Command Injection Vulnerability

Our coverage: CVE-2016-3081: Apache Struts RCE via Command Injection — Patch Now
CVE-2015-5477 exploited federal due 2026-10-11

ISC — BIND

ISC BIND Data Processing Errors Vulnerability

Our coverage: CVE-2015-5477: Remote DoS in ISC BIND via TKEY Queries
CVE-2015-3306 exploited federal due 2026-10-11

ProFTPD — ProFTPD

ProFTPD Improper Access Control Vulnerability

Our coverage: CVE-2015-3306: ProFTPD Improper Access Control Exploitation

Oct 4, 2026 (1)

CVE-2026-88779 exploited federal due 2026-10-07

Citrix — NetScaler

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Our coverage: CVE-2026-88779: NetScaler DoS Exploit – Patch Now

Source: CISA KEV catalog. Refreshed every ingestion run. See also the full CVE tracker.