Exploited flaws
HARD’s guide to every flaw CISA lists as being used in attacks · Updated · RSS
Exploited flaws are the 1,766 security vulnerabilities the US Cybersecurity and Infrastructure Security Agency (CISA) lists in its Known Exploited Vulnerabilities catalog: flaws it has reliable evidence attackers are using.[1] CISA added 282 this year, ten of them in the last week. HARD has an article on each one, in plain English: what the product is, what the flaw lets an attacker do, who has it, and how to fix it.
Search for an app, a company or a CVE, or browse by company, product, month or kind of flaw below.
| CVE | Flaw | Found | Added |
|---|
Added this week
Ten flaws added since 26 Oct 2026. The newest, CVE-2026-118527, came in on 30 Oct 2026. marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-118527At work |
Ivanti Connect Secure. Attackers are using a flaw in Ivanti Connect Secure. | At work |
CVE-2026-111357At work |
Ivanti Connect Secure. Someone who already has a foothold can use Ivanti Connect Secure to take full control of the machine. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-97229At work |
GitLab Community Edition and Enterprise Edition. Attackers can run their own code on GitLab Community Edition and Enterprise Edition from anywhere, without logging in. | At work |
CVE-2026-76418At work |
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Attackers can corrupt memory in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software from anywhere, without logging in, which they use to take it over. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-46300At work |
Linux Kernel. Attackers are using a flaw in Linux Kernel. | At work |
CVE-2026-41709At work |
Broadcom VMware ESX. Attackers are using a flaw in Broadcom VMware ESX. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-48356At work |
Adobe Commerce and Magento. A booby-trapped web page can run an attacker's code through Adobe Commerce and Magento. | At work |
CVE-2026-111497At work |
Google Brotli. Attackers can run their own code on Google Brotli from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-109619At work |
PHP. Attackers can run their own code on PHP from anywhere, without logging in. | At work |
CVE-2026-109618At work |
PHP. Attackers can run their own code on PHP from anywhere, without logging in. | At work |
Earlier this month
| CVE | Flaw | Found | Added |
|---|---|---|---|
CVE-2026-114625At work · |
Arista VeloCloud Orchestrator. Attackers can read or change the database behind Arista VeloCloud Orchestrator. | At work | |
CVE-2026-110447At work · |
Collabora Online – Built-in CODE Server. Attackers can run their own code on Collabora Online – Built-in CODE Server. | At work | |
CVE-2026-96656At home · |
Plex Media Server. Attackers are using a flaw in Plex Media Server. | At home | |
CVE-2026-96655At home · |
Plex Media Server. Attackers can make Plex Media Server send requests into the network behind it. | At home | |
CVE-2026-96654At home · |
Plex Media Server. Attackers are using a flaw in Plex Media Server. | At home | |
CVE-2026-96652At home · |
Plex Media Server. Attackers can make Plex Media Server send requests into the network behind it. | At home | |
CVE-2026-110936At work · |
Siemens Software Center. Someone who already has a way in can use Siemens Software Center to run their own code. | At work | |
CVE-2026-106931At work · |
EG Secure Solutions SiteGuard Server Edition. Attackers can run commands on EG Secure Solutions SiteGuard Server Edition. | At work | |
CVE-2026-102764At work · |
BeyondTrust Remote Support. Attackers can get into BeyondTrust Remote Support without a valid password. | At work | |
CVE-2025-61624At work · |
Fortinet products. Attackers can reach parts of Fortinet products that should be locked to them. | At work | |
CVE-2026-21589At work · |
Atlassian products. Attackers can read files on Atlassian products that should be out of reach from anywhere, without logging in. | At work | |
CVE-2026-76519At work · |
Cisco Secure Email Gateway. Attackers can run commands on Cisco Secure Email Gateway from anywhere, without logging in. | At work | |
CVE-2026-105134At work · |
AhsayCBS. Attackers can run commands on AhsayCBS. | At work | |
CVE-2026-105133At work · |
AhsayCBS. Attackers can get into AhsayCBS without a valid password. | At work | |
CVE-2026-0322At work · |
Palo Alto Networks PAN-OS. Someone who already has a way in can use Palo Alto Networks PAN-OS to run their own code. | At work | |
CVE-2026-96951At home · |
Microsoft Windows. Attackers can run commands on Microsoft Windows. | At home | |
CVE-2026-104935At work · |
Ivanti Connect Secure. Attackers can run commands on Ivanti Connect Secure from anywhere, without logging in. | At work | |
CVE-2023-22894At work · |
Strapi. Attackers can run their own code on Strapi. | At work | |
CVE-2021-3199At work · |
ONLYOFFICE Docs. Attackers can run their own code on ONLYOFFICE Docs. | At work | |
CVE-2016-3081At work · |
Apache Struts. Attackers can run their own code on Apache Struts. | At work | |
CVE-2015-5477At work · |
ISC BIND. Attackers can crash ISC BIND or stop it working. | At work | |
CVE-2015-3306At work · |
ProFTPD. Attackers can reach parts of ProFTPD that should be locked to them. | At work | |
CVE-2026-88779At work · |
Citrix NetScaler. Attackers can crash Citrix NetScaler or stop it working. | At work | |
CVE-2026-102490At work · |
Zammad GmbH Zammad. Someone who already has a foothold can use Zammad GmbH Zammad to take full control of the machine. | At work | |
CVE-2026-102489At work · |
Zammad GmbH Zammad. Attackers can run their own code on Zammad GmbH Zammad. | At work | |
CVE-2026-104286At work · |
Fortinet FortiMail. Attackers can reach parts of Fortinet FortiMail that should be locked to them from anywhere, without logging in. | At work |
Everything added in October 2026 · September 2026
Most searched
The 15 flaws people look up by name most often, with how many times a month each is searched on Google in the US.[2]
| CVE | Flaw | Searches a month |
|---|---|---|
CVE-2026-314315,400 a month | Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | 5,400 |
CVE-2025-55182†3,600 a month | Meta React Server Components. Attackers can run their own code on Meta React Server Components from anywhere, without logging in. | 3,600 |
CVE-2025-592871,600 a month | Microsoft Windows. Attackers can run their own code on Microsoft Windows. | 1,600 |
CVE-2025-203331,300 a month | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. Attackers can run their own code on Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. | 1,300 |
CVE-2026-215091,300 a month | Microsoft Office. Attackers can get past a security protection in Microsoft Office. | 1,300 |
CVE-2025-148471,000 a month | MongoDB and MongoDB Server. Attackers are using a flaw in MongoDB and MongoDB Server. | 1,000 |
CVE-2026-0257†880 a month | Palo Alto Networks PAN-OS. Attackers can get into Palo Alto Networks PAN-OS without a valid password. | 880 |
CVE-2025-61882†880 a month | Oracle E-Business Suite. Attackers are using a flaw in Oracle E-Business Suite that its maker hasn't described in detail. | 880 |
CVE-2013-3900880 a month | Microsoft WinVerifyTrust function. Attackers can run their own code on Microsoft WinVerifyTrust function. | 880 |
CVE-2021-44228†880 a month | Apache Log4j2. Attackers can run their own code on Apache Log4j2. | 880 |
CVE-2026-0300720 a month | Palo Alto Networks PAN-OS. Attackers can run their own code on Palo Alto Networks PAN-OS from anywhere, without logging in. | 720 |
CVE-2026-1731†720 a month | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). Attackers can run their own code on BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) from anywhere, without logging in. | 720 |
CVE-2026-24061720 a month | GNU InetUtils. Attackers can get into GNU InetUtils without a valid password. | 720 |
CVE-2026-33824590 a month | Microsoft Internet Key Exchange (IKE) Service Extensions. Attackers can run their own code on Microsoft Internet Key Exchange (IKE) Service Extensions. | 590 |
CVE-2026-33825†590 a month | Microsoft Defender. Someone who already has a foothold can use Microsoft Defender to take full control of the machine. | 590 |
Also searched often:
- CVE-2026-42897590
- CVE-2025-20352590
- CVE-2025-41244590
- CVE-2026-2441590
- CVE-2026-5281590
- CVE-2025-24813590
- CVE-2023-44487590
- CVE-2026-41940480
- CVE-2025-20362480
- CVE-2025-32463480
- CVE-2025-33073480
- CVE-2025-59718480
- CVE-2025-62215480
- CVE-2026-20127480
- CVE-2026-24858480
- CVE-2026-34621480
- CVE-2026-21962390
- CVE-2026-32202390
- CVE-2025-13223390
- CVE-2025-14174390
- CVE-2026-20045390
- CVE-2026-20805390
- CVE-2026-3055390
- CVE-2023-20198390
- CVE-2026-20079320
- CVE-2025-43529320
- CVE-2025-53770320
- CVE-2025-62221320
- CVE-2026-20131320
- CVE-2026-20700320
Browse
By company
The 30 companies with the most flaws on the list, and how many each has. Most are business equipment; the ones at home are mostly phones, computers, browsers and routers.
- Microsoft390
- Cisco102
- Apple95
- Adobe83
- Google76
- Oracle46
- Apache41
- Ivanti38
- Linux32
- Fortinet32
- Citrix27
- D-Link26
- VMware26
- SonicWall19
- Synacor19
- Android17
- Palo Alto Networks16
- Samsung15
- Atlassian14
- SAP14
- Zyxel13
- Mozilla13
- Trend Micro12
- Qualcomm12
- SolarWinds11
- Roundcube11
- QNAP11
- Red Hat9
- Progress9
- Arm9
All 95 companies with three or more, or look up any other.
By product
The products with the most flaws on the list. Each opens the lookup, with CISA’s full entry for every one.
- Microsoft Windows175
- Chrome and other Chromium browsers65
- Microsoft Internet Explorer36
- Adobe Flash Player33
- Linux Kernel32
- Microsoft Office29
- Microsoft Win32k25
- Synacor Zimbra Collaboration Suite (ZCS)17
- Microsoft Exchange Server17
- Adobe ColdFusion16
- Cisco IOS and IOS XE Software14
- Palo Alto Networks PAN-OS13
- Adobe Acrobat and Reader13
- Samsung Mobile Devices13
- Oracle WebLogic Server12
- Qualcomm Multiple Chipsets11
- Roundcube Webmail11
- Apple iOS, iPadOS, and macOS11
- Microsoft SharePoint10
- SAP NetWeaver10
- Fortinet FortiOS9
- VMware vCenter Server9
- Apple iOS8
- Adobe Reader and Acrobat8
- Ivanti Endpoint Manager Mobile (EPMM)7
- Juniper Junos OS7
- Oracle Java SE7
- Ivanti Pulse Connect Secure7
- Apache Struts6
- Citrix NetScaler6
By month
CISA started its list in November 2021 with the flaws it already knew were being used; it has added some most weeks since. Pick a month to see everything added in it.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
By kind of flaw
What each flaw lets an attacker do, in four, from CISA’s and NVD’s descriptions.[3]
| Attackers can | Flaws | Ransomware | Latest |
|---|---|---|---|
| Take it over: run their own code, or take full control | 1,252 | 262 | CVE-2026-111357 |
| Get in: get past a login or a protection | 209 | 44 | CVE-2026-102764 |
| Read what’s inside: read files, databases or private data | 158 | 35 | CVE-2026-114625 |
| Other: crash it, or something CISA doesn’t describe | 147 | 20 | CVE-2026-118527 |
And by CISA’s own name for the kind of flaw, the commonest first:
- Remote code execution109
- Privilege escalation83
- Use-after-free63
- Memory corruption49
- Path traversal47
- OS command injection46
- Command injection42
- Authentication bypass39
- Deserialization of untrusted data34
- Information disclosure33
- Improper input validation32
- Type confusion32
- Code injection29
- SQL injection28
- Out-of-bounds write28
- Improper access control26
- Buffer overflow26
- Improper authentication22
- Directory traversal16
- Heap-based buffer overflow14
- Stack-based buffer overflow14
- Cross-site scripting (XSS)13
- Kernel privilege escalation13
- Server-side request forgery (SSRF)11
About the list
CISA adds a flaw only when it has reliable evidence that attackers are using it, and only once there’s a fix or clear advice. The date on each is when CISA added it, not when the attacks began. US government agencies have to fix each one by a deadline; for a family or a small business it comes to the same thing: update, or ask whoever looks after your IT to confirm it’s done.[1]
Not being on the list doesn’t mean safe. Most flaws are never added, and attacks start before anyone has evidence. Keep everything updated either way.
HARD adds NVD’s severity scores and affected versions and FIRST’s odds of attacks to each flaw, and refreshes them every morning.[4][5] The Situation Room covers the ones that matter most to families, as they happen.
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026.
- ^ DataForSEO keyword_overview (Google Ads search volume), United States, English, 30 Oct 2026.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
- ^ National Institute of Standards and Technology. “National Vulnerability Database”, as of 1 Nov 2026.
- ^ FIRST. “Exploit Prediction Scoring System”, 31 Oct 2026.
This page was last updated on 30 Oct 2026, from version 2026.10.30 of CISA’s catalog. Follow new additions by RSS.