Is it being used in attacks?
Look up an app, a company or a CVE. CISA, the US cybersecurity agency, lists 1,754 flaws it has evidence are being used in attacks; this searches all of them.
The 10 most recently added, newest first.
- Siemens Software Center
CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element VulnerabilitySiemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - EG Secure Solutions SiteGuard Server Edition
CVE-2026-106931EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityEG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Plex Media Server
CVE-2026-96656Plex Media Server External Control of File Name or Path VulnerabilityPlex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Plex Media Server
CVE-2026-96655Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Plex Media Server
CVE-2026-96654Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityPlex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Plex Media Server
CVE-2026-96652Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - BeyondTrust Remote Support
CVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Fortinet Multiple Products
CVE-2025-61624Fortinet Multiple Products Path Traversal VulnerabilityFortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Atlassian Multiple Products
CVE-2026-21589Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityMultiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - AhsayCBS
CVE-2026-105134Ahsay AhsayCBS Command Injection VulnerabilityAhsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). Plain-English advisories are HARD’s own.
What being on the list means
CISA adds a flaw only when it has reliable evidence that attackers are using it, and only once there's a fix or clear advice. So a match means two things: someone, somewhere, is using this flaw against real people now, and there's something you can do about it. Usually that's installing an update.
Not being on the list doesn't mean safe. Most flaws are never added, and attacks start before anyone has evidence. Keep everything updated either way.
CISA’s required action is written for US government agencies, which have to act by a deadline. For a family or a small business it comes to the same thing: update, or ask whoever looks after your IT to confirm it’s done.
By company
The companies with the most flaws on the list. Each page lists every one, newest first.
- Microsoft390
- Cisco101
- Apple95
- Adobe82
- Google75
- Oracle46
- Apache41
- Ivanti36
- Fortinet32
- Linux31
- Citrix27
- D-Link26
- VMware26
- SonicWall19
- Synacor19
- Android17
All 94 companiesCompanies with three or more flaws on the list.
Latest alerts
When a flaw matters to people like you, HARD sends an alert: what's happening and what to do. Only when it matters.
- BIND DNS servers: a flaw that could let attackers take over, fixed in 9.20.30
ISC disclosed CVE-2026-94300, rated 8.1: replayed or crafted GSS-TSIG messages can corrupt memory in BIND 9 and may allow remote code execution. No workaround, no known attacks yet.
What to doAsk whoever runs IT for you (company, family office, web host) whether they run BIND, and confirm it's on 9.20.30 or 9.21.27.
Read the full storyIs CVE-2026-94300 being used in attacks? - AI with its safety rules removed now rents for US$20 a month
Abliteration.ai sells access to frontier AI models with their refusals removed, with a free sign-up, no identity checks and no record kept of what's asked.
What to doNothing to change today. Make sure nobody moves money or shares a code because of a message alone: they call back on a number they already had.
Read the full story - Railway breached: the third platform in fifteen days to lose customers' keys
Railway, a hosting platform popular with developers, says someone accessed the secrets customers store with it, some decrypted. It believes it's part of a series of attacks on platforms, aimed at AI providers, after Fireworks AI and OpenCode.
What to doIf your company, family office or anyone building software for you uses Railway, OpenCode or Fireworks AI, ask them to change every stored key and password today, and to set spending limits on AI accounts.
Read the full story