Is it being used in attacks?
Look up an app, a company, a CVE or a question. CISA, the US cybersecurity agency, lists 1,766 flaws it has evidence are being used in attacks;[1] this searches every one, with HARD’s article on each in plain English, and everything else on hard.fyi. Narrow the flaws with the filters, and sort them by any column.
On hard.fyi
| Company | What it lets attackers do | |||||
|---|---|---|---|---|---|---|
| Ivanti Connect Secure | CVE-2026-118527 | Generation of predictable numbers or identifiers. | Not scored | |||
| Ivanti Connect Secure | CVE-2026-111357 | Someone who already has a foothold can use Ivanti Connect Secure to take full control of the machine. | 7.0 HighOdds: under 1% | |||
 | GitLab Community Edition and Enterprise Edition | CVE-2026-97229 | Attackers can run their own code on GitLab Community Edition and Enterprise Edition from anywhere, without logging in. | 10.0 CriticalOdds: 27% | ||
 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | CVE-2026-76418 | Attackers can corrupt memory in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software from anywhere, without logging in, which they use to take it over. | 8.6 HighOdds: under 1% | ||
| Linux Kernel | CVE-2026-46300 | Missing initialization of a variable. | 7.8 HighOdds: 16% | |||
 | Broadcom VMware ESX | CVE-2026-41709 | Insufficient logging. | 2.7 LowOdds: under 1% | ||
 | Adobe Commerce and Magento | CVE-2026-48356 | A booby-trapped web page can run an attacker's code through Adobe Commerce and Magento. | 9.3 CriticalOdds: 45% | ||
 | Google Brotli | CVE-2026-111497 | Attackers can run their own code on Google Brotli from anywhere, without logging in. | 9.8 CriticalOdds: 83% | ||
 | PHP | CVE-2026-109619 | Attackers can run their own code on PHP from anywhere, without logging in. | 8.1 HighOdds: over 99% | ||
| PHP | CVE-2026-109618 | Attackers can run their own code on PHP from anywhere, without logging in. | 9.8 CriticalOdds: over 99% | ||
| Arista VeloCloud Orchestrator | CVE-2026-114625 | Attackers can read or change the database behind Arista VeloCloud Orchestrator. | 9.9 CriticalOdds: 1% | |||
| Collabora Online – Built-in CODE Server | CVE-2026-110447 | Attackers can run their own code on Collabora Online – Built-in CODE Server. | 9.8 CriticalOdds: 73% | |||
 | Plex Media Server | CVE-2026-96656 | External control of file name or path. | 7.2 HighOdds: 2% | ||
| Plex Media Server | CVE-2026-96655 | Attackers can make Plex Media Server send requests into the network behind it. | 4.3 MediumOdds: 2% | ||
| Plex Media Server | CVE-2026-96654 | Improper neutralization of encoded URI schemes in a web page. | 6.5 MediumOdds: 2% | ||
| Plex Media Server | CVE-2026-96652 | Attackers can make Plex Media Server send requests into the network behind it. | 4.3 MediumOdds: 2% | ||
| Siemens Software Center | CVE-2026-110936 | Someone who already has a way in can use Siemens Software Center to run their own code. | 6.7 MediumOdds: under 1% | |||
| EG Secure Solutions SiteGuard Server Edition | CVE-2026-106931 | Attackers can run commands on EG Secure Solutions SiteGuard Server Edition. | 8.5 HighOdds: 3% | |||
 | BeyondTrust Remote Support | CVE-2026-102764 | Attackers can get into BeyondTrust Remote Support without a valid password. | 9.8 CriticalOdds: 19% | ||
 | Fortinet products | CVE-2025-61624 | Attackers can reach parts of Fortinet products that should be locked to them. | 6.5 MediumOdds: 1% | ||
 | Atlassian products | CVE-2026-21589 | Attackers can read files on Atlassian products that should be out of reach from anywhere, without logging in. | 7.5 HighOdds: 99% | ||
| Cisco Secure Email Gateway | CVE-2026-76519 | Attackers can run commands on Cisco Secure Email Gateway from anywhere, without logging in. | 9.8 CriticalOdds: 2% | ||
| AhsayCBS | CVE-2026-105134 | Attackers can run commands on AhsayCBS. | 10.0 CriticalOdds: 82% | |||
| AhsayCBS | CVE-2026-105133 | Attackers can get into AhsayCBS without a valid password. | 7.3 HighOdds: 79% | |||
 | Palo Alto Networks PAN-OS | CVE-2026-0322 | Someone who already has a way in can use Palo Alto Networks PAN-OS to run their own code. | 7.2 HighOdds: 2% | ||
 | Microsoft Windows | CVE-2026-96951 | Attackers can run commands on Microsoft Windows. | 8.8 HighOdds: 10% | ||
| Ivanti Connect Secure | CVE-2026-104935 | Attackers can run commands on Ivanti Connect Secure from anywhere, without logging in. | 8.6 HighOdds: 87% | |||
| Strapi | CVE-2023-22894 | Attackers can run their own code on Strapi. | 4.9 MediumOdds: 4% | |||
| ONLYOFFICE Docs | CVE-2021-3199 | Attackers can run their own code on ONLYOFFICE Docs. | 9.8 CriticalOdds: 30% | |||
 | Apache Struts | CVE-2016-3081 | Attackers can run their own code on Apache Struts. | 8.1 HighOdds: 97% | ||
 | ISC BIND | CVE-2015-5477 | Attackers can crash ISC BIND or stop it working. | 7.5 HighOdds: over 99% | ||
| ProFTPD | CVE-2015-3306 | Attackers can reach parts of ProFTPD that should be locked to them. | 10.0 CriticalOdds: over 99% | |||
 | Citrix NetScaler | CVE-2026-88779 | Attackers can crash Citrix NetScaler or stop it working. | 7.5 HighOdds: 11% | ||
| Zammad GmbH Zammad | CVE-2026-102490 | Someone who already has a foothold can use Zammad GmbH Zammad to take full control of the machine. | 7.8 HighOdds: 11% | |||
| Zammad GmbH Zammad | CVE-2026-102489 | Attackers can run their own code on Zammad GmbH Zammad. | 9.8 CriticalOdds: 22% | |||
| Fortinet FortiMail | CVE-2026-104286 | Attackers can reach parts of Fortinet FortiMail that should be locked to them from anywhere, without logging in. | 9.8 CriticalOdds: 5% | ||
| Cisco Catalyst SD-WAN Manager | CVE-2026-76504 | Attackers can get into Cisco Catalyst SD-WAN Manager without a valid password. | 9.8 CriticalOdds: 39% | ||
 | Apple devices | CVE-2026-86950 | Opening a booby-trapped file can let an attacker run their own code through Apple devices. | 8.8 HighOdds: 26% | ||
| Citrix NetScaler | CVE-2026-88772 | Attackers can run their own code on Citrix NetScaler. | 8.1 HighOdds: 78% | ||
| Citrix NetScaler | CVE-2026-88771 | Attackers can run commands on Citrix NetScaler from anywhere, without logging in. | 9.8 CriticalOdds: 82% | ||
| WordPress Core | CVE-2026-87902 | Attackers can run their own code on WordPress Core from anywhere, without logging in. | 8.1 HighOdds: 96% | |||
 | MikroTik RouterOS | CVE-2026-67279 | Improper enforcement of behavioral workflow. | 6.5 MediumOdds: 2% | ||
| Microsoft SharePoint | CVE-2026-65660 | Attackers can run their own code on Microsoft SharePoint. | 8.8 HighOdds: 8% | ||
| Adobe Commerce and Magento | CVE-2026-71362 | Someone who already has a foothold can use Adobe Commerce and Magento to take full control of the machine. | 9.1 CriticalOdds: 90% | ||
| WSO2 products | CVE-2026-5430 | Attackers can run their own code on WSO2 products. | 10.0 CriticalOdds: 22% | |||
 | F5 BIG-IP APM | CVE-2026-94127 | Attackers can run their own code on F5 BIG-IP APM from anywhere, without logging in. | 9.8 CriticalOdds: 27% | ||
| Arista VeloCloud Orchestrator | CVE-2026-93952 | Improper input validation. | 10.0 CriticalOdds: 1% | |||
 | Check Point products | CVE-2026-93616 | Attackers can read files on Check Point products that should be out of reach from anywhere, without logging in. | 9.8 CriticalOdds: 92% | ||
| Check Point products | CVE-2026-85102 | Attackers can run their own code on Check Point products from anywhere, without logging in. | 9.8 CriticalOdds: 54% | ||
| Zyxel GS1900 Series Switches | CVE-2026-7273 | Attackers can run commands on Zyxel GS1900 Series Switches from anywhere, without logging in. | 8.8 HighOdds: 3% |
What being on the list means
CISA adds a flaw only when it has reliable evidence that attackers are using it, and only once there's a fix or clear advice.[1] So a match means two things: someone, somewhere, is using this flaw against real people now, and there's something you can do about it. Usually that's installing an update.
Not being on the list doesn't mean safe. Most flaws are never added, and attacks start before anyone has evidence. Keep everything updated either way.
CISA’s required action is written for US government agencies, which have to act by a deadline. For a family or a small business it comes to the same thing: update, or ask whoever looks after your IT to confirm it’s done.
By company
The companies with the most flaws on the list, and how many each has. Each page lists every one, newest first.
- Microsoft390
- Cisco102
- Apple95
- Adobe83
- Google76
- Oracle46
- Apache41
- Ivanti38
- Linux32
- Fortinet32
- Citrix27
- D-Link26
- VMware26
- SonicWall19
- Synacor19
- Android17
- Palo Alto Networks16
- Samsung15
- Atlassian14
- SAP14
- Zyxel13
- Mozilla13
- Trend Micro12
- Qualcomm12
All 95 companies with three or more flaws on the list, or every flaw by month.
Latest alerts
When a flaw matters to people like you, HARD sends an alert: what's happening and what to do. Only when it matters.
- Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code: while a connection is being set up, the kernel can free some data too early and then read it again. The kernel's own rating is 9.8 out of 10. Anthropic, whose researcher reported it, says an unreleased Claude model built an exploit that ran commands as root on a server with a multipath TCP listener, in about 53 minutes. That exploit hasn't been published, and nobody has reported attacks. Debian, Oracle, SUSE and Amazon have fixed kernels for some versions; Ubuntu and Red Hat Enterprise Linux didn't as of 30 October.
What to doAsk whoever runs servers for you (the family office, a business, the person who set up a home server or NAS) whether they run Linux, and to install the fixed kernel and reboot as soon as their distribution ships it. Until then, they can block IPv4 packets that carry IP options at the firewall.
Read the full storyIs CVE-2026-98432 being used in attacks? - Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer
Late on Friday 30 October, US time, at least twelve crypto websites registered through Name.com started sending visitors to a copy of the site rigged with Step Drainer, a kit that tricks people into approving transfers out of their wallets. Ten of the domains were bought through Vercel Domains, which uses Name.com underneath. Name.com says 15 domains were affected and all have been restored. About US$138,000 has been traced so far. Neither company has said how the attackers got in.
What to doIf anyone in the family connected a crypto wallet to a DeFi site on 30 or 31 October, check and revoke its approvals at revoke.cash, and move what's left to a fresh wallet if they signed anything. If the family owns a domain through Vercel or Name.com, check its nameservers haven't changed, turn on two-step sign-in and ask for a registry lock.
Read the full story
The Situation Room · RSS feed · HARD’s advisories · The long reads
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. The plain-English articles are HARD’s own.