NewsCompaniesFlawsGuides
Get the app

Is it being used in attacks?

Search, HARD’s lookup of CISA’s catalog · Updated

Look up an app, a company, a CVE or a question. CISA, the US cybersecurity agency, lists 1,766 flaws it has evidence are being used in attacks;[1] this searches all of them, with CISA’s full entry for each and a link to HARD’s article in plain English, and everything else on hard.fyi: the Situation Room, the journal, the companies, the advisories and the guides.

Try ChromeiPhoneMicrosoftFortinetIs my router safe?CVE-2026-118527

Results

The 10 most recently added, newest first.

  1. Being used in attacks
    Ivanti Connect Secure
    CVE-2026-118527Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
    Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery Ivanti flaw
  2. Being used in attacks
    Ivanti Connect Secure
    CVE-2026-111357Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
    Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery Ivanti flaw
  3. Being used in attacks
    GitLab Community Edition and Enterprise Edition
    CVE-2026-97229GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
    GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery GitLab flaw
  4. Being used in attacks
    Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
    CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
    Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery Cisco flaw
  5. Being used in attacks
    Linux Kernel
    CVE-2026-46300Linux Kernel Missing Initialization of a Variable Vulnerability
    Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery Linux flaw
  6. Being used in attacks
    Broadcom VMware ESX
    CVE-2026-41709Broadcom VMWare ESX Insufficient Logging Vulnerability
    Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery Broadcom flaw
  7. Being used in attacks
    Google Brotli
    CVE-2026-111497Google Brotli Unchecked Return Value Vulnerability
    Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery Google flaw
  8. Being used in attacks
    Adobe Commerce and Magento
    CVE-2026-48356Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
    Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery Adobe flaw
  9. Being used in attacks
    PHP Group PHP
    CVE-2026-109619PHP Stale Internal Request-State Vulnerability
    PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery PHP Group flaw
  10. Being used in attacks
    PHP Group PHP
    CVE-2026-109618PHP Memory Corruption Vulnerability
    PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
    CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read allFollow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    In plain EnglishCVE recordNVDEvery PHP Group flaw

What being on the list means

CISA adds a flaw only when it has reliable evidence that attackers are using it, and only once there's a fix or clear advice.[1] So a match means two things: someone, somewhere, is using this flaw against real people now, and there's something you can do about it. Usually that's installing an update.

Not being on the list doesn't mean safe. Most flaws are never added, and attacks start before anyone has evidence. Keep everything updated either way.

CISA’s required action is written for US government agencies, which have to act by a deadline. For a family or a small business it comes to the same thing: update, or ask whoever looks after your IT to confirm it’s done.

By company

The companies with the most flaws on the list, and how many each has. Each page lists every one, newest first.

All 95 companies with three or more flaws on the list, or browse every flaw by month.

Latest alerts

When a flaw matters to people like you, HARD sends an alert: what's happening and what to do. Only when it matters.

  1. High
    Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet

    CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code: while a connection is being set up, the kernel can free some data too early and then read it again. The kernel's own rating is 9.8 out of 10. Anthropic, whose researcher reported it, says an unreleased Claude model built an exploit that ran commands as root on a server with a multipath TCP listener, in about 53 minutes. That exploit hasn't been published, and nobody has reported attacks. Debian, Oracle, SUSE and Amazon have fixed kernels for some versions; Ubuntu and Red Hat Enterprise Linux didn't as of 30 October.

    What to doAsk whoever runs servers for you (the family office, a business, the person who set up a home server or NAS) whether they run Linux, and to install the fixed kernel and reboot as soon as their distribution ships it. Until then, they can block IPv4 packets that carry IP options at the firewall.

    Read the full storyIs CVE-2026-98432 being used in attacks?
  2. High
    Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer

    Late on Friday 30 October, US time, at least twelve crypto websites registered through Name.com started sending visitors to a copy of the site rigged with Step Drainer, a kit that tricks people into approving transfers out of their wallets. Ten of the domains were bought through Vercel Domains, which uses Name.com underneath. Name.com says 15 domains were affected and all have been restored. About US$138,000 has been traced so far. Neither company has said how the attackers got in.

    What to doIf anyone in the family connected a crypto wallet to a DeFi site on 30 or 31 October, check and revoke its approvals at revoke.cash, and move what's left to a fresh wallet if they signed anything. If the family owns a domain through Vercel or Name.com, check its nameservers haven't changed, turn on two-step sign-in and ask for a registry lock.

    Read the full story
  3. High
    Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it

    Updated Northflank, a platform that runs customers' apps and databases, said on 30 October that attackers got at the secrets customers store with it, and that customers should assume every one was decrypted. More

    Railway, a hosting platform popular with developers, says someone accessed the secrets customers store with it, some decrypted. It believes it's part of a series of attacks on platforms, aimed at AI providers, after Fireworks AI and OpenCode.

    What to do nowIf your company, family office or anyone building software for you uses Northflank, Railway, OpenCode, Fireworks AI or any similar platform, ask them to change every key and password stored there today, check their AI providers' usage and bills, and set spending limits on AI accounts.

    Read the full story

The Situation Room · RSS feed · HARD’s advisories · The journal

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. The plain-English articles are HARD’s own.