Vulnerabilities
Flaws in widely used software that are in the news, each on one page: whether it is being attacked, whether there is a fix, which versions, and what to do. Being exploited first.
- CVE-2026-96951 Microsoft WindowsCommand injection in Windows Shell lets an attacker bypass a security featureCVE-2026-96951 · 2 storiesBeing exploitedCISA listedFix available
- Broccoli2Shell Google BrotliBrotli decoder memory corruption lets remote attackers run code or crash appsCVE-2026-111497 · 2 storiesBeing exploitedCISA listedFix available
- CVE-2026-35273 Oracle Corporation PeopleSoft Enterprise PeopleToolsAllows unauthenticated attacker to take over PeopleSoft Enterprise PeopleToolsCVE-2026-35273 · From CISA's listBeing exploitedCISA listedNo fix in the record
- PHP2Shell PHP Group PHPCritical PHP2Shell flaws allow remote code execution on serversCVE-2026-109618, CVE-2026-109619 · 6 storiesBeing exploitedCISA listedFix available
- CVE-2026-20700 Apple Multiple ProductsApple operating system flaws let attackers execute code, steal data, access camerasCVE-2026-20700, CVE-2026-86950, CVE-2026-86987 +1 · 4 storiesBeing exploitedCISA listedFix available
- CVE-2026-48356 Adobe Commerce and MagentoAttacker can upload malicious files to run code on Adobe Commerce storesCVE-2026-48356 · From CISA's listBeing exploitedCISA listedNo fix in the record
- CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared)Authentication bypass in cPanel and WHM lets unauthenticated attackers gain control panel accessCVE-2026-41940 · 1 storyBeing exploitedCISA listedFix available
- Baton Drop Microsoft Windows 10 Version 1809Bypass Secure Boot and deploy UEFI bootkits on Windows systems.CVE-2022-21894 · 1 storyBeing exploitedFix available
- CVE-2026-110447 Collabora Collabora Online – Built-in CODE ServerOS command injection in Collabora CODE Server allows remote code execution on NextcloudCVE-2026-110447 · 1 storyBeing exploitedCISA listedFix available
- CVE-2026-114625 Arista VeloCloud OrchestratorSQL injection lets authenticated users gain operator privileges in VeloCloud OrchestratorCVE-2026-114625 · 1 storyBeing exploitedCISA listedFix available
- CVE-2026-85706 GitLab Community Edition and Enterprise EditionPath traversal lets unauthenticated attackers read arbitrary files from GitLab serversCVE-2026-85706 · 4 storiesBeing exploitedCISA listedFix available
- CVE-2023-27532 Veeam Backup & ReplicationAttackers can obtain encrypted credentials and access backup infrastructure hosts in Veeam Backup & Replication.CVE-2023-27532 · 1 storyBeing exploitedCISA listedNo fix in the record
- CVE-2026-0257 Palo Alto Networks PAN-OSAttackers bypass authentication in Palo Alto PAN-OS firewalls to establish unauthorized VPN connections.CVE-2026-0257 · 1 storyBeing exploitedCISA listedFix available
- CVE-2026-110936 Siemens Software CenterUncontrolled search path allows local code execution in Siemens Software CenterCVE-2026-110936 · From CISA's listBeing exploitedCISA listedFix available
- CVE-2026-96654 Plex Media ServerURL injection in Plex Media Server lets attackers call arbitrary plugin functions.CVE-2026-96654 · From CISA's listBeing exploitedCISA listedFix available
- CVE-2026-96655 Plex Media ServerLets authenticated users make Plex Media Server connect to any internal or external address.CVE-2026-96655 · From CISA's listBeing exploitedCISA listedFix available
- CVE-2026-106931 EG Secure Solutions SiteGuard Server EditionOS command injection in SiteGuard WAF lets attacker execute commands with root or SYSTEM privilegesCVE-2026-106931 · 1 storyBeing exploitedCISA listedFix available
- CVE-2026-96652 Plex Media ServerAttacker can force Plex server to send requests to any destinationCVE-2026-96652 · From CISA's listBeing exploitedCISA listedFix available
- CVE-2026-96656 Plex Media ServerArbitrary file write in Plex Media Server lets admin attacker execute code on load.CVE-2026-96656 · From CISA's listBeing exploitedCISA listedFix available
- CVE-2026-88771 Citrix NetScalerAttackers can run commands and crash Citrix NetScaler appliancesCVE-2026-88771, CVE-2026-88772, CVE-2026-88779 · 4 storiesBeing exploitedCISA listedFix available
- CVE-2026-102764 BeyondTrust Remote SupportAttackers bypass authentication and perform file operations on BeyondTrust Remote SupportCVE-2026-102764 · 1 storyBeing exploitedCISA listedNo fix in the record
- CVE-2026-1731 BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA)An unauthenticated attacker can execute OS commands in BeyondTrust Remote Support and Privileged Remote Access.CVE-2026-1731 · From CISA's listBeing exploitedCISA listedNo fix in the record
- CVE-2025-61624 Fortinet Multiple ProductsAuthenticated admin can write or delete arbitrary files in multiple Fortinet productsCVE-2025-61624 · From CISA's listBeing exploitedCISA listedNo fix in the record
From our reporting and the public records: CVE.org, CISA's Known Exploited Vulnerabilities catalog and FIRST's exploit prediction scores. Checked every half hour.