Vulnerabilities
Flaws in widely used software that are in the news, each on one page: whether it is being attacked, whether there is a fix, which versions, and what to do. Being exploited first.
- Broccoli2Shell Google BrotliBrotli decoder memory corruption lets remote attackers run code or crash appsCVE-2026-111497 · 1 storyBeing exploitedCISA listedFix available
- CVE-2026-35273 Oracle Corporation PeopleSoft Enterprise PeopleToolsAllows unauthenticated attacker to take over PeopleSoft Enterprise PeopleToolsCVE-2026-35273 · From CISA's listBeing exploitedCISA listedNo fix in the record
- PHP2Shell PHP Group PHPCritical PHP2Shell flaws allow remote code execution on serversCVE-2026-109618, CVE-2026-109619 · 6 storiesBeing exploitedCISA listedFix available
- CVE-2026-20700 Apple Multiple ProductsApple operating system flaws let attackers execute code, steal data, access camerasCVE-2026-20700, CVE-2026-86950, CVE-2026-86987 +1 · 4 storiesBeing exploitedCISA listedFix available
- CVE-2026-48356 Adobe Commerce and MagentoAttacker can upload malicious files to run code on Adobe Commerce storesCVE-2026-48356 · From CISA's listBeing exploitedCISA listedNo fix in the record
- CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared)Authentication bypass in cPanel and WHM lets unauthenticated attackers gain control panel accessCVE-2026-41940 · 1 storyBeing exploitedCISA listedFix available
- Baton Drop Microsoft Windows 10 Version 1809Bypass Secure Boot and deploy UEFI bootkits on Windows systems.CVE-2022-21894 · 1 storyBeing exploitedFix available
- CVE-2026-110447 Collabora Collabora Online – Built-in CODE ServerOS command injection in Collabora CODE Server allows remote code execution on NextcloudCVE-2026-110447 · 1 storyBeing exploitedCISA listedFix available
- CVE-2026-114625 Arista VeloCloud OrchestratorSQL injection lets authenticated users gain operator privileges in VeloCloud OrchestratorCVE-2026-114625 · 1 storyBeing exploitedCISA listedFix available
- CVE-2026-85706 GitLab Community Edition and Enterprise EditionPath traversal lets unauthenticated attackers read arbitrary files from GitLab serversCVE-2026-85706 · 4 storiesBeing exploitedCISA listedFix available
- CVE-2026-58240 SAP_SE SAP NetWeaver (Message Server)Lets attacker register unauthorized components in SAP NetWeaver Message ServerCVE-2026-58240 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-44756 SAP_SE SAP Extended Passport (EPP) ProcessingUnauthenticated request can corrupt memory and crash SAP Extended Passport processing.CVE-2026-44756 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-8467 phenixdigital phoenix_storybookUnauthenticated remote code execution via HEEx template injection in Phoenix StorybookCVE-2026-8467 · 1 storyNot reported exploitedFix available
- CVE-2026-114595 The EPICS Community EPICS BaseCritical flaws in EPICS Base can let attackers crash systems or execute code remotelyCVE-2026-114595, CVE-2026-114596, CVE-2026-114597 +1 · 1 storyNot reported exploitedNo fix in the record
- CVE-2026-97631 TianoCore EDK2Allows code execution before OS defenses load in UEFI firmware.CVE-2026-97631 · 1 storyNot reported exploitedNo fix in the record
- CVE-2026-80097 Microsoft Microsoft Authenticator for AndroidAndroid app flaw lets attackers steal work account tokens.CVE-2026-80097 · From CISA's listNot reported exploitedFix available
- CVE-2025-20701 Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x seriesAllows Bluetooth pairing without user consent leading to privilege escalationCVE-2025-20701 · 1 storyNot reported exploitedNo fix in the record
- CVE-2026-106069 nodejs nodeBypass TLS hostname verification in Node.js via non-canonical IPv4 literalCVE-2026-106069 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-105482 nodejs nodeNUL byte in DNS queries lets validated hostnames resolve to different domainsCVE-2026-105482 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-105483 nodejs nodeTLS hostname check bypass in Node.js lets attacker use wrong certificate for IPv4 addresses.CVE-2026-105483 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-76475 Cisco Cisco Emergency ResponderCross-site scripting lets an attacker run malicious scripts in Cisco Unified Communications web interfacesCVE-2026-76475 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-76474 Cisco Cisco Emergency ResponderImproper authentication flaw allows attacker access to Cisco UC productsCVE-2026-76474 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-76473 Cisco Cisco Emergency ResponderUnauthorized access to Cisco Unified Communications systems via resource control flaw.CVE-2026-76473 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-43736 Apple macOSApp may access sensitive user data on macOSCVE-2026-43736 · 1 storyNot reported exploitedFix available
- CVE-2026-30612 n/aRemote code execution via vulnerable updater in Time4PopcornCVE-2026-30612 · 1 storyNot reported exploitedNo fix in the record
- CVE-2026-93674 IBM Langflow OSSRemote code execution in Langflow OSS via OS command injectionCVE-2026-93674 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-27960 OpenCTI-Platform openctiAttackers can take over an OpenCTI instance via default admin account.CVE-2026-27960 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-0768 LangflowRemote code execution in Langflow via code injectionCVE-2026-0768 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-0769 LangflowUnauthenticated remote code execution via eval injection in Langflow.CVE-2026-0769 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-10134 IBM Langflow OSSUnauthenticated remote code execution in IBM Langflow OSSCVE-2026-10134 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2024-9264 GrafanaSQL Expressions in Grafana allow attackers to execute commands and read filesCVE-2024-9264 · From CISA's listNot reported exploitedFix available
- CVE-2026-7873 IBM Langflow OSSAttackers can execute OS commands and read sensitive files in IBM Langflow OSS.CVE-2026-7873 · From CISA's listNot reported exploitedFix available
- CVE-2026-39980 OpenCTI-Platform openctiArbitrary JavaScript execution on OpenCTI through crafted notifier templatesCVE-2026-39980 · From CISA's listNot reported exploitedNo fix in the record
- CVE-2026-79844 Hewlett Packard Enterprise (HPE) ArubaOS (AOS)Unauthenticated remote code execution and authentication bypass in ArubaOSCVE-2026-79844, CVE-2026-79846, CVE-2026-79847 +4 · 1 storyNot reported exploitedNo fix in the record
- CVE-2026-112900 python-pillow PillowArgument injection in Pillow's Ghostscript call allows remote code executionCVE-2026-112900 · From CISA's listNot reported exploitedFix available
- CVE-2026-110264 GitLabAllows unauthenticated remote code execution in GitLabCVE-2026-110264, CVE-2026-97229 · 2 storiesNot reported exploitedFix available
- CVE-2026-20043 Cisco Cisco Cyber VisionOut-of-bounds write flaws in Snort 3 affect Cisco Cyber VisionCVE-2026-20043 · From CISA's listNot reported exploitedNo fix in the record
From our reporting and the public records: CVE.org, CISA's Known Exploited Vulnerabilities catalog and FIRST's exploit prediction scores. Checked every half hour.