This page tracks the vulnerabilities most actively exploited in the wild right now. Each entry is a CVE added to the CISA Known Exploited Vulnerabilities (KEV) catalog within the last 30 days and confirmed as under active exploitation by our CVE Watchtower. The list is ranked by EPSS score, which estimates the probability of exploitation, alongside CVSS severity. It refreshes automatically throughout the day. If you only have time to patch a few things this month, start here.
Last updated: November 14, 2026 · Source: CISA KEV + Daily CyberSecurity CVE Watchtower
| # | CVE | Vendor / Product | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|---|
| 1 |
CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly…
|
PHP Group PHP | 9.2 | 100.0% | Oct 26, 2026 |
| 2 |
CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts…
|
PHP Group PHP | 9.2 | 100.0% | Oct 26, 2026 |
| 3 |
CVE-2026-111497
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows…
|
Google Brotli | 9.2 | 82.6% | Oct 27, 2026 |
| 4 |
CVE-2026-102764
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of…
|
BeyondTrust Remote Support | 9.3 | 79.5% | Oct 16, 2026 |
| 5 |
CVE-2026-110447
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild…
|
Collabora Collabora Online – Built-in CODE Server | 9.2 | 73.3% | Oct 23, 2026 |
| 6 |
CVE-2026-97229
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4…
|
GitLab Community Edition and Enterprise Edition | 10.0 | 69.3% | Oct 29, 2026 |
| 7 |
CVE-2026-48356
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code…
|
Adobe Commerce and Magento | 9.3 | 47.5% | Oct 27, 2026 |
| 8 |
CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password…
|
OpenBSD OpenSSH | 8.1 | 18.9% | Nov 9, 2026 |
| 9 |
CVE-2026-46300
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach…
|
Linux Kernel | 7.8 | 16.1% | Oct 28, 2026 |
| 10 |
CVE-2026-96652
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL…
|
Plex Media Server | 5.3 | 11.9% | Oct 20, 2026 |
| 11 |
CVE-2026-116606
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a…
|
Barracuda Networks Barracuda Email Security Gateway (ESG) | 9.3 | 10.9% | Nov 10, 2026 |
| 12 |
CVE-2026-96655
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path…
|
Plex Media Server | 5.3 | 10.7% | Oct 20, 2026 |
| 13 |
CVE-2026-111560
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows…
|
Barracuda Networks Multiple Products | 8.6 | 9.1% | Nov 10, 2026 |
| 14 |
CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with…
|
EG Secure Solutions SiteGuard Server Edition | 8.5 | 2.5% | Oct 20, 2026 |
| 15 |
CVE-2026-116779
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that…
|
SignalWire FreeSwitch | 9.8 | 2.5% | Nov 9, 2026 |
Previous 30 days
| # | CVE | Vendor / Product | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|---|
| 1 |
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,…
|
Atlassian Multiple Products | 9.3 | 99.7% | Oct 15, 2026 |
| 2 |
CVE-2015-5477
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service…
|
ISC BIND | 7.5 | 99.6% | Oct 8, 2026 |
| 3 |
CVE-2015-3306
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr…
|
ProFTPD ProFTPD | 10.0 | 99.5% | Oct 8, 2026 |
| 4 |
CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote…
|
Apache Struts | 8.1 | 96.5% | Oct 8, 2026 |
| 5 |
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories.…
|
WordPress Core | 8.1 | 95.8% | Sep 25, 2026 |
| 6 |
CVE-2026-71362
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this…
|
Adobe Commerce and Magento | 9.1 | 91.7% | Sep 24, 2026 |
| 7 |
CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does…
|
Ivanti Connect Secure | 8.6 | 88.9% | Oct 13, 2026 |
| 8 |
CVE-2026-105133
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of…
|
Ahsay AhsayCBS | 6.9 | 84.5% | Oct 14, 2026 |
| 9 |
CVE-2026-88771
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23,…
|
Citrix NetScaler | 9.5 | 82.2% | Sep 27, 2026 |
| 10 |
CVE-2026-105134
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do…
|
Ahsay AhsayCBS | 10.0 | 81.8% | Oct 14, 2026 |
| 11 |
CVE-2026-88772
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS,…
|
Citrix NetScaler | 9.5 | 78.2% | Sep 27, 2026 |
| 12 |
CVE-2026-93616
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point…
|
Check Point Multiple Products | 9.8 | 75.9% | Sep 22, 2026 |
| 13 |
CVE-2026-76460
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.…
|
Cisco Identity Services Engine | 10.0 | 75.6% | Sep 16, 2026 |
| 14 |
CVE-2026-85102
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to…
|
Check Point Multiple Products | 9.8 | 54.2% | Sep 22, 2026 |
| 15 |
CVE-2026-102489
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad…
|
Zammad GmbH Zammad | 8.7 | 49.9% | Oct 2, 2026 |
Frequently Asked Questions
What does “actively exploited” mean?
It means attackers are using the vulnerability in real-world attacks right now, not just in theory. Confirmation comes from the CISA KEV catalog and our own CVE Watchtower tracking.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is a list maintained by the U.S. Cybersecurity and Infrastructure Security Agency. It only includes CVEs with reliable evidence of exploitation in the wild, which makes it a strong patching baseline for any organization.
What is an EPSS score?
EPSS (Exploit Prediction Scoring System) estimates the probability that a vulnerability will be exploited within the next 30 days. A score of 90% means very high likelihood. We rank this list by EPSS because it reflects real-world risk better than severity alone.
How is this different from CVSS?
CVSS measures how severe a vulnerability could be if exploited. EPSS measures how likely exploitation actually is. A flaw can be critical on paper but rarely attacked, or moderate on paper yet heavily abused. We show both so defenders can prioritize correctly.
How often is this page updated?
The list refreshes automatically several times a day from the CISA KEV feed and our CVE Watchtower database. The “Last updated” line above the table shows the most recent refresh.
Should I patch everything on this list?
Yes, treat every entry as a priority. These CVEs are confirmed under active exploitation, so the usual “wait and assess” approach does not apply. If a patch is unavailable, apply the vendor’s mitigations immediately.
Can I cite or link to this list?
Yes. This page is free to reference in reports, advisories, and articles. Please credit Daily CyberSecurity and link back to this page so readers always see the current data.