This page tracks the vulnerabilities most actively exploited in the wild right now. Each entry is a CVE added to the CISA Known Exploited Vulnerabilities (KEV) catalog within the last 30 days and confirmed as under active exploitation by our CVE Watchtower. The list is ranked by EPSS score, which estimates the probability of exploitation, alongside CVSS severity. It refreshes automatically throughout the day. If you only have time to patch a few things this month, start here.
Last updated: October 20, 2026 · Source: CISA KEV + Daily CyberSecurity CVE Watchtower
| # | CVE | Vendor / Product | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|---|
| 1 |
CVE-2015-3306
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr…
|
ProFTPD ProFTPD | 10.0 | 99.5% | Oct 8, 2026 |
| 2 |
CVE-2015-5477
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service…
|
ISC BIND | 7.5 | 99.4% | Oct 8, 2026 |
| 3 |
CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote…
|
Apache Struts | 8.1 | 96.1% | Oct 8, 2026 |
| 4 |
CVE-2026-71362
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this…
|
Adobe Commerce and Magento | 9.1 | 87.5% | Sep 24, 2026 |
| 5 |
CVE-2026-93616
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point…
|
Check Point Multiple Products | 9.8 | 75.9% | Sep 22, 2026 |
| 6 |
CVE-2026-85102
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to…
|
Check Point Multiple Products | 9.8 | 50.4% | Sep 22, 2026 |
| 7 |
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories.…
|
WordPress Core | 8.1 | 40.0% | Sep 25, 2026 |
| 8 |
CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does…
|
Ivanti Connect Secure | 8.6 | 26.0% | Oct 13, 2026 |
| 9 |
CVE-2021-3199
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used,…
|
ONLYOFFICE Docs | 9.8 | 20.1% | Oct 8, 2026 |
| 10 |
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,…
|
Atlassian Multiple Products | 9.3 | 12.7% | Oct 15, 2026 |
| 11 |
CVE-2026-105134
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do…
|
Ahsay AhsayCBS | 10.0 | 4.8% | Oct 14, 2026 |
| 12 |
CVE-2023-22894
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query…
|
Strapi Strapi | 4.9 | 3.6% | Oct 8, 2026 |
| 13 |
CVE-2026-7273
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated…
|
Zyxel GS1900 Series Switches | 8.8 | 2.5% | Sep 21, 2026 |
| 14 |
CVE-2026-94127
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can…
|
F5 BIG-IP APM | 9.8 | 2.2% | Sep 22, 2026 |
| 15 |
CVE-2026-104286
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail…
|
Fortinet FortiMail | 9.8 | 2.2% | Oct 1, 2026 |
Previous 30 days
| # | CVE | Vendor / Product | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|---|
| 1 |
CVE-2026-85706
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before…
|
GitLab Community Edition and Enterprise Edition | 10.0 | 93.0% | Sep 11, 2026 |
| 2 |
CVE-2026-20079
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker…
|
Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 10.0 | 88.2% | Sep 9, 2026 |
| 3 |
CVE-2026-81578
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated…
|
PaperCut NG/MF | 8.8 | 85.6% | Aug 31, 2026 |
| 4 |
CVE-2021-23758
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary…
|
Ajax.NET Professional Ajax.NET Professional | 8.1 | 82.6% | Aug 26, 2026 |
| 5 |
CVE-2026-82078
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application…
|
PaperCut NG/MF | 9.4 | 63.5% | Aug 31, 2026 |
| 6 |
CVE-2019-1068
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft…
|
Microsoft SQL Server | 8.8 | 57.9% | Aug 26, 2026 |
| 7 |
CVE-2026-85046
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the…
|
Google Chromium V8 | 8.8 | 48.9% | Sep 4, 2026 |
| 8 |
CVE-2023-49105
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication…
|
ownCloud ownCloud | 9.8 | 42.9% | Aug 27, 2026 |
| 9 |
CVE-2026-21962
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy…
|
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | 10.0 | 42.5% | Aug 24, 2026 |
| 10 |
CVE-2026-76461
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote…
|
Cisco Secure Email Gateway | 9.8 | 29.5% | Sep 14, 2026 |
| 11 |
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
|
Gitea Gitea | 9.8 | 24.0% | Aug 25, 2026 |
| 12 |
CVE-2026-19490
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21;…
|
Citrix NetScaler | 9.3 | 23.2% | Sep 9, 2026 |
| 13 |
CVE-2026-9586
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly…
|
Sangoma Switchvox | 9.3 | 19.0% | Sep 2, 2026 |
| 14 |
CVE-2026-82329
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain…
|
JFrog Artifactory | 9.8 | 14.1% | Sep 2, 2026 |
| 15 |
CVE-2026-76460
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.…
|
Cisco Identity Services Engine | 10.0 | 14.0% | Sep 16, 2026 |
Frequently Asked Questions
What does “actively exploited” mean?
It means attackers are using the vulnerability in real-world attacks right now, not just in theory. Confirmation comes from the CISA KEV catalog and our own CVE Watchtower tracking.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is a list maintained by the U.S. Cybersecurity and Infrastructure Security Agency. It only includes CVEs with reliable evidence of exploitation in the wild, which makes it a strong patching baseline for any organization.
What is an EPSS score?
EPSS (Exploit Prediction Scoring System) estimates the probability that a vulnerability will be exploited within the next 30 days. A score of 90% means very high likelihood. We rank this list by EPSS because it reflects real-world risk better than severity alone.
How is this different from CVSS?
CVSS measures how severe a vulnerability could be if exploited. EPSS measures how likely exploitation actually is. A flaw can be critical on paper but rarely attacked, or moderate on paper yet heavily abused. We show both so defenders can prioritize correctly.
How often is this page updated?
The list refreshes automatically several times a day from the CISA KEV feed and our CVE Watchtower database. The “Last updated” line above the table shows the most recent refresh.
Should I patch everything on this list?
Yes, treat every entry as a priority. These CVEs are confirmed under active exploitation, so the usual “wait and assess” approach does not apply. If a patch is unavailable, apply the vendor’s mitigations immediately.
Can I cite or link to this list?
Yes. This page is free to reference in reports, advisories, and articles. Please credit Daily CyberSecurity and link back to this page so readers always see the current data.