Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-46300 Exploited |
Not yet scored | Linux Kernel Applications & supply chain |
Linux Kernel Missing Initialization of a Variable Vulnerability | 28 Oct 2026 |
| CVE-2026-109618 Exploited |
Not yet scored | PHP Group PHP Applications & supply chain |
PHP Memory Corruption Vulnerability | 26 Oct 2026 |
| CVE-2026-109619 Exploited |
Not yet scored | PHP Group PHP Applications & supply chain |
PHP Stale Internal Request-State Vulnerability | 26 Oct 2026 |
| CVE-2026-114625 Exploited |
Not yet scored | Arista VeloCloud Orchestrator Applications & supply chain |
Arista VeloCloud Orchestrator SQL Injection Vulnerability | 23 Oct 2026 |
| CVE-2026-96654 Exploited |
Not yet scored | Plex Media Server Applications & supply chain |
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 20 Oct 2026 |
| CVE-2026-21589 Exploited |
Not yet scored | Atlassian Multiple Products Applications & supply chain |
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 15 Oct 2026 |
| CVE-2026-105133 Exploited |
Not yet scored | Ahsay AhsayCBS Applications & supply chain |
Ahsay AhsayCBS Improper Authentication Vulnerability | 14 Oct 2026 |
| CVE-2026-105134 Exploited |
Not yet scored | Ahsay AhsayCBS Applications & supply chain |
Ahsay AhsayCBS Command Injection Vulnerability | 14 Oct 2026 |
| CVE-2026-87902 Exploited |
Not yet scored | WordPress Core Applications & supply chain |
WordPress Core Remote File Inclusion Vulnerability | 25 Sep 2026 |
| CVE-2026-87886 Exploited |
Not yet scored | Acronis Backup Applications & supply chain |
Acronis Backup Incorrect Default Permissions Vulnerability | 16 Sep 2026 |
| CVE-2026-85706 Exploited |
Not yet scored | GitLab Community Edition and Enterprise Edition Applications & supply chain |
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | 11 Sep 2026 |
| CVE-2026-75650 Exploited |
Not yet scored | Adobe Commerce and Magento Applications & supply chain |
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 8 Sep 2026 |
| CVE-2026-82078 Exploited |
Not yet scored | PaperCut NG/MF Applications & supply chain |
PaperCut NG/MF Unsafe Reflection Vulnerability | 31 Aug 2026 |
| CVE-2026-60004 Exploited |
Not yet scored | Gitea Gitea Applications & supply chain |
Gitea Code Injection Vulnerability | 25 Aug 2026 |
| CVE-2026-72898 Exploited |
Not yet scored | Metabase Metabase Applications & supply chain |
Metabase SQL Injection Vulnerability | 11 Aug 2026 |
| CVE-2026-60137 Exploited |
Not yet scored | WordPress Core Applications & supply chain |
WordPress Core SQL Injection Vulnerability | 21 Jul 2026 |
| CVE-2026-63030 Exploited |
Not yet scored | WordPress Core Applications & supply chain |
WordPress Core Interpretation Conflict Vulnerability | 21 Jul 2026 |
| CVE-2026-48939 Exploited |
Not yet scored | iCagenda iCagenda Applications & supply chain |
iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability | 10 Jul 2026 |
| CVE-2026-48908 Exploited |
Not yet scored | JoomShaper SP Page Builder Applications & supply chain |
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability | 7 Jul 2026 |
| CVE-2026-48907 Exploited |
Not yet scored | Widget Factory Joomla Content Editor Applications & supply chain |
Widget Factory Joomla Content Editor Improper Access Control Vulnerability | 16 Jun 2026 |
| CVE-2026-45247 Exploited |
Not yet scored | Mirasvit Mirasvit Full Page Cache Warmer Applications & supply chain |
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability | 3 Jun 2026 |
| CVE-2026-48172 Exploited |
Not yet scored | LiteSpeed cPanel Plugin Applications & supply chain |
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability | 26 May 2026 |
| CVE-2026-9082 Exploited |
Not yet scored | Drupal Core Applications & supply chain |
Drupal Core SQL Injection Vulnerability | 22 May 2026 |
| CVE-2026-42208 Exploited |
Not yet scored | BerriAI LiteLLM Applications & supply chain |
BerriAI LiteLLM SQL Injection Vulnerability | 8 May 2026 |
| CVE-2026-41940 Exploited |
Not yet scored | WebPros cPanel & WHM and WP2 (WordPress Squared) Applications & supply chain |
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability | 30 Apr 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.