Standard
A U.S. CISA-maintained catalog of vulnerabilities confirmed to be actively exploited, used to prioritize patching across federal agencies and industry.
Cisco Talos counts more than 70,000 CVEs by the end of September, up 105% on a year earlier, while CISA's KEV catalog grew 37%. Its newsletter says the backlog of exploited bugs from older CVEs is where the patching work sits.
Reality
JFrog disclosed an unauthenticated remote code execution flaw in LMCache's multiprocess mode, CVE-2026-105192, rated CVSS 9.8 with no patch. A public proof of concept exists, so any deployment that exposes the cache server to a network needs access limits or the mode turned off.
Reality
Microsoft's October Patch Tuesday fixes CVE-2026-96951, an exploited Windows Shell zero-day rated CVSS 8.8 that strips Mark-of-the-Web from files. A dev.to analysis counts it as the third such bypass this year.
Reality
Progress Software published 31 MarkLogic Server flaws on October 12, five of them critical. The 11.3.6 and 12.0.3 releases that fixed August's 10 flaws are affected. Fixes are in 11.3.7 and 12.1.0.
Reality
Atlassian rates CVE-2026-21589 critical at CVSS 4.0 9.3, a no-login file-read flaw in every version of eight self-hosted products. Honeypots saw exploitation attempts by October 6, a day after the advisory, according to a dev.to write-up that found no public report of confirmed victims.
Reality
Super Forms CVE-2026-17609 (CVSS 9.1) lets unauthenticated visitors recursively delete server directories when file cleanup is enabled. Versions through 6.3.316 are affected, and 6.3.317 fixes it, a dev.to analysis says.
Reality
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishersReality
PaperCut's 27 August 2026 advisory of in-the-wild exploitation hid a pre-auth RCE chain whose first patch, 26.0.4, watchTowr defeated within a day. Operators who patched once and stopped tracking the CVEs may still be reachable without credentials.
Reality
CISA added Zammad's unauthenticated WebSocket session-disclosure flaw, CVE-2026-102489, to its exploited-vulnerabilities catalog on October 2. The fix ships in Zammad 7.2.0, leaving teams on the unsupported 6.5-and-earlier releases to make a major-version jump.
Reality
Microsoft says attackers are exploiting SharePoint flaw CVE-2026-65660, roughly six weeks after it shipped a fix in August. Any server still missing that update should be treated as possibly compromised, checked for webshells and patched.
Perspective Coverage
4 publishersReality
CVE-2026-58231 is an unauthenticated, CVSS 10.0 code execution bug in Commerce Cloud's Data Hub Adapter. Defused says attempts hit its honeypots three days after patch day.
Perspective Coverage
4 publishersReality
CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.
Perspective Coverage
5 publishersReality
Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.
Perspective Coverage
11 publishersReality
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Reality
CVE-2026-58704 is a logic error in the cellular modem that lets an attacker within radio range, already holding basic privileges on the handset, escalate with no user interaction. It is one of 110 fixes in September's Pixel bulletin.
Perspective Coverage
6 publishersReality
CVE-2026-76460 scores a CVSS 10.0, affects Cisco ISE and ISE-PIC in every configuration, and has no workaround. CISA added it to the KEV catalog the day the patches shipped and gave federal agencies three days.
Perspective Coverage
10 publishersReality
One HTTP request to an unauthenticated cluster-join endpoint returns a non-expiring Artifactory admin token, and Fastly logged the volume going from single-digit probes to indiscriminate spraying in five days.
Reality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
Apple patched CoreGraphics flaw CVE-2026-86950 in iOS 26.7.1 after a report that it may have been exploited against targeted iPhone users. iPhone fleets still on iOS 26 have the strongest case for forcing that update before the next scheduled patch window.
Perspective Coverage
9 publishersReality
CISA added Kestra's unauthenticated code-execution flaw CVE-2026-49869, rated 10.0, to its exploited list on 2 September, three months after the fix. Orchestrators hold their workflows' credentials, so any reachable unpatched instance needs a compromise check as well as an upgrade.
Reality
Security · October 1, 2026 · Confirmed9 publishers
Build · September 28, 2026 · Confirmed3 publishers
Security · September 30, 2026 · Confirmed12 publishers
Product · September 14, 2026 · Confirmed3 publishers
Product · September 28, 2026 · Confirmed2 publishers
Security · September 27, 2026 · Confirmed3 publishers
Security · September 23, 2026 · Confirmed2 publishers
Security · August 15, 2026 · Confirmed2 publishers
Security · August 15, 2026 · Confirmed2 publishers
Security · August 19, 2026 · Confirmed2 publishers
Security · August 19, 2026 · Confirmed6 publishers
Security · August 29, 2026 · Confirmed4 publishers
Security · September 4, 2026 · Confirmed4 publishers
Security · September 6, 2026 · Confirmed2 publishers
Security · September 10, 2026 · Confirmed4 publishers
Build · September 10, 2026 · Confirmed2 publishers
Security · September 10, 2026 · Confirmed5 publishers
Security · September 11, 2026 · Confirmed3 publishers
Security · September 15, 2026 · Confirmed2 publishers
Security · September 15, 2026 · Confirmed2 publishers