standard
A CISA database listing software and hardware vulnerabilities confirmed to be actively exploited, used to prioritize patching across government and industry.
No evidence-backed relationships are recorded.
DIVD says an attacker chained two unpublished Zammad bugs from an unauthenticated web session to root on its helpdesk host. Its claim that an autonomous AI agent did it is still a first-party assessment with no independent confirmation yet.
Reality
Cisco confirmed attackers are exploiting CVE-2026-76460, a CVSS 10.0 flaw giving unauthenticated root on Identity Services Engine. ISE decides which devices join the network, so a rooted node hands over every access decision and the device credentials it stores.
Reality
Fortinet confirmed a 9.8-rated, unauthenticated file-write zero-day in FortiMail that attackers are using to drop a reboot-surviving ld.so.preload rootkit. Patching closes the hole but leaves any implant already on the appliance in place.
Reality
Microsoft patched CVE-2026-69730, a CVSS 9.8 remote code execution flaw in the Windows DNS Server role reachable with one unauthenticated packet to port 53. In most Active Directory shops that role runs on the domain controller, so the box answering on port 53 also holds the identity database.
Reality
Horizon3 used Anthropic's Mythos model to find CVE-2026-61500, a chain that forges Rejetto HFS admin sessions and reaches remote code execution. The firm expects frontier models to make deeper, less reliable bug classes worth weaponizing at scale.
Reality
Cisco Talos says three threat clusters are exploiting a CVSS 10.0 pre-auth root bypass and a 5.3 hard-coded credential in Secure Firewall Management Center. A patch policy with a severity cutoff above 5.3 would have skipped the credential fix on the console that pushes policy to every managed firewall.
Reality
Citrix confirmed attackers are exploiting two CVSS 9.5 pre-auth RCE flaws in NetScaler ADC and Gateway, one of them present in default configurations. Self-managed appliances need the fixed build, installed after evidence is saved, since an upgrade can erase signs of intrusion.
Perspective Coverage
3 publishersReality
watchTowr says attackers exploited two remote code execution flaws in Citrix NetScaler ADC and Gateway before any fix existed. The August patch for CVE-2026-19490 fixes a different bug, so every operator now has to decide whether to keep the box online and whether to assume it is breached.
Perspective Coverage
3 publishersReality
The kernel fixed CVE-2026-80521 on August 6. Ubuntu has shipped nothing for 22.04, 24.04 or 26.04, including its AWS, Azure and GCP kernels, and DepthFirst's exploit for 26.04 went public on September 22.
Reality
Ranking by KEV, then EPSS, then CVSS puts a 6.5 with 0.61 exploit odds ahead of a 9.1 at 0.02 in a Dev.to triage guide's worked example. The order is sound, though the backlog savings it promises rest on five hypothetical findings and CVE-wide statistics the post does not source.
Reality
A researcher published a GeoServer SQL injection on 12 August 2026 and watchTowr says probing started within hours. With no fix shipped, access control is the only lever available.
Reality
Hunt.io says one operator brute-forced its way through more than 14,000 internet-exposed cameras in five weeks. The tooling was borrowed; the exposure did the work.
Perspective Coverage
6 publishersReality
CVE-2026-82329 is reported as a pre-auth authentication bypass in JFrog Artifactory's Access microservice, and it reaches every dependency your builds pull from the platform. One publisher, no vendor advisory.
Perspective Coverage
6 publishersReality
CVE-2026-6471 has sat in every PostgreSQL release since 9.4 shipped in 2014. Cyera says the plugin name in a replication slot request reaches dlopen() unvalidated, which makes the fix a privilege audit as much as a patch.
Perspective Coverage
4 publishersReality
CVE-2026-81963 in the Update Stack and CVE-2026-85880 in ALPC each take a low-privilege foothold to SYSTEM, and the remediation guidance asks for verified restarts, which is a harder number to report than install counts.
Reality
Check Point assigned the CVE identifiers and the 9.8 scores itself and shipped fixes on September 9, so there is no outside read on how reachable the bugs are. Customers on R81.10 get neither a hotfix nor Live Patch.
Perspective Coverage
5 publishersReality
cPanel's September 14 advisory covers every LiteSpeed Web Server Enterprise build before 6.3.7. The fix shipped on September 11; because auto-update may lag, administrators have to force it onto servers by hand.
Reality
CVE-2026-86218 lets an unauthenticated attacker run code on an N-central server with no user interaction. N-able fixed it in build 2026.3.1.14 and has already patched its own hosted instances.
Reality
CISA said Sept. 23 that ransomware crews are exploiting CVE-2026-63077, an unauthenticated 9.8 RCE in JetBrains TeamCity patched July 25. Any build server patched late has to be handled as breached, including the credentials and signing keys it held.
Reality
A default self-hosted Artifactory install trusted an empty string as a join key. Because JFrog supports non-expiring tokens, an upgrade can leave a forged administrator token valid.
Reality
Security · September 22, 2026 · 2 publishers
Security · September 23, 2026 · 6 publishers
Build · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Science · September 18, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Build · September 15, 2026 · 2 publishers
Build · September 11, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Build · September 6, 2026 · 1 publisher
Security · September 5, 2026 · 3 publishers
Build · September 5, 2026 · 1 publisher
Security · September 4, 2026 · 1 publisher
Security · September 2, 2026 · 1 publisher
Security · August 31, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Security · August 31, 2026 · 1 publisher
Build · August 30, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Security · August 28, 2026 · 2 publishers
Security · August 27, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Security · August 25, 2026 · 1 publisher
Build · August 17, 2026 · 1 publisher
Security · August 15, 2026 · 2 publishers