standard
A U.S. CISA-maintained catalog of vulnerabilities confirmed to be actively exploited, used to prioritize patching across federal agencies and industry.
No evidence-backed relationships are recorded.
Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.
Reality
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
Perspective Coverage
12 publishersReality
Two exploited Citrix NetScaler zero-days and a CVSS 9.8 Cisco SD-WAN Manager flaw top a weekly DACH OT risk bulletin. For many operators, both products enforce segmentation into OT, so an attacker who takes one over is standing in front of the control systems.
Reality
Attackers chained two self-hosted JFrog Artifactory flaws, both patched more than a month before exploitation, to take admin and install backdoor plugins. Either fix breaks the chain, yet on the published tables only release 7.133.28 closes both.
Reality
Fortinet says attackers are exploiting a CVSS 9.8 unauthenticated file-write flaw in FortiMail, and no fixed release has shipped yet. Until builds arrive, its two workarounds are the only protection, including for 7.2 users told to move to a 7.4 branch that is still unpatched.
Perspective Coverage
7 publishersReality
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Perspective Coverage
3 publishersReality
CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.
Perspective Coverage
7 publishersReality
DIVD, the Dutch volunteer disclosure group, was breached through two chained zero-days in its own Zammad helpdesk that took an attacker to root in seconds. Zammad claims over 2,000 customers, and DIVD wants every older install upgraded to version 7 or taken offline.
Perspective Coverage
8 publishersReality
TECH VEDA counts 36 actionable device CVEs across 14 non-kernel packages in September, two of them Chromium V8 bugs on CISA's exploited list. How many apply to a given fleet depends on each image's SBOM and on which scorer a team trusts.
Reality
CISA added Apple's CoreGraphics zero-day CVE-2026-86950 to its KEV catalog, giving federal agencies until October 2, 2026 to patch. Only federal civilian agencies are bound by that date. Every other Apple fleet sets its own deadline for a bug Apple links to targeted attacks.
Perspective Coverage
9 publishersReality
Citrix disclosed eight NetScaler flaws on September 27, two already exploited, with a federal fix deadline three days later. The box holds authentication, remote access, certificates and admin trust, so cleaning up a compromised one means saving evidence first and then invalidating each of them.
Reality
LiteLLM's MCP test endpoints let any valid proxy key run arbitrary commands on the gateway, rated CVSS 8.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.
Reality
CISA added Apple's CoreGraphics out-of-bounds write, CVE-2026-86950, to its KEV catalog with an October 2 deadline for federal agencies. Apple's iOS advisory is dated September 28, so agencies have four days to move iPhones, iPads and Macs onto patched builds.
Reality
Microsoft's record September release fixed up to 997 CVEs, including two local escalations to SYSTEM that attackers used before the patch shipped. A 7.8 score understates the step that turns a phishing foothold into control of the machine, so both go ahead of the 9.8 remote flaws.
Reality
Citrix has fixed two NetScaler ADC and Gateway flaws, each rated 9.5 out of 10, that attackers were exploiting before any patch existed. CISA wants owners to look for signs of compromise first because the update can erase the evidence, so the upgrade comes second.
Reality
Microsoft says attackers are exploiting SharePoint flaw CVE-2026-65660, roughly six weeks after it shipped a fix in August. Any server still missing that update should be treated as possibly compromised, checked for webshells and patched.
Perspective Coverage
5 publishersReality
CVE-2026-76461 lets a crafted email run SQL as root on Cisco Secure Email Gateway, with no workaround and a September 17 federal patch deadline from CISA. Because the trigger is mail parsing, every gateway in the mail path is in scope, whether or not it faces the internet.
Reality
CISA added Linux kernel flaw CVE-2026-53266 to its Known Exploited Vulnerabilities catalog on 18 September 2026. Affected versions and fixed builds come from each distribution's security notice, and a host is protected only once it reboots into the fixed kernel.
Reality
Three exploited flaws, three very different exposure classes. The self-hosted Metabase zero-day is the one with an unpatched population behind it.
Reality
CVE-2026-58231 is an unauthenticated, CVSS 10.0 code execution bug in Commerce Cloud's Data Hub Adapter. Defused says attempts hit its honeypots three days after patch day.
Perspective Coverage
5 publishersReality
Security · August 19, 2026 · 2 publishers
Build · August 26, 2026 · 1 publisher
Build · September 26, 2026 · 1 publisher
Security · August 29, 2026 · 4 publishers
Security · September 6, 2026 · 2 publishers
Security · September 10, 2026 · 4 publishers
Security · September 11, 2026 · 3 publishers
Security · September 15, 2026 · 2 publishers
Security · September 25, 2026 · 2 publishers
Security · September 22, 2026 · 4 publishers
Security · September 22, 2026 · 1 publisher
Build · September 21, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Security · September 15, 2026 · 1 publisher
Security · September 14, 2026 · 1 publisher
Security · September 11, 2026 · 1 publisher
Security · September 11, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher
Security · September 5, 2026 · 4 publishers
Security · September 4, 2026 · 9 publishers
Security · September 5, 2026 · 1 publisher
Leadership · September 5, 2026 · 1 publisher
Security · September 1, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Security · August 21, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher
Security · August 19, 2026 · 1 publisher
Security · August 14, 2026 · 1 publisher