CISA Known Exploited Vulnerabilities

Microsoft Office Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability CVE-2026-124194 Active Openwave Messaging Limited Webtop Media Transcoder Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability CVE-2026-111793 Active Cisco BroadWorks Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability CVE-2026-20320 Active Barracuda Networks Multiple Products Barracuda Networks Multiple Products OS Command Injection Vulnerability CVE-2026-111560 Active Barracuda Networks Barracuda Email Security Gateway (ESG) Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-116606 Active Google Chromium Google Chromium Use-After-Free Vulnerability CVE-2026-125350 Active GPUStack GPUStack GPUStack Improper Authentication Vulnerability CVE-2026-102895 Active OpenBSD OpenSSH OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123158 Active SignalWire FreeSwitch SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-116779 Active IBM Aspera Faspex IBM Aspera Faspex Incorrect Authorization Vulnerability CVE-2026-123218 Active SonicWall SonicOS SSLVPN SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability CVE-2026-19868 Active Apple Multiple Products Apple Multiple Products Improper Authentication Vulnerability CVE-2024-27834 Active WordPress WordPress Core WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability CVE-2026-119977 Past due Ivanti Connect Secure Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability CVE-2026-118527 Active Ivanti Connect Secure Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-111357 Past due GitLab Community Edition and Enterprise Edition GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability CVE-2026-97229 Past due Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability CVE-2026-76418 Past due Broadcom VMware ESX Broadcom VMWare ESX Insufficient Logging Vulnerability CVE-2026-41709 Past due Linux Kernel Linux Kernel Missing Initialization of a Variable Vulnerability CVE-2026-46300 Past due Adobe Commerce and Magento Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48356 Past due Google Brotli Google Brotli Unchecked Return Value Vulnerability CVE-2026-111497 Past due PHP Group PHP PHP Memory Corruption Vulnerability CVE-2026-109618 Past due PHP Group PHP PHP Stale Internal Request-State Vulnerability CVE-2026-109619 Past due Arista VeloCloud Orchestrator Arista VeloCloud Orchestrator SQL Injection Vulnerability CVE-2026-114625 Past due Collabora Collabora Online – Built-in CODE Server Collabora Online – Built-in CODE Server OS Command Injection Vulnerability CVE-2026-110447 Past due EG Secure Solutions SiteGuard Server Edition EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CVE-2026-106931 Past due Plex Media Server Plex Media Server External Control of File Name or Path Vulnerability CVE-2026-96656 Past due Plex Media Server Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96655 Past due Plex Media Server Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96654 Past due Plex Media Server Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96652 Past due Siemens Software Center Siemens Software Center Uncontrolled Search Path Element Vulnerability CVE-2026-110936 Past due BeyondTrust Remote Support BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability CVE-2026-102764 Past due Fortinet Multiple Products Fortinet Multiple Products Path Traversal Vulnerability CVE-2025-61624 Past due Atlassian Multiple Products Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CVE-2026-21589 Past due Ahsay AhsayCBS Ahsay AhsayCBS Command Injection Vulnerability CVE-2026-105134 Past due Cisco Secure Email Gateway Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-76519 Past due Ahsay AhsayCBS Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105133 Past due Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-0322 Past due Ivanti Connect Secure Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability CVE-2026-104935 Past due Microsoft Windows Microsoft Windows Command Injection Vulnerability CVE-2026-96951 Past due ISC BIND ISC BIND Data Processing Errors Vulnerability CVE-2015-5477 Past due Apache Struts Apache Struts Command Injection Vulnerability CVE-2016-3081 Past due Strapi Strapi Strapi Cleartext Storage of Sensitive Information Vulnerability CVE-2023-22894 Past due ONLYOFFICE Docs ONLYOFFICE Docs Server Path Traversal Vulnerability CVE-2021-3199 Past due ProFTPD ProFTPD ProFTPD Improper Access Control Vulnerability CVE-2015-3306 Past due Citrix NetScaler Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-88779 Past due Zammad GmbH Zammad Zammad GmbH Zammad Improper Privilege Management Vulnerability CVE-2026-102490 Past due Zammad GmbH Zammad Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102489 Past due Fortinet FortiMail Fortinet FortiMail Path Traversal Vulnerability CVE-2026-104286 Past due Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability CVE-2026-76504 Past due