Exploited Right Now
Every few days CISA, the US government’s cyber-defence agency, adds bugs to a list called Known Exploited Vulnerabilities. A bug only gets on that list when there is evidence attackers are already using it. Not “could be exploited”. Is being exploited.
This page pulls that list straight from CISA and refreshes it every 15 minutes, newest first. A mint bar on the left marks anything added in the last seven days.
| Added | CVE | Vendor · product | What it is | Fix by* |
|---|---|---|---|---|
| 2026-11-04 | CVE-2024-27834 | Apple · Multiple Products | Improper Authentication | 2026-11-18 |
| 2026-11-03 | CVE-2026-119977 | WordPress · WordPress Core | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-11-06 |
| 2026-10-30 | CVE-2026-118527 | Ivanti · Connect Secure | Generation of Predictable Numbers or Identifiers | 2026-11-13 |
| 2026-10-30 | CVE-2026-111357 | Ivanti · Connect Secure | Missing Authentication for Critical Function | 2026-11-02 |
| 2026-10-29 | CVE-2026-97229 | GitLab · Community Edition and Enterprise Edition | Integer Overflow or Wraparound | 2026-11-01 |
| 2026-10-29 | CVE-2026-76418 | Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software | Unchecked Return Value to NULL Pointer Dereference | 2026-11-01 |
| 2026-10-28 | CVE-2026-46300 | Linux · Kernel | Missing Initialization of a Variable | 2026-10-31 |
| 2026-10-28 | CVE-2026-41709 | Broadcom · VMware ESX | Insufficient Logging | 2026-11-11 |
| 2026-10-27 | CVE-2026-48356 | Adobe · Commerce and Magento | Unrestricted Upload of File with Dangerous Type | 2026-11-10 |
| 2026-10-27 | CVE-2026-111497 | Google · Brotli | Unchecked Return Value | 2026-11-10 |
| 2026-10-26 | CVE-2026-109619 | PHP Group · PHP | Stale Internal Request-State | 2026-10-29 |
| 2026-10-26 | CVE-2026-109618 | PHP Group · PHP | Memory Corruption | 2026-10-29 |
| 2026-10-23 | CVE-2026-114625 | Arista · VeloCloud Orchestrator | SQL Injection | 2026-10-26 |
| 2026-10-23 | CVE-2026-110447 | Collabora · Collabora Online – Built-in CODE Server | Online – Built-in CODE Server OS Command Injection | 2026-10-26 |
| 2026-10-20 | CVE-2026-96656 | Plex · Media Server | External Control of File Name or Path | 2026-10-23 |
| 2026-10-20 | CVE-2026-96655 | Plex · Media Server | Server-Side Request Forgery (SSRF) | 2026-11-03 |
| 2026-10-20 | CVE-2026-96654 | Plex · Media Server | Improper Neutralization of Encoded URI Schemes in a Web Page | 2026-10-23 |
| 2026-10-20 | CVE-2026-96652 | Plex · Media Server | Server-Side Request Forgery (SSRF) | 2026-11-03 |
| 2026-10-20 | CVE-2026-110936 | Siemens · Software Center | Uncontrolled Search Path Element | 2026-11-03 |
| 2026-10-20 | CVE-2026-106931 | EG Secure Solutions · SiteGuard Server Edition | OS Command Injection | 2026-10-23 |
| 2026-10-16 | CVE-2026-102764 | BeyondTrust · Remote Support | Authentication Bypass by Spoofing | 2026-10-19 |
| 2026-10-16 | CVE-2025-61624 | Fortinet · Multiple Products | Path Traversal | 2026-10-19 |
| 2026-10-15 | CVE-2026-21589 | Atlassian · Multiple Products | Files or Directories Accessible to External Parties | 2026-10-18 |
| 2026-10-14 | CVE-2026-76519 | Cisco · Secure Email Gateway | Relative Path Traversal | 2026-10-17 |
| 2026-10-14 | CVE-2026-105134 | Ahsay · AhsayCBS | Command Injection | 2026-10-17 |
| 2026-10-14 | CVE-2026-105133 | Ahsay · AhsayCBS | Improper Authentication | 2026-10-17 |
| 2026-10-14 | CVE-2026-0322 | Palo Alto Networks · PAN-OS | Code Injection | 2026-10-17 |
| 2026-10-13 | CVE-2026-96951 | Microsoft · Windows | Command Injection | 2026-10-16 |
| 2026-10-13 | CVE-2026-104935 | Ivanti · Connect Secure | Authentication Bypass by Spoofing | 2026-10-16 |
| 2026-10-08 | CVE-2023-22894 | Strapi · Strapi | Cleartext Storage of Sensitive Information | 2026-10-11 |
| 2026-10-08 | CVE-2021-3199 | ONLYOFFICE · Docs | Server Path Traversal | 2026-10-11 |
| 2026-10-08 | CVE-2016-3081 | Apache · Struts | Command Injection | 2026-10-11 |
| 2026-10-08 | CVE-2015-5477 | ISC · BIND | Data Processing Errors | 2026-10-11 |
| 2026-10-08 | CVE-2015-3306 | ProFTPD · ProFTPD | Improper Access Control | 2026-10-11 |
* “Fix by” is the deadline CISA sets for US federal agencies. Everyone else should treat it as a strong hint. Data: CISA Known Exploited Vulnerabilities catalog v2026.11.04 (1768 entries in total), checked . Full catalog: cisa.gov.
How to use it
- Scan the vendor column for anything you run, at home or at work. Routers, VPNs, firewalls, NAS boxes, email gateways and remote-support tools turn up again and again.
- Found a match? Click the CVE for the details, then apply the vendor’s fix. “Fix by” is the deadline CISA gives US federal agencies; it is a sensible deadline for you too.
- Red “ransomware” tag means a ransomware group has been seen using that bug. Those go to the front of the queue.
- Can’t patch yet? Take the device off the internet, or put it behind a VPN, until you can.
If the same vendor shows up three times in a month, that isn’t bad luck. Somebody has made a hobby of them. Patch, then maybe start shopping. — Nyx
The news behind these
The Open Tabs page carries the stories, with a short note from Nova on each and a link to the original. It also has a live headline strip that updates every 15 minutes.
Open Tabs RSS · Everything RSS · Follow on Feedly
Want to see exploitation up close, safely?
Build the isolated attack range first: a Kali VM and a deliberately vulnerable target on a network with no way out. Everything offensive on StashGrid happens there, never against systems you don’t own.
Data comes from CISA’s public Known Exploited Vulnerabilities catalog (US government work, free to reuse), with CISA’s own copy on GitHub as a backup source. The table is generated automatically and nothing in it is edited by hand. If something looks wrong, check the CVE link and tell me.