Threat level Elevated
Contact

· Vulnerability feed · live

CVE feed

Aggregated from NVD and the CISA Known Exploited Vulnerabilities catalog, updated every 30 minutes. Scores use CVSS v3.1 where published.

RSS feed

Top vendors, 2026 year to date

2,055 published, 121 exploited
WeekMonthYear
  1. Google146 CVEs4 exploited
  2. Microsoft89 CVEs11 exploited
  3. Apache83 CVEs1 exploited
  4. Oracle71 CVEs2 exploited
  5. ThemeREX66 CVEs
  6. HPE58 CVEs
  7. IBM52 CVEs1 exploited
  8. TOTOLINK44 CVEs
  9. Adobe39 CVEs4 exploited
  10. Mozilla32 CVEs
  11. Cisco29 CVEs8 exploited
  12. Wavlink26 CVEs
  13. Linux25 CVEs3 exploited
  14. Dell18 CVEs
  15. Hitachi18 CVEs
  16. Juniper Networks17 CVEs
  17. Progress Software15 CVEs1 exploited
  18. Apple14 CVEs2 exploited
  19. Red Hat14 CVEs
  20. Splunk12 CVEs

Most exploited: Microsoft 11Cisco 8Fortinet 6all 121 exploited

Filters
Severity
Status
Newly exploitedAdded to KEV, last 7 days4Added to KEV, last 30 days34
Vendor
121 results 2026 year to dateActively exploited (KEV) Sort:NewestExploited firstLikely exploitedCVSS
4.3Ivanti Connect Secure — Generation of Predictable Numbers or Identifiers.ExploitedEPSS 0.8%8.1WordPress WordPress Core — Time-of-check Time-of-use (TOCTOU) Race Condition.ExploitedEPSS 1.2%8.6Cisco Secure Firewall ASA Software and Cisco Secure FTD Software — Unchecked Return Value to NULL Pointer Dereference.ExploitedEPSS 0.8%9.9Arista VeloCloud Orchestrator — SQL Injection.ExploitedEPSS 1.0%9.8Google Brotli — Unchecked Return Value.ExploitedEPSS 83%9.8PHP Group PHP — PHP Memory Corruption.ExploitedEPSS 99.9%8.1PHP Group PHP — PHP Stale Internal Request-State.ExploitedEPSS 99.9%7.0Ivanti Connect Secure — Missing Authentication for Critical Function.ExploitedEPSS 0.5%9.8BeyondTrust Remote Support — Authentication Bypass by Spoofing.ExploitedEPSS 78%6.7Siemens Software Center — Uncontrolled Search Path Element.ExploitedEPSS 1.0%7.2Palo Alto Networks PAN-OS — Code Injection.ExploitedEPSS 1.7%9.8Cisco Secure Email Gateway — Relative Path Traversal.ExploitedEPSS 2.2%8.5EG Secure Solutions SiteGuard Server Edition — OS Command Injection.ExploitedEPSS 2.5%9.8Collabora Collabora Online – Built-in CODE Server — Online – Built-in CODE Server OS Command Injection.ExploitedEPSS 73%8.8Microsoft Windows — Command Injection.ExploitedEPSS 9.8%8.6Ivanti Connect Secure — Authentication Bypass by Spoofing.ExploitedEPSS 89%10.0GitLab Community Edition and Enterprise Edition — Integer Overflow or Wraparound.ExploitedEPSS 65%7.5Atlassian Multiple Products — Files or Directories Accessible to External Parties.ExploitedEPSS 99.6%7.3Ahsay AhsayCBS — Improper Authentication.ExploitedEPSS 79%10.0Ahsay AhsayCBS — Command Injection.ExploitedEPSS 82%7.5Citrix NetScaler — Improper Restriction of Operations within the Bounds of a Memory Buffer.ExploitedEPSS 11%9.8Fortinet FortiMail — Path Traversal.ExploitedEPSS 4.6%9.8Zammad GmbH Zammad — Session Fixation.ExploitedEPSS 22%7.8Zammad GmbH Zammad — Improper Privilege Management.ExploitedEPSS 11%9.8Cisco Catalyst SD-WAN Manager — Hex Encoding.ExploitedEPSS 39%