Known exploited vulnerabilities
Vulnerabilities CISA has confirmed are being actively exploited. These are the ones to patch first.
- CVE-2026-25089CRITICALadded 2026-07-16due 2026-07-19
Fortinet FortiSandbox OS Command Injection Vulnerability
- CVE-2026-20230HIGHadded 2026-06-25due 2026-06-28
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-20253CRITICALadded 2026-06-18due 2026-06-21
Splunk Enterprise Missing Authentication for Critical Function Vulnerability
- CVE-2026-48907CRITICALadded 2026-06-16due 2026-06-19
Widget Factory Joomla Content Editor Improper Access Control Vulnerability
- CVE-2026-10520CRITICALadded 2026-06-11due 2026-06-14
Ivanti Sentry OS Command Injection Vulnerability
- CVE-2026-11645HIGHadded 2026-06-09due 2026-06-23
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
- CVE-2026-20245HIGHadded 2026-06-09due 2026-06-23
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
- CVE-2026-7473MEDIUMadded 2026-06-09due 2026-06-23
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
- CVE-2026-50751ransomwareCRITICALadded 2026-06-08due 2026-06-11
Check Point Security Gateway Improper Authentication Vulnerability
- CVE-2026-28318HIGHadded 2026-06-05due 2026-06-19
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
- CVE-2025-48595HIGHadded 2026-06-02due 2026-06-05
Android Framework Integer Overflow Vulnerability
- CVE-2024-3400ransomwareCRITICALadded 2024-04-12due 2024-04-19
Palo Alto Networks PAN-OS Command Injection Vulnerability
- CVE-2023-34362ransomwareCRITICALadded 2023-06-02due 2023-06-23
Progress MOVEit Transfer SQL Injection Vulnerability
- CVE-2021-44228ransomwareCRITICALadded 2021-12-10due 2021-12-24
Apache Log4j2 Remote Code Execution Vulnerability