daniele.michelin // security

DE EN IT

ls ~/exploited

Actively exploited vulnerabilities.

According to CISA (Known Exploited Vulnerabilities) these flaws are already used in attacks. Updated daily; the ones that matter in server operations come first.

133 entries in the last 120 days. Patch the ones marked as actively exploited first.

Relevant for server admins

daniele@mikweb: ~/exploited — admin

29 October 2026CVE-2026-97229 · GitLab Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability 28 October 2026CVE-2026-46300 · Linux KernelLinux Kernel Missing Initialization of a Variable Vulnerability 26 October 2026CVE-2026-109619 · PHP Group PHPPHP Stale Internal Request-State Vulnerability 26 October 2026CVE-2026-109618 · PHP Group PHPPHP Memory Corruption Vulnerability 8 October 2026CVE-2016-3081 · Apache StrutsApache Struts Command Injection Vulnerability 18 September 2026CVE-2026-53266 · Linux KernelLinux Kernel Out-of-Bounds Write Vulnerability 18 September 2026CVE-2025-39964 · Linux KernelLinux Kernel Race Condition Vulnerability 18 September 2026CVE-2025-39682 · Linux KernelLinux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability 11 September 2026CVE-2026-85706 · GitLab Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Path Traversal Vulnerability 27 August 2026CVE-2026-53362 · Linux KernelLinux Kernel Unspecified Vulnerability 26 August 2026CVE-2022-0995 · Linux KernelLinux Kernel Out-of-Bounds Write Vulnerability 24 August 2026CVE-2026-21962 · Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-inOracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Latest additions

daniele@mikweb: ~/exploited — ls -t

29 October 2026CVE-2026-76418 · Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability 28 October 2026CVE-2026-41709 · Broadcom VMware ESXBroadcom VMWare ESX Insufficient Logging Vulnerability 27 October 2026CVE-2026-48356 · Adobe Commerce and MagentoAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability 27 October 2026CVE-2026-111497 · Google BrotliGoogle Brotli Unchecked Return Value Vulnerability 23 October 2026CVE-2026-114625 · Arista VeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection Vulnerability 23 October 2026CVE-2026-110447 · Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection Vulnerability 20 October 2026CVE-2026-96656 · Plex Media ServerPlex Media Server External Control of File Name or Path Vulnerability 20 October 2026CVE-2026-96655 · Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability 20 October 2026CVE-2026-96654 · Plex Media ServerPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability 20 October 2026CVE-2026-96652 · Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability 20 October 2026CVE-2026-110936 · Siemens Software CenterSiemens Software Center Uncontrolled Search Path Element Vulnerability 20 October 2026CVE-2026-106931 · EG Secure Solutions SiteGuard Server EditionEG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability 16 October 2026CVE-2026-102764 · BeyondTrust Remote SupportBeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability 16 October 2026CVE-2025-61624 · Fortinet Multiple ProductsFortinet Multiple Products Path Traversal Vulnerability 15 October 2026CVE-2026-21589 · Atlassian Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability 14 October 2026CVE-2026-76519 · Cisco Secure Email GatewayCisco Secure Email Gateway Relative Path Traversal Vulnerability 14 October 2026CVE-2026-105134 · AhsayCBSAhsay AhsayCBS Command Injection Vulnerability 14 October 2026CVE-2026-105133 · AhsayCBSAhsay AhsayCBS Improper Authentication Vulnerability 14 October 2026CVE-2026-0322 · Palo Alto Networks PAN-OSPalo Alto Networks PAN-OS Code Injection Vulnerability 13 October 2026CVE-2026-96951 · Microsoft WindowsMicrosoft Windows Command Injection Vulnerability 13 October 2026CVE-2026-104935 · Ivanti Connect SecureIvanti Connect Secure Authentication Bypass by Spoofing Vulnerability 8 October 2026CVE-2023-22894 · StrapiStrapi Cleartext Storage of Sensitive Information Vulnerability 8 October 2026CVE-2021-3199 · ONLYOFFICE DocsONLYOFFICE Docs Server Path Traversal Vulnerability 8 October 2026CVE-2015-5477 · ISC BIND ISC BIND Data Processing Errors Vulnerability 8 October 2026CVE-2015-3306 · ProFTPDProFTPD Improper Access Control Vulnerability 4 October 2026CVE-2026-88779 · Citrix NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability 2 October 2026CVE-2026-102490 · Zammad GmbH ZammadZammad GmbH Zammad Improper Privilege Management Vulnerability 2 October 2026CVE-2026-102489 · Zammad GmbH ZammadZammad GmbH Zammad Session Fixation Vulnerability 1 October 2026CVE-2026-104286 · Fortinet FortiMailFortinet FortiMail Path Traversal Vulnerability 30 September 2026CVE-2026-76504 · Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Hex Encoding Vulnerability 29 September 2026CVE-2026-86950 · Apple Multiple ProductsApple Multiple Products Out-of-Bounds Write Vulnerability 27 September 2026CVE-2026-88772 · Citrix NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability 27 September 2026CVE-2026-88771 · Citrix NetScalerCitrix NetScaler Improper Input Validation Vulnerability 25 September 2026CVE-2026-87902 · WordPress CoreWordPress Core Remote File Inclusion Vulnerability 25 September 2026CVE-2026-67279 · MikroTik RouterOSMikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability 25 September 2026CVE-2026-65660 · Microsoft SharePointMicrosoft SharePoint Code Injection Vulnerability 24 September 2026CVE-2026-71362 · Adobe Commerce and MagentoAdobe Commerce and Magento Incorrect Authorization Vulnerability 24 September 2026CVE-2026-5430 · WSO2 Multiple ProductsWSO2 Multiple Products Path Traversal Vulnerability 22 September 2026CVE-2026-94127 · F5 BIG-IP APMF5 BIG-IP APM Heap-based Buffer Overflow Vulnerability 22 September 2026CVE-2026-93952 · Arista VeloCloud OrchestratorArista VeloCloud Orchestrator Improper Input Validation Vulnerability

Data: CISA Known Exploited Vulnerabilities Catalog, as of 30 October 2026. No guarantee — always check the vendor's advisory.

vulnerabilities → · Weekly patch radar →