Actively exploited vulnerabilities
Security flaws that attackers are known to be using, from CISA's Known Exploited Vulnerabilities catalog and vendor advisories. Patch these first.
Updated 10 h ago
| Product | CVE | Severity | Patch | CISA deadline | Ransomware | Added |
|---|---|---|---|---|---|---|
| Cisco BroadWorks | CVE-2026-20320 | HIGH · CVSS 7.5 | PATCH AVAILABLE | – | ||
| Microsoft Office | CVE-2026-124194 | MEDIUM · CVSS 6.5 | PATCH AVAILABLE | – | ||
| SonicWall SonicOS SSLVPN | CVE-2026-19868 | HIGH · CVSS 7.5 | PATCH AVAILABLE | – | ||
| Ivanti Connect Secure | CVE-2026-111357 | HIGH · CVSS 7.0 | PATCH AVAILABLE | – | ||
| GitLab Community Edition and Enterprise Edition | CVE-2026-97229 | CRITICAL · CVSS 10.0 | PATCH AVAILABLE | – | ||
| PHP Group PHP | CVE-2026-109619 | CRITICAL · CVSS 9.2 | PATCH AVAILABLE | – | ||
| PHP Group PHP | CVE-2026-109618 | CRITICAL · CVSS 9.2 | PATCH AVAILABLE | – | ||
| BeyondTrust Remote Support | CVE-2026-102764 | CRITICAL · CVSS 9.3 | Not yet | – | ||
| Atlassian Multiple Products | CVE-2026-21589 | CRITICAL · CVSS 9.3 | PATCH AVAILABLE | – |