Updated every 5 minutes
Exploited vulnerabilities this week
6 vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) catalog in the last 7 days (since Oct 21, 2026): 6 rated critical (CVSS 9 or higher) and 0 with known ransomware use. KEV means CISA has evidence of exploitation in the wild; it does not mean a zero-day.
| Added to KEV | CVE | Vendor | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|---|
| 2026-10-27 | CVE-2026-48356 | adobe | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 9.3 (v3.1) | 30.6% | 2026-11-10 | Unknown |
| 2026-10-27 | CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability | 9.2 (v4.0) | 55.5% | 2026-11-10 | Unknown | |
| 2026-10-26 | CVE-2026-109618 | php | PHP Memory Corruption Vulnerability | 9.2 (v4.0) | >99.9% | 2026-10-29 | Unknown |
| 2026-10-26 | CVE-2026-109619 | php | PHP Stale Internal Request-State Vulnerability | 9.2 (v4.0) | >99.9% | 2026-10-29 | Unknown |
| 2026-10-23 | CVE-2026-114625 | arista | Arista VeloCloud Orchestrator SQL Injection Vulnerability | 9.4 (v4.0) | 1.0% | 2026-10-26 | Unknown |
| 2026-10-23 | CVE-2026-110447 | collabora | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | 9.2 (v4.0) | 11.6% | 2026-10-26 | Unknown |
Also reported exploited (not yet in KEV)
Security reporting from the last 7 days that describes exploitation of a vulnerability CISA has not listed. Reporting is not primary confirmation; check each source.
- 2026-10-28T10:30:00.000Z: American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
- 2026-10-27T14:40:39.000Z: US government says hackers are now exploiting critical PHP web bugs
- 2026-10-27T13:16:00.000Z: CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
- 2026-10-27T11:49:57.000Z: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
- 2026-10-27T05:30:33.000Z: 71% of vulnerability exploitation starts within a week of disclosure
- 2026-10-23T09:58:34.000Z: Attackers Exploit Third Arista VCO Zero-Day in Four Months
- 2026-10-22T19:05:17.000Z: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
- 2026-10-21T09:01:12.000Z: Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Follow it
RSS feed of known-exploited vulnerabilities · Filter to your stack · Ask your AI assistant · Known exploited by vendor