Security tracker
Security tracker: actively exploited critical vulnerabilities
Latest tracked vulnerabilities
Explore vulnerabilities CISA lists as exploited in the wild, selected using our sources and method.
| CVE | Vendor / product | CVSS | KEV added | Ransomware |
|---|---|---|---|---|
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition | 10 | 2026-10-29 | Not reported by CISA |
| CVE-2026-111497 | Google Brotli | 9.2 | 2026-10-27 | Not reported by CISA |
| CVE-2026-48356 | Adobe Commerce and Magento | 9.3 | 2026-10-27 | Not reported by CISA |
| CVE-2026-109618 | PHP Group PHP | 9.2 | 2026-10-26 | Not reported by CISA |
| CVE-2026-109619 | PHP Group PHP | 9.2 | 2026-10-26 | Not reported by CISA |
| CVE-2026-110447 | Collabora Collabora Online – Built-in CODE Server | 9.2 | 2026-10-23 | Not reported by CISA |
| CVE-2026-114625 | Arista VeloCloud Orchestrator | 9.4 | 2026-10-23 | Not reported by CISA |
| CVE-2026-102764 | BeyondTrust Remote Support | 9.3 | 2026-10-16 | Not reported by CISA |
| CVE-2026-21589 | Atlassian Multiple Products | 9.3 | 2026-10-15 | Not reported by CISA |
| CVE-2026-105134 | Ahsay AhsayCBS | 10 | 2026-10-14 | Not reported by CISA |
Sources
CISA Known Exploited Vulnerabilities Catalog, CC0 1.0. No endorsement by CISA. This product uses the NVD API but is not endorsed or certified by the NVD. EPSS scores by FIRST.
Check your own domain's public security settings
The snapshot checks a domain you own or are authorized to check for DNS, HTTPS/TLS and web-header hygiene. It does not test for vulnerabilities in this tracker.