CISA says max severity GitLab flaw now exploited in the wild
Severity: CriticalAction: Act nowExploitation: Exploited
Live feed
Requires attention
High-severity developments with a clear action (patch, mitigate or act now), newest first.
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
Severity: HighAction: Patch
Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
Severity: HighAction: Patch
Hitachi Energy CoreTec Product
Severity: HighAction: Mitigate
New Cisco firewall zero-day exploited to crash SSL VPN devices
Severity: CriticalAction: Act nowExploitation: Exploited
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Severity: CriticalAction: Act nowExploitation: ExploitedCISA KEV
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Severity: CriticalAction: Act nowExploitation: ExploitedCISA KEV
Even after PHP2Shell, blast radius matters more than a CVSS score
Severity: HighAction: Patch
Broadcom VMWare ESX Insufficient Logging Vulnerability (CVE-2026-41709) is being actively exploited, CISA warns
Severity: HighAction: PatchExploitation: ExploitedCISA KEV
Hackers Start Probing Fresh Oracle EBS Vulnerability
Severity: CriticalAction: Patch
Beta Channel Update for ChromeOS / ChromeOS Flex
Severity: CriticalAction: Patch
Tailscale warns of SSH flaws allowing root privilege escalation
Severity: HighAction: Patch
HPE Patches Dozens of Critical Flaws in Networking Products
Severity: HighAction: Patch
Google Brotli Unchecked Return Value Vulnerability (CVE-2026-111497) is being actively exploited, CISA warns
Severity: CriticalAction: Act nowExploitation: ExploitedCISA KEV
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48356) is being actively exploited, CISA warns
Severity: CriticalAction: Act nowExploitation: ExploitedCISA KEV
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Severity: CriticalAction: Act nowExploitation: ExploitedCISA KEV
Apple backports CoreGraphics zero-day patches to older iPhones
Severity: CriticalAction: Act nowExploitation: ExploitedCISA KEV
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
Severity: HighAction: PatchExploitation: Exploited
Long Term Support Channel Update for ChromeOS
Severity: CriticalAction: Patch
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
Severity: HighAction: Patch
Microsoft releases emergency .NET patches for critical Brotli flaw
Severity: HighAction: Patch
PHP shares mitigation for new RCE vulnerability with no patch
Severity: HighAction: Patch
HPE patches eight max severity RCE and auth bypass AOS flaws
Severity: HighAction: Patch
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447) is being actively exploited, CISA warns
Severity: CriticalAction: Act nowExploitation: ExploitedCISA KEV
Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625) is being actively exploited, CISA warns
Severity: CriticalAction: Act nowExploitation: ExploitedCISA KEV
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Severity: CriticalAction: Act nowExploitation: Exploited
New Serious PHP Vulnerabilities Released and Patched
Severity: HighAction: Patch
Siemens SIMATIC S7 PLCs Web Server
Severity: CriticalAction: Patch
Siemens PSS(R)SINCAL
Severity: HighAction: Patch
Siemens Industrial Edge Device Kit
Severity: HighAction: Patch