| CVE-2026-125350Google Chromium Use-After-Free Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV |
8.8High |
| CVE-2026-124194Microsoft Outlook Spoofing Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024 Versions & vendor guidance → |
Known exploitedCISA KEV |
6.5Medium |
| CVE-2026-123218IBM Aspera Faspex Authorization Bypass IBM Aspera Faspex Reported fix guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-123158OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability OpenBSD OpenSSH Versions & vendor guidance → |
Known exploitedCISA KEV |
8.1High |
| CVE-2026-119977WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution WordPress Foundation WordPress Versions & vendor guidance → |
Known exploitedCISA KEV |
8.1High |
| CVE-2026-118527Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Ivanti Connect Secure Versions & vendor guidance → |
Known exploitedCISA KEV |
4.3Medium |
| CVE-2026-116779FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands signalwire freeswitch Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-116606Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway Barracuda Networks Barracuda Email Security Gateway (ESG) Versions & vendor guidance → |
Known exploitedCISA KEV |
9.3Critical |
| CVE-2026-11645Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV |
8.8High |
| CVE-2026-114625Security Advisory 0199 Arista Networks VeloCloud Orchestrator Reported fix guidance → |
Known exploitedCISA KEV |
9.4Critical |
| CVE-2026-111793Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability Openwave Messaging (Ireland) Limited Webtop Media Transcoder Versions & vendor guidance → |
Known exploitedCISA KEV |
4.3Medium |
| CVE-2026-111560OS Command Injection in Barracuda Appliances Barracuda Networks Barracuda Email Security Gateway (ESG), Barracuda Networks Barracuda Load Balancer Application Delivery Controller (ADC), Barracuda Networks Barracuda Web Application Firewall (WAF), Barracuda Networks Barracuda Web Security Gateway (WSG), Barracuda Networks Barracuda Message Archiver (BMA), Barracuda Networks Barracuda WAF Control Center (WCC) Versions & vendor guidance → |
Known exploitedCISA KEV |
8.6High |
| CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder Google Brotli Reported fix guidance → |
Known exploitedCISA KEV |
9.2Critical |
| CVE-2026-111357Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Ivanti Connect Secure Versions & vendor guidance → |
Known exploitedCISA KEV |
7High |
| CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element Vulnerability Siemens Siemens Software Center Versions & vendor guidance → |
Known exploitedCISA KEV |
8.4High |
| CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora Collabora Online - Built-in CODE Server Versions & vendor guidance → |
Known exploitedCISA KEV |
9.2Critical |
| CVE-2026-109619RCE via stale global state PHP Group PHP Reported workaround → |
Known exploitedCISA KEV |
9.2Critical |
| CVE-2026-109618RCE via OOM corruption PHP Group PHP Reported workaround → |
Known exploitedCISA KEV |
9.2Critical |
| CVE-2026-106931EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx, EG Secure Solutions Inc. SiteGuard Server Edition for IIS, EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd on FreeBSD, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx on FreeBSD Versions & vendor guidance → |
Known exploitedCISA KEV |
8.5High |
| CVE-2026-10520Ivanti Sentry OS Command Injection Vulnerability ivanti Sentry Versions & vendor guidance → |
Known exploitedCISA KEV |
10Critical |
| CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection Ahsay AhsayCBS Versions & vendor guidance → |
Known exploitedCISA KEV |
10Critical |
| CVE-2026-105133Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication Ahsay AhsayCBS Versions & vendor guidance → |
Known exploitedCISA KEV |
6.9Medium |
| CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Ivanti Connect Secure Versions & vendor guidance → |
Known exploitedCISA KEV |
8.6High |
| CVE-2026-104286Fortinet FortiMail Path Traversal Vulnerability Fortinet FortiMail Reported fix guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-102895GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin gpustack gpustack Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |