Exploited List
A tracked vulnerabilities dataset for our cybersecurity coverage: what it measures, where the figures come from and when they were last checked.
Microsoft's October 2026 Patch Tuesday Sets Record with 1,411 CVEs
Microsoft released a record 1,411 CVEs in October 2026, including three actively exploited zero days, driven by AI-powered scanning.
Ivanti Connect Secure zero-day chain exploited by UTA0576
Threat actor UTA0576 chained three zero-day flaws, including an unpatched privilege escalation, to achieve unauthenticated root access on fully...
Pwn2Own Ireland 2026 reveals six Samsung Galaxy S26 zero-day hacks
Security researchers earned $232,500 exploiting 45 zero-days on day two of Pwn2Own Ireland 2026, with Samsung's flagship phone hacked six times in 48...
Anthropic expands Cyber Verification Program with reduced AI safeguards
Anthropic has expanded its Cyber Verification Program, offering vetted cybersecurity professionals reduced safeguards on advanced AI models like...
FBI Top 10 Cybercriminal Aguirre Faces U.S. ATM Jackpotting Charges
Anibal Alexander Canelon Aguirre, the first cybercriminal on the FBI's Top 10 Most Wanted list, is in U.S. custody to face charges for masterminding...
ClingSTUN malware exploits 24 IoT flaws via STUN protocol
A new Linux backdoor named ClingSTUN hijacks internet-facing IoT devices by exploiting two dozen known, unpatched vulnerabilities.
Fortra patches critical BoKS vulnerabilities
Fortra has released patches for eight vulnerabilities in its BoKS Privileged Access Manager, three of which are critical.
AI-Discovered Vulnerabilities Exploitation Accelerates
Five threat clusters exploited a critical remote code execution flaw in BeyondTrust products within a week of its disclosure.
Xint DARPA AI Security Tool Exposes Critical Signal Flaws
A DARPA-backed AI security startup, Xint, identified three critical vulnerabilities in Signal's Android app during a one-hour scan.
NetScaler CVE-2026-88771 and CVE-2026-88772 Exploited
Two critical Citrix NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are being actively exploited in zero-day attacks to deploy...
Citrix NetScaler zero-day remote code execution flaws exploited
Two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway appliances are under active exploitation.
Salesforce Agentforce Zero-Click Vulnerabilities Enable Data Exfiltration
Zenity Labs disclosed three critical zero-click vulnerabilities in Salesforce Agentforce, collectively named SalesBleed.
F5 Patches Critical BIG-IP APM Zero-Day Exploited for RCE
F5 has released hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in BIG-IP APM. The flaw, a heap-based buffer overflow with a CVSS...
Check Point Zero-Day Exploited in Targeted July Attacks
Check Point has disclosed that a critical zero-day vulnerability in its Security Management Server was exploited in targeted attacks in July.
Siemba automates IDOR testing for production APIs
Siemba has launched automated testing for insecure direct object reference (IDOR) vulnerabilities in REST, GraphQL, and SOAP APIs.
CISA Adds Three Exploited Linux Kernel Flaws to KEV Catalog
The U.S. Cybersecurity agency CISA has mandated patching for three actively exploited Linux kernel vulnerabilities.
BlueMoon Exploit Kit Chains Chrome, Windows Zero-Days
A new exploit kit called BlueMoon, which chains three recent zero-day vulnerabilities in Chrome and Windows, has been rapidly adopted by multiple...
CISA Director Warns of Critical Vulnerabilities and Technical Debt
Acting CISA Director Nick Andersen warns that decades of bad decisions and overwhelming technical debt have left the U.S.
Adobe Patches Critical Commerce Zero-Day Among 170 Flaws
Adobe has released patches for over 170 security flaws, including an urgent fix for a critical, actively exploited zero-day in Adobe Commerce and...
Microsoft Patches Record 974 Flaws, Two Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two Windows zero-days under active exploitation. The U.S.
MikroTik RouterOS SSH Flaws Enable Full Device Hijack
CERT Polska discovered six RouterOS vulnerabilities, two of which allow unauthenticated full device control via SSH.
Anthropic's Claude Mythos finds 23,000 bugs
Anthropic's Claude Mythos Preview AI identified over 23,000 potential vulnerabilities in open-source projects.
Unpatched Magento Zero-Day Exploited to Backdoor Stores
Attackers are exploiting an unpatched critical vulnerability in Magento Open Source and Adobe Commerce, installing persistent backdoors.
Elementor Pro Plugin Vulnerability Actively Exploited
A critical vulnerability in the Elementor Pro WordPress plugin is being exploited to upload malicious PHP files, allowing attackers to compromise...