CVEs & Actively Exploited Vulnerabilities News

385 stories · Updated every 5 minutes · Page 3 of 10

1. Citrix NetScaler vulnerabilities being actively exploited

   IT Pro · 29 Sep 2026, 18:16 IST · Critical severity

   Citrix NetScaler vulnerabilities being actively exploited

2. Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)

   Help Net Security · 29 Sep 2026, 15:20 IST · Critical severity

   Apple has shipped iOS and macOS security updates to fix an actively exploited zero-day vulnerability (CVE-2026-86950) in the operating systems’ Core Graphics framework. “Apple is aware of a report that this issue may have been exploited...

3. Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950), (Mon, Sep 28th)

   SANS Internet Storm Center · 29 Sep 2026, 03:34 IST · Medium severity

   Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited.

4. Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild

   Palo Alto Unit 42 · 28 Sep 2026, 20:32 IST · Medium severity

   Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited...

5. OTX Threat: ShinyHunters Exploits Oracle PeopleSoft Vulnerability CVE-2026-35273 in New Attack Wave

   AlienVault OTX · 28 Sep 2026, 16:05 IST · Medium severity

   ShinyHunters Exploits Oracle PeopleSoft Vulnerability CVE-2026-35273 in New Attack Wave CVEs: CVE-2026-35273

6. Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

   Help Net Security · 28 Sep 2026, 15:21 IST · Critical severity

   Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells on compromised devices....

7. CISA KEV: CVE-2026-88771 — Citrix NetScaler actively exploited

   CISA KEV · 27 Sep 2026, 05:30 IST · Critical severity

   Citrix NetScaler Improper Input Validation Vulnerability. Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. Required...

8. CISA KEV: CVE-2026-88772 — Citrix NetScaler actively exploited

   CISA KEV · 27 Sep 2026, 05:30 IST · Critical severity

   Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability. Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer...

9. Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

   SecurityWeek · 27 Sep 2026, 14:53 IST · Medium severity

   CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28. The post Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks appeared first on SecurityWeek .

10. SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

    The Hacker News · 26 Sep 2026, 14:19 IST · Critical severity

    Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active...

11. CISA KEV: CVE-2026-87902 — WordPress Core actively exploited

    CISA KEV · 25 Sep 2026, 05:30 IST · Critical severity

    WordPress Core Remote File Inclusion Vulnerability. WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file...

12. Attackers Target Unpatched Roundcube Servers With CVE-2026-48842

    TechRepublic · 25 Sep 2026, 23:24 IST · Medium severity

    Attackers are exploiting CVE-2026-48842 against unpatched Roundcube servers months after a fix was released, raising urgency for organizations to update. The post Attackers Target Unpatched Roundcube Servers With CVE-2026-48842 appeared...

13. WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution

    TechRepublic · 25 Sep 2026, 17:34 IST · Critical severity

    Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. The post WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution appeared first on TechRepublic .

14. CISA KEV: CVE-2026-65660 — Microsoft SharePoint actively exploited

    CISA KEV · 25 Sep 2026, 05:30 IST · Critical severity

    Microsoft SharePoint Code Injection Vulnerability. Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Required action: Apply mitigations in accordance...

15. CISA KEV: CVE-2026-67279 — MikroTik RouterOS actively exploited

    CISA KEV · 25 Sep 2026, 05:30 IST · Critical severity

    Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability. Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel...

16. Only 26% of Detected CISA Known Exploited Vulnerabilities Were Fully Remediated

    HackRead · 25 Sep 2026, 18:14 IST

    A recent Verizon study found that vulnerability exploitation became the most common initial access vector, appearing in 31%…

17. Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

    The Hacker News · 25 Sep 2026, 15:44 IST · Critical severity

    The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL...

18. CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2

    Hacker News · 25 Sep 2026, 12:33 IST · Medium severity

19. CISA KEV: CVE-2026-71362 — Adobe Commerce and Magento actively exploited

    CISA KEV · 24 Sep 2026, 05:30 IST · Critical severity

    Adobe Commerce and Magento Incorrect Authorization Vulnerability . Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to...

20. CISA KEV: CVE-2026-5430 — WSO2 Multiple Products actively exploited

    CISA KEV · 24 Sep 2026, 05:30 IST · Critical severity

    WSO2 Multiple Products Path Traversal Vulnerability . WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code...

21. Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

    The Hacker News · 24 Sep 2026, 11:06 IST · Critical severity

    Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to...

22. Arista patches actively exploited VeloCloud Orchestrator zero-day

    BleepingComputer · 23 Sep 2026, 17:59 IST · Critical severity

    Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments.

23. WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

    Help Net Security · 23 Sep 2026, 14:31 IST · Medium severity

    WordPress released version 7.1.2 to fix a critical flaw that lets an unauthenticated attacker make the software load a PHP file of the attacker’s choosing from outside the site’s active theme folders. On sites where the server and the...

24. CISA KEV: CVE-2026-85102 — Check Point Multiple Products actively exploited

    CISA KEV · 22 Sep 2026, 05:30 IST · Critical severity

    Check Point Multiple Products Improper Certificate Validation Vulnerability. Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation...

25. CISA KEV: CVE-2026-93616 — Check Point Multiple Products actively exploited

    CISA KEV · 22 Sep 2026, 05:30 IST · Critical severity

    Check Point Multiple Products Path Traversal Vulnerability. Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that...

26. CISA KEV: CVE-2026-94127 — F5 BIG-IP APM actively exploited

    CISA KEV · 22 Sep 2026, 05:30 IST · Critical severity

    F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability. F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an...

27. CISA KEV: CVE-2026-93952 — Arista VeloCloud Orchestrator actively exploited

    CISA KEV · 22 Sep 2026, 05:30 IST · Critical severity

    Arista VeloCloud Orchestrator Improper Input Validation Vulnerability. Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal...

28. New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

    The Hacker News · 22 Sep 2026, 17:59 IST · Critical severity

    Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952, may allow a remote...

29. Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)

    Help Net Security · 22 Sep 2026, 16:12 IST · Medium severity

    A Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 devices across 48 countries, GreyNoise reported on Monday. The...

30. CISA KEV: CVE-2026-7273 — Zyxel GS1900 Series Switches actively exploited

    CISA KEV · 21 Sep 2026, 05:30 IST · Critical severity

    Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability. Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to...

31. CISA Flags Actively Exploited Cisco ISE Flaw With No Workaround

    News – MeriTalk · 19 Sep 2026, 01:51 IST · Critical severity

    The Cybersecurity and Infrastructure Security Agency (CISA) added a critical Cisco identity-management vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog after finding evidence that attackers are using the flaw. The...

32. CISA KEV: CVE-2025-39682 — Linux Kernel actively exploited

    CISA KEV · 18 Sep 2026, 05:30 IST · Critical severity

    Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability. Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record...

33. CISA KEV: CVE-2026-53266 — Linux Kernel actively exploited

    CISA KEV · 18 Sep 2026, 05:30 IST · Critical severity

    Linux Kernel Out-of-Bounds Write Vulnerability. Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer...

34. CISA KEV: CVE-2025-39964 — Linux Kernel actively exploited

    CISA KEV · 18 Sep 2026, 05:30 IST · Critical severity

    Linux Kernel Race Condition Vulnerability. Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the...

35. Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)

    Help Net Security · 17 Sep 2026, 15:54 IST · Critical severity

    Two days after it warned customers about an actively exploited email gateway zero-day, Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE)....

36. CISA KEV: CVE-2026-87886 — Acronis Backup actively exploited

    CISA KEV · 16 Sep 2026, 05:30 IST · Critical severity

    Acronis Backup Incorrect Default Permissions Vulnerability. Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. Required...

37. CISA KEV: CVE-2026-76460 — Cisco Identity Services Engine actively exploited

    CISA KEV · 16 Sep 2026, 05:30 IST · Critical severity

    Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability. Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could...

38. CISA KEV: CVE-2026-58704 — Google Pixel actively exploited

    CISA KEV · 16 Sep 2026, 05:30 IST · Critical severity

    Google Pixel Improper Authorization Vulnerability. Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges....

39. Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)

    Help Net Security · 16 Sep 2026, 18:06 IST · Medium severity

    A newly disclosed vulnerability in Parallels Desktop, tracked as CVE-2026-90894 and dubbed “ParaShells,” can allow any local user on a Mac to gain root privileges on the host system. ParaShells PoC in action (Source: JFrog) The danger...

40. Critical ScreenConnect flaw now actively exploited in attacks

    BleepingComputer · 16 Sep 2026, 16:44 IST · Critical severity

    Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).