CISA Known Exploited Vulnerabilities
Recently added to the CISA KEV catalog
29 CVEs entered the KEV catalog in the last 30 days, with CISA’s due date and today’s CVSS and EPSS.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added October 16, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-102764 | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support | 9.8 | 1.2 % | Oct 19, 2026 |
Added October 15, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | — | — | Oct 18, 2026 |
Added October 14, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-0322 | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | 7.2 | 1.2 % | Oct 17, 2026 |
| CVE-2026-105133 | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication | 7.3 | 0.9 % | Oct 17, 2026 |
| CVE-2026-105134 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection | 10 | 4.8 % | Oct 17, 2026 |
| CVE-2026-76519 | Cisco Secure Email Gateway Arbitrary File Write Vulnerability | 9.8 | 1.6 % | Oct 17, 2026 |
Added October 13, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | 8.6 | 26.0 % | Oct 16, 2026 |
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | 8.8 | 1.5 % | Oct 16, 2026 |
Added October 8, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability | 10 | 99.5 % | Oct 11, 2026 |
| CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerability | 7.5 | 99.4 % | Oct 11, 2026 |
| CVE-2021-3199 | ONLYOFFICE Docs Server Path Traversal Vulnerability | 9.8 | 20.1 % | Oct 11, 2026 |
| CVE-2023-22894 | Strapi Cleartext Storage of Sensitive Information Vulnerability | 4.9 | 3.6 % | Oct 11, 2026 |
Added October 4, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-88779 | Memory overflow vulnerability leading to Denial of Service | 7.5 | 0.6 % | Oct 7, 2026 |
Added October 2, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-102489 | Undisclosed RCE in Zammad v6.3 and higher | — | 1.3 % | Oct 5, 2026 |
| CVE-2026-102490 | Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha | — | 0.5 % | Oct 5, 2026 |
Added October 1, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-104286 | Improper Pathname Restriction Allows Unauthenticated Arbitrary File Write in Fortinet FortiMail | 9.8 | 2.2 % | Oct 4, 2026 |
Added September 30, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability | 9.8 | 1.8 % | Oct 3, 2026 |
Added September 29, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write Vulnerability | 8.8 | 1.2 % | Oct 2, 2026 |
Added September 27, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler Improper Input Validation Vulnerability | 9.8 | 1.1 % | Sep 30, 2026 |
| CVE-2026-88772 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 8.1 | 1.3 % | Sep 30, 2026 |
Added September 25, 20263
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-65660 | Microsoft SharePoint Code Injection Vulnerability | 6.5 | 2.1 % | Sep 28, 2026 |
| CVE-2026-67279 | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | — | 1.0 % | Sep 28, 2026 |
| CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability | 8.1 | 40.0 % | Sep 28, 2026 |
Added September 24, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-5430 | WSO2 Multiple Products Path Traversal Vulnerability | 10 | 0.6 % | Sep 27, 2026 |
| CVE-2026-71362 | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 9.1 | 87.5 % | Sep 27, 2026 |
Added September 22, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-85102 | Check Point Multiple Products Improper Certificate Validation Vulnerability | 9.8 | 50.4 % | Sep 25, 2026 |
| CVE-2026-93616 | Check Point Multiple Products Path Traversal Vulnerability | 9.8 | 75.9 % | Sep 25, 2026 |
| CVE-2026-93952 | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | 10 | 1.1 % | Sep 25, 2026 |
| CVE-2026-94127 | BIG-IP APM OAuth vulnerability | 9.8 | 2.2 % | Sep 25, 2026 |