$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
Apple Multiple Products Improper Authentication Vulnerability
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. CISA notes it can be chained with other Ivanti Connect Secure flaws.
Ivanti Connect Secure Predictable Identifier File Upload
CISA lists an exploited predictable-identifier flaw in Ivanti Connect Secure. A remote authenticated attacker can upload attacker-controlled files to a known location on disk.
Cisco ASA/FTD SSL VPN Secondary Auth Logic Error Enables Remote DoS
Logic errors in Cisco ASA/FTD SSL VPN secondary authentication let unauthenticated remote attackers reload the firewall, causing a denial-of-service condition.
Latest security news
CISA Adds Old Apple PAC Bypass to KEV After APT29 Reports
CVE-2024-27834, a medium-severity Apple pointer authentication bypass patched in May 2024, is now in CISA's KEV catalog. Federal deadline is November 18.
Zyxel GS1900 Zero-Day CVE-2026-107441 Patched After Attacks
Zyxel fixed CVE-2026-107441 in ten GS1900 switch models after about 1,000 devices were hit. The June patch did not cover it. Update the firmware.
Rails Active Storage ImageMagick Flaw Allows File Writes
Rails fixed a critical Active Storage flaw in 8.1.4.1 and 8.0.5.2. Apps using ImageMagick on untrusted uploads let attackers write server files.
WordPress Core Upgrade Flaw Hits CISA KEV, Due Nov 6
CISA lists WordPress Core CVE-2026-119977, a race condition during full core upgrades, as exploited. Patches shipped late October; federal deadline is Nov 6.
BYOD ransomware gang claims Michigan State data theft
BYOD listed Michigan State University on its leak site, claiming data on 1.3 million people. The school ties it to an October credential incident and disputes wider access.
Android November Patches Fix 200+ Flaws, Framework RCE Tops
Google's November Android bulletin fixes more than 200 vulnerabilities across two patch levels, led by a critical zero-click Framework RCE, CVE-2026-58868.