$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
VeloCloud Orchestrator privilege escalation via SQL injection
A SQL injection flaw in Arista's on-prem VeloCloud Orchestrator lets any authenticated user gain superuser operator privileges, with active exploitation confirmed as of October 22, 2026.
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Siemens Software Center DLL Sideloading via Uncontrolled Search Path
Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path, allowing a local attacker to execute code with the application's privileges. Exploited in the wild via ClickFix lures.
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Latest security news
AI Agents Ran INC and Gentlemen Ransomware Intrusions
SOCRadar found an exposed server logging 8,257 messages from INC and The Gentlemen affiliates running autonomous AI agent frameworks against 62 organizations.
HPE Patches 72 ArubaOS Flaws, Eight at Max Severity
HPE's latest ArubaOS security bulletin covers 72 flaws, including eight rated maximum severity for authentication bypass and remote code execution.
PHP Warns of New Unpatched RCE, No Patch Available
PHP's security team disclosed a new RCE flaw affecting non-default server configurations. No patch is out; mitigation guidance has been published.
Atlassian October Bulletin Covers 75 Flaws, 14 Critical
Atlassian patches 75 flaws in its October bulletin, 14 rated critical, all in third-party components shipped with Data Center and Server products.
Quest Diagnostics Discloses Patient Data Breach
Quest Diagnostics filed a regulatory notice confirming unauthorized access to its Quanum Lab Services Manager, with certain patient records among the data exposed.
Cisco Patches 34 CVEs, Six Critical Across Products
Cisco released patches for 34 CVEs across Expressway, Unified Communications, and Snort 3. Six are critical-severity; no exploitation confirmed.