$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
Cisco ASA/FTD SSL VPN Secondary Auth Logic Error Enables Remote DoS
Logic errors in Cisco ASA/FTD SSL VPN secondary authentication let unauthenticated remote attackers reload the firewall, causing a denial-of-service condition.
Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Google Brotli Unchecked Return Value Vulnerability
Google Brotli decoder memory corruption via crafted stream. Unauthenticated RCE potential. Ships in Node.js, PHP, Python, .NET, Bun. CISA KEV added October 27, 2026.
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce/Magento unrestricted file upload (CVSS 9.3). Unauthenticated RCE. Actively exploited by PolyShell since July 2025. CISA KEV added October 27, 2026.
VeloCloud Orchestrator privilege escalation via SQL injection
A SQL injection flaw in Arista's on-prem VeloCloud Orchestrator lets any authenticated user gain superuser operator privileges, with active exploitation confirmed as of October 22, 2026.
Latest security news
GMO Group Orders Cloud Shutdown After Ransomware Threat
GMO Group told Onamae Desktop Cloud customers to disconnect and shut down PCs after a threat actor who breached the service threatened a ransomware deployment.
Tailscale SSH Flaws Exposed Before Patches Ready
Nearly a dozen Tailscale SSH vulnerabilities went public before fixes were available. Root privilege escalation and credential theft confirmed as possible impact.
ENGIE Discloses Customer Data Breach via Partner Platform
French energy giant ENGIE confirmed attackers stole customer data after compromising a third-party marketing platform used by its business partners.
PHP2Shell KEV Deadline: Federal Agencies Must Patch by Oct 29
CISA confirmed active exploitation of PHP2Shell and set an October 29 patch deadline for federal agencies. CVE-2026-109618 (CVSS 9.8) and CVE-2026-109619 (CVSS 8.1) hit PHP 8.3/8.4/8.5.
Apple Backports CoreGraphics Zero-Day Fix to Older iPhones
Apple extended patches for CVE-2026-86950, a CoreGraphics zero-day confirmed in targeted attacks, to older iPhone and iPad models that cannot run iOS 26.
Teams IT Support Scams Deploy Ransomware at Scale
Researchers document hundreds of cases where threat actors pose as IT support via Microsoft Teams external chat to deliver malware and ransomware into enterprise networks.