$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
Fortinet Multiple Products Path Traversal Vulnerability
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
BeyondTrust Remote Support Authentication Bypass by Spoofing
CVSS 9.8 auth bypass in BeyondTrust Remote Support; unauthenticated attackers can perform file operations on the appliance. Added to CISA KEV on October 16, 2026.
Palo Alto Networks PAN-OS Code Injection Vulnerability
PAN-OS code injection flaw lets authenticated network attackers run code as root. Actively exploited; CISA KEV deadline October 17.
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Ivanti Connect Secure Authentication Bypass by Spoofing
Authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. Unauthenticated remote attackers can execute arbitrary commands. Added to CISA KEV October 13, 2026.
Microsoft Windows Command Injection Vulnerability
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Latest security news
CVE-2026-110447: Collabora CODE Server Exploited
CVE-2026-110447 is a CVSS 9.8 command injection in Collabora CODE Server before 26.4.303, actively exploited on Nextcloud hosts since September 2026.
CISA: 105 Attacks Confirm Ivanti Patch Is Urgent
CISA cites 105 honeypot-logged exploit attempts and urges immediate patching of CVE-2026-104935 in Ivanti Connect Secure. Oct 16 deadline is 24 hours out.
Palo Alto PAN-OS Zero-Day Added to KEV, Fix by Oct 17
CVE-2026-0322, a PAN-OS code injection flaw, is confirmed exploited in attacks. CISA added it to KEV with an October 17 remediation deadline.
Cisco Patches Exploited Email Gateway File Write Bug
Cisco patches a second critical SEG zero-day in two months: unauthenticated attackers can write files to the OS. Exploitation is active. Patch immediately.
Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday
Fortinet, Citrix, and Ivanti each released October patches today, closing 29 vulnerabilities including critical-severity flaws in edge network products.
AI Finds Linux vhost Flaw Giving Root, VM Escape
A Linux vhost subsystem flaw lets local users reach root via kernel memory access and can break guest VM isolation. The vulnerability spans nearly a decade of kernel versions.