$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Siemens Software Center DLL Sideloading via Uncontrolled Search Path
Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path, allowing a local attacker to execute code with the application's privileges. Exploited in the wild via ClickFix lures.
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Plex Media Server arbitrary file write via transcoder preferences
Plex Media Server before 1.43.3.10861 lets an admin write arbitrary .so files via the TranscoderH264Options preference; the server loads all Codecs-directory .so files at startup without checks.
Latest security news
F5 Out-of-Band Patches Fix Three High-Sev NGINX Flaws
F5 patched three CVSS 8.1 flaws in NGINX Plus and Open Source on October 14, covering HTTP/3, AIO+SSI processing, and map directive handling. No exploitation confirmed.
BeyondTrust Remote Support Auth Bypass Hits CISA KEV
CVSS 9.8 authentication bypass in BeyondTrust Remote Support is actively exploited. CISA's federal patch deadline is October 19, 2026.
Fortinet Flaws Chained to Deploy PeerStitch in Telecom
Unit 42 details how UNC5820 chained CVE-2024-47575 and CVE-2025-61624 to deploy PeerStitch, a memory-only FortiGate implant, against a telecom organization.
PwnEscape: Linux Kernel Flaw Lets VMs Read Host Memory
A critical Linux kernel vulnerability named PwnEscape allows guest virtual machines to read host system memory, demonstrated live against Vercel's cloud infrastructure.
Next.js Out-of-Band Update Fixes Two Critical RCEs
Vercel patched two critical unauthenticated RCE flaws in Next.js on October 14: one in the caching layer, one in SVG processing, plus a high-severity DoS bug.
Langflow RCE Draws 1,423 Attacks: Patch to 1.9.0
CVE-2026-105740, CVSS 9.9, lets authenticated Langflow users execute server commands. Patch to 1.9.0 now; 1,423 exploit attempts logged since September 19.