$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Google Brotli Unchecked Return Value Vulnerability
Google Brotli decoder memory corruption via crafted stream. Unauthenticated RCE potential. Ships in Node.js, PHP, Python, .NET, Bun. CISA KEV added October 27, 2026.
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce/Magento unrestricted file upload (CVSS 9.3). Unauthenticated RCE. Actively exploited by PolyShell since July 2025. CISA KEV added October 27, 2026.
VeloCloud Orchestrator privilege escalation via SQL injection
A SQL injection flaw in Arista's on-prem VeloCloud Orchestrator lets any authenticated user gain superuser operator privileges, with active exploitation confirmed as of October 22, 2026.
PHP OOM Handling Memory Corruption Enables Unauthenticated RCE
PHP OOM handling leaves request memory uninitialized before cleanup runs, enabling unauthenticated RCE. CVSS 9.8 critical. Patched in PHP 8.3.36, 8.4.27, and 8.5.12.
Latest security news
PHP2Shell KEV Deadline: Federal Agencies Must Patch by Oct 29
CISA confirmed active exploitation of PHP2Shell and set an October 29 patch deadline for federal agencies. CVE-2026-109618 (CVSS 9.8) and CVE-2026-109619 (CVSS 8.1) hit PHP 8.3/8.4/8.5.
Apple Backports CoreGraphics Zero-Day Fix to Older iPhones
Apple extended patches for CVE-2026-86950, a CoreGraphics zero-day confirmed in targeted attacks, to older iPhone and iPad models that cannot run iOS 26.
Teams IT Support Scams Deploy Ransomware at Scale
Researchers document hundreds of cases where threat actors pose as IT support via Microsoft Teams external chat to deliver malware and ransomware into enterprise networks.
New Mexico Hospital Diverts Ambulances in Cyber Incident
UNM Health System diverted ambulances and closed 30 clinics Monday after a cybersecurity incident. The FBI is assisting; operations are resuming in phases.
Fortinet Patches CVSS 9.8 Auth Bypass in FortiSandbox
CVE-2026-107656, a CVSS 9.8 authentication bypass in Fortinet FortiSandbox, affects three active branches. No active exploitation confirmed at publication.
Two KEV Deadlines Hit Today: Arista, Collabora
CISA's October 26 remediation deadline is now. Federal agencies running Arista VeloCloud Orchestrator or Collabora Online Built-in CODE Server that haven't patched are overdue.