$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
VeloCloud Orchestrator privilege escalation via SQL injection
A SQL injection flaw in Arista's on-prem VeloCloud Orchestrator lets any authenticated user gain superuser operator privileges, with active exploitation confirmed as of October 22, 2026.
PHP OOM Handling Memory Corruption Enables Unauthenticated RCE
PHP OOM handling leaves request memory uninitialized before cleanup runs, enabling unauthenticated RCE. CVSS 9.8 critical. Patched in PHP 8.3.36, 8.4.27, and 8.5.12.
PHP Stale Global State Across Requests Enables Unauthenticated RCE
Stale PHP global state may reference freed request memory, which subsequent requests read before it resets, enabling unauthenticated RCE. CVSS 8.1 high. Patched in PHP 8.3.36, 8.4.27, and 8.5.12.
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Latest security news
New Mexico Hospital Diverts Ambulances in Cyber Incident
UNM Health System diverted ambulances and closed 30 clinics Monday after a cybersecurity incident. The FBI is assisting; operations are resuming in phases.
Fortinet Patches CVSS 9.8 Auth Bypass in FortiSandbox
CVE-2026-107656, a CVSS 9.8 authentication bypass in Fortinet FortiSandbox, affects three active branches. No active exploitation confirmed at publication.
Two KEV Deadlines Hit Today: Arista, Collabora
CISA's October 26 remediation deadline is now. Federal agencies running Arista VeloCloud Orchestrator or Collabora Online Built-in CODE Server that haven't patched are overdue.
Wasmtime Patches Two Critical Sandbox Escapes
Bytecode Alliance fixed two CVSS 9.9 sandbox-escape flaws in Wasmtime. Update to 36.0.19, 48.0.7, 49.0.4, or 50.0.0 depending on your branch.
YesWiki Search Has Critical Unauthed SQL Injection
CVE-2026-116207 is a CVSS 9.1 unauthed SQL injection in YesWiki's search endpoint. All 4.6.x and 5.0.0-alpha1/3 installs are exposed. Fixed in 4.7.0 and 5.0.0-alpha4.
vLLM Patches Unauth Memory DoS in 0.25.0
CVE-2026-116177 lets unauthenticated attackers exhaust vLLM inference server memory via Nemotron-VL. Affects 0.10.2 through 0.24.x; patch to 0.25.0.