Cleus
Zero-days

Live CISA data · Nov 4, 2026

Zero-day vulnerabilities being exploited right now

Every vulnerability confirmed as used in real attacks, newest first, explained so it makes sense without a security team — who it affects and what to do about it.

added this week: 4
in the last 30 days: 34
used by ransomware: 361
confirmed exploited in total: 1,768

Ask Cleus about it

Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.

Newest exploited vulnerabilities

The latest additions to CISA's catalog, each one proven to be used in real attacks. Home kit means devices and apps people own; Work IT means company systems.

CVE-2024-27834Home kitNov 4, 2026
Apple Multiple Products
Login or permission bypass. A door that should be locked is not: part of the system can be reached without a valid login or permission.
Full details →
CVE-2026-119977Work ITNov 3, 2026
WordPress WordPress Core
Software flaw. A mistake in the software that attackers have found a way to abuse.
Full details →
CVE-2026-118527Work ITOct 30, 2026
Ivanti Connect Secure
Software flaw. A mistake in the software that attackers have found a way to abuse.
Full details →
CVE-2026-111357Work ITOct 30, 2026
Ivanti Connect Secure
Login or permission bypass. A door that should be locked is not: part of the system can be reached without a valid login or permission.
Full details →
CVE-2026-97229Work ITOct 29, 2026
GitLab Community Edition and Enterprise Edition
Memory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.
Full details →
CVE-2026-76418Work ITOct 29, 2026
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Memory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.
Full details →

Search all 1,768 entries →

How people actually get hacked

The news covers clever zero-days. Real break-ins are mostly seven boring things, ranked by how well they work on an ordinary person — and every one of them can be closed today.

A password you already used somewhere else
Works more than anything else on this page
A shop or forum you signed up to years ago gets breached. The list of emails and passwords is sold and fed into a machine that tries the same pair on your email, your bank, Instagram, Amazon. One hit and someone is inside an account you actually care about.
The fix: A password manager with a different password per site, plus two-step sign-in on your email. That combination ends this whole category.
A message that sounds like a normal day
Several times a week for most people
A parcel is held. A road toll is unpaid. Your “boss” needs gift cards. The link goes to a page that looks exactly right and asks you to sign in — which hands over your password and the code that was supposed to protect you. Text messages work better than email now, because people trust them.
The fix: Never sign in from a link in a message — open the app instead. If a message claims to be your bank or a person, verify on a channel you started.
A “free” download with something extra
The most common way home computers get infected
Cracked software, a “PDF converter”, a browser extension, a mod for a game. The installer quietly adds adware, a search hijacker, or a remote-access tool. Some come from real app stores, bought by someone who then stuffed them full of junk.
The fix: Install from the maker or the official store, then remove the add-ons you did not mean to accept. Keep one browser profile for the questionable stuff.
“Your computer is infected — call this number”
Very common, especially over 55
A full-screen pop-up, sometimes with a beep, tells you there is a virus and gives a phone number. The “technician” asks to connect remotely, then finds problems, then wants card details. Some are just a browser page; others really do install a remote-control tool.
The fix: Close the tab, or force-quit the browser. Only let someone connect remotely if you rang them on a number you looked up yourself.
The router in the hall nobody has touched
The quiet one — you would never notice
Routers ship with a password printed on the sticker and remote administration switched on. Botnets sweep the whole internet for them. Once in, yours joins the swarm, gets used for attacks, and can have your traffic watched or your home network reached.
The fix: One login: change the admin password off the sticker, switch off remote admin, and let it take firmware updates. Replace it if the maker has stopped supporting it.
Signing in on a network you do not own
Less common than the adverts suggest, still real
Airport, hotel and café Wi-Fi is often fine. The risk is the fake network with a name one letter off (“Airport_Free_WiFi”), or a hotel login page that is actually harvesting logins. Nobody has to break any encryption to run it.
The fix: Use your phone’s hotspot for anything important. Or a VPN — though it protects against the fake network, not the fake page.
A machine that stopped getting updates
Guaranteed, once the maker drops it
An old phone, a laptop on an operating system nobody patches, a camera with firmware from 2018. Every flaw ever found stays open forever, and public attack code still works. This is what the scary lists are actually about.
The fix: Check whether it still gets security updates. If not, stop putting new logins on it, and plan the replacement.

What is a zero-day?

Software has mistakes, and some let a stranger in where they shouldn't. A zero-day is one of those mistakes found and used before the company that made the software knows — so there is no fix yet. The company has had "zero days" to repair it.

Think of burglars discovering a hidden flaw in a popular lock. Every house with that lock is open until the maker sends a new part. Your job is not to be a locksmith — it is to let the maker in when they knock with the part. That is what installing an update is.

CVE is the ID every public vulnerability gets. CVSS is a 0–10 severity score for the bug, not your risk. KEV means it is proven to be used in attacks — that is this list.

The life of a zero-day

Hidden flaw. A bug ships in a product, sometimes unnoticed for years.
Found. An attacker or a researcher discovers it. Researchers report it; attackers stay quiet.
Exploited. It gets used, usually against a few chosen targets first. This is the zero-day window.
Disclosed. The maker learns of it and it gets a CVE ID.
Patched. An update ships. Now it is an "n-day": public, fixable, and a race against everyone who has not updated — which is most of this list.

All known exploited vulnerabilities

All 1,768 entries, newest first. Search a phone, browser, router or company you use, filter by what it affects, and open any entry for the plain-English version and the fix.

1,768 vulnerabilities

CVE-2024-27834Nov 4, 2026Apple Multiple Products Improper Authentication VulnerabilityLogin or permission bypass. A door that should be locked is not: part of the system can be reached without a valid login or permission.Could reach you
Could reach you. This one is aimed at devices or apps of the kind people own.
Product
Apple Multiple Products · Computers & everyday apps
What it can lead to
The attacker gets in as a user or administrator without knowing a password.
CISA description
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
Confirmed exploited
Nov 4, 2026
US federal patch deadline
Nov 18, 2026
Weakness type
CWE-287
How to protect
- Install the vendor's security update for Multiple Products (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Turn on automatic updates for the operating system and for Office, PDF and archive apps.
- Be careful with unexpected attachments — documents, .zip/.rar files and shortcuts are common bait.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-119977Nov 3, 2026WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
WordPress WordPress Core · Servers & business software
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
Confirmed exploited
Nov 3, 2026
US federal patch deadline
Nov 6, 2026
Weakness type
CWE-367
How to protect
- Install the vendor's security update for WordPress Core (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-118527Oct 30, 2026Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Ivanti Connect Secure · VPNs, firewalls & gateways
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
Confirmed exploited
Oct 30, 2026
US federal patch deadline
Nov 13, 2026
Weakness type
CWE-340
How to protect
- Install the vendor's security update for Connect Secure (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-111357Oct 30, 2026Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityLogin or permission bypass. A door that should be locked is not: part of the system can be reached without a valid login or permission.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Ivanti Connect Secure · VPNs, firewalls & gateways
What it can lead to
The attacker gets in as a user or administrator without knowing a password.
CISA description
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
Confirmed exploited
Oct 30, 2026
US federal patch deadline
Nov 2, 2026
Weakness type
CWE-306, CWE-862, CWE-345
How to protect
- Install the vendor's security update for Connect Secure (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-97229Oct 29, 2026GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityMemory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
GitLab Community Edition and Enterprise Edition · Servers & business software
What it can lead to
Usually lets an attacker crash the program or run their own code with its permissions.
CISA description
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Confirmed exploited
Oct 29, 2026
US federal patch deadline
Nov 1, 2026
Weakness type
CWE-190
How to protect
- Install the vendor's security update for Community Edition and Enterprise Edition (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-76418Oct 29, 2026Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityMemory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software · VPNs, firewalls & gateways
What it can lead to
Usually lets an attacker crash the program or run their own code with its permissions.
CISA description
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Confirmed exploited
Oct 29, 2026
US federal patch deadline
Nov 1, 2026
Weakness type
CWE-690
How to protect
- Install the vendor's security update for Secure Firewall ASA Software and Cisco Secure FTD Software (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-46300Oct 28, 2026Linux Kernel Missing Initialization of a Variable VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Could reach you
Could reach you. This one is aimed at devices or apps of the kind people own.
Product
Linux Kernel · Computers & everyday apps
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Confirmed exploited
Oct 28, 2026
US federal patch deadline
Oct 31, 2026
Weakness type
CWE-456
How to protect
- Install the vendor's security update for Kernel (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Turn on automatic updates for the operating system and for Office, PDF and archive apps.
- Be careful with unexpected attachments — documents, .zip/.rar files and shortcuts are common bait.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-41709Oct 28, 2026Broadcom VMWare ESX Insufficient Logging VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Broadcom VMware ESX · Servers & business software
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Confirmed exploited
Oct 28, 2026
US federal patch deadline
Nov 11, 2026
Weakness type
CWE-778
How to protect
- Install the vendor's security update for VMware ESX (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-48356Oct 27, 2026Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityDangerous file upload. The program accepts files it should refuse, such as programs disguised as ordinary uploads.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Adobe Commerce and Magento · Servers & business software
What it can lead to
The attacker can place and run their own tools on the server.
CISA description
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Confirmed exploited
Oct 27, 2026
US federal patch deadline
Nov 10, 2026
Weakness type
CWE-434
How to protect
- Install the vendor's security update for Commerce and Magento (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-111497Oct 27, 2026Google Brotli Unchecked Return Value VulnerabilityMemory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Google Brotli · Servers & business software
What it can lead to
Usually lets an attacker crash the program or run their own code with its permissions.
CISA description
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Confirmed exploited
Oct 27, 2026
US federal patch deadline
Nov 10, 2026
Weakness type
CWE-252, CWE-787
How to protect
- Install the vendor's security update for Brotli. If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
NVD record ↗
CVE-2026-109619Oct 26, 2026PHP Stale Internal Request-State VulnerabilityMemory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
PHP Group PHP · Servers & business software
What it can lead to
Usually lets an attacker crash the program or run their own code with its permissions.
CISA description
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
Confirmed exploited
Oct 26, 2026
US federal patch deadline
Oct 29, 2026
Weakness type
CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
How to protect
- Install the vendor's security update for PHP. If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
NVD record ↗
CVE-2026-109618Oct 26, 2026PHP Memory Corruption VulnerabilityMemory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
PHP Group PHP · Servers & business software
What it can lead to
Usually lets an attacker crash the program or run their own code with its permissions.
CISA description
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
Confirmed exploited
Oct 26, 2026
US federal patch deadline
Oct 29, 2026
Weakness type
CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
How to protect
- Install the vendor's security update for PHP. If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
NVD record ↗
CVE-2026-114625Oct 23, 2026Arista VeloCloud Orchestrator SQL Injection VulnerabilityDatabase injection. Text typed into the app ends up changing the database query behind it.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Arista VeloCloud Orchestrator · VPNs, firewalls & gateways
What it can lead to
Reading, changing or stealing data from the database.
CISA description
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Confirmed exploited
Oct 23, 2026
US federal patch deadline
Oct 26, 2026
Weakness type
CWE-89
How to protect
- Install the vendor's security update for VeloCloud Orchestrator (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-110447Oct 23, 2026Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCommand or code injection. The program treats text it receives as instructions instead of plain data.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Collabora Collabora Online – Built-in CODE Server · Servers & business software
What it can lead to
The attacker can run commands on the machine — often the whole device is taken over.
CISA description
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Confirmed exploited
Oct 23, 2026
US federal patch deadline
Oct 26, 2026
Weakness type
CWE-78
How to protect
- Install the vendor's security update for Collabora Online – Built-in CODE Server (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-96656Oct 20, 2026Plex Media Server External Control of File Name or Path VulnerabilityFile path flaw. The program can be tricked into reading or writing files outside the folder it should stay in.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Plex Media Server · Servers & business software
What it can lead to
Leaks files such as passwords and settings, or overwrites important ones.
CISA description
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Confirmed exploited
Oct 20, 2026
US federal patch deadline
Oct 23, 2026
Weakness type
CWE-73
How to protect
- Install the vendor's security update for Media Server (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-96655Oct 20, 2026Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityWeb page flaw. A web app can be made to act on someone's behalf or reach places it should not.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Plex Media Server · Servers & business software
What it can lead to
Stolen sessions, actions taken as the victim, or access to internal systems.
CISA description
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Confirmed exploited
Oct 20, 2026
US federal patch deadline
Nov 3, 2026
Weakness type
CWE-918
How to protect
- Install the vendor's security update for Media Server (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-96654Oct 20, 2026Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Plex Media Server · Servers & business software
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Confirmed exploited
Oct 20, 2026
US federal patch deadline
Oct 23, 2026
Weakness type
CWE-84
How to protect
- Install the vendor's security update for Media Server (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-96652Oct 20, 2026Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityWeb page flaw. A web app can be made to act on someone's behalf or reach places it should not.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Plex Media Server · Servers & business software
What it can lead to
Stolen sessions, actions taken as the victim, or access to internal systems.
CISA description
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Confirmed exploited
Oct 20, 2026
US federal patch deadline
Nov 3, 2026
Weakness type
CWE-918
How to protect
- Install the vendor's security update for Media Server (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-110936Oct 20, 2026Siemens Software Center Uncontrolled Search Path Element VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Siemens Software Center · Servers & business software
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Confirmed exploited
Oct 20, 2026
US federal patch deadline
Nov 3, 2026
Weakness type
CWE-427
How to protect
- Install the vendor's security update for Software Center (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-106931Oct 20, 2026EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityCommand or code injection. The program treats text it receives as instructions instead of plain data.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
EG Secure Solutions SiteGuard Server Edition · Servers & business software
What it can lead to
The attacker can run commands on the machine — often the whole device is taken over.
CISA description
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Confirmed exploited
Oct 20, 2026
US federal patch deadline
Oct 23, 2026
Weakness type
CWE-78
How to protect
- Install the vendor's security update for SiteGuard Server Edition (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-102764Oct 16, 2026BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityLogin or permission bypass. A door that should be locked is not: part of the system can be reached without a valid login or permission.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
BeyondTrust Remote Support · Servers & business software
What it can lead to
The attacker gets in as a user or administrator without knowing a password.
CISA description
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Confirmed exploited
Oct 16, 2026
US federal patch deadline
Oct 19, 2026
Weakness type
CWE-290
How to protect
- Install the vendor's security update for Remote Support (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2025-61624Oct 16, 2026Fortinet Multiple Products Path Traversal VulnerabilityFile path flaw. The program can be tricked into reading or writing files outside the folder it should stay in.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Fortinet Multiple Products · VPNs, firewalls & gateways
What it can lead to
Leaks files such as passwords and settings, or overwrites important ones.
CISA description
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Confirmed exploited
Oct 16, 2026
US federal patch deadline
Oct 19, 2026
Weakness type
CWE-22
How to protect
- Install the vendor's security update for Multiple Products (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-21589Oct 15, 2026Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Atlassian Multiple Products · Servers & business software
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Confirmed exploited
Oct 15, 2026
US federal patch deadline
Oct 18, 2026
Weakness type
CWE-552
How to protect
- Install the vendor's security update for Multiple Products (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-76519Oct 14, 2026Cisco Secure Email Gateway Relative Path Traversal VulnerabilityFile path flaw. The program can be tricked into reading or writing files outside the folder it should stay in.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Cisco Secure Email Gateway · VPNs, firewalls & gateways
What it can lead to
Leaks files such as passwords and settings, or overwrites important ones.
CISA description
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Confirmed exploited
Oct 14, 2026
US federal patch deadline
Oct 17, 2026
Weakness type
CWE-23
How to protect
- Install the vendor's security update for Secure Email Gateway (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-105134Oct 14, 2026Ahsay AhsayCBS Command Injection VulnerabilityCommand or code injection. The program treats text it receives as instructions instead of plain data.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Ahsay AhsayCBS · Servers & business software
What it can lead to
The attacker can run commands on the machine — often the whole device is taken over.
CISA description
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Confirmed exploited
Oct 14, 2026
US federal patch deadline
Oct 17, 2026
Weakness type
CWE-77, CWE-78
How to protect
- Install the vendor's security update for AhsayCBS (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-105133Oct 14, 2026Ahsay AhsayCBS Improper Authentication VulnerabilityLogin or permission bypass. A door that should be locked is not: part of the system can be reached without a valid login or permission.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Ahsay AhsayCBS · Servers & business software
What it can lead to
The attacker gets in as a user or administrator without knowing a password.
CISA description
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Confirmed exploited
Oct 14, 2026
US federal patch deadline
Oct 17, 2026
Weakness type
CWE-287
How to protect
- Install the vendor's security update for AhsayCBS (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-0322Oct 14, 2026Palo Alto Networks PAN-OS Code Injection VulnerabilityCommand or code injection. The program treats text it receives as instructions instead of plain data.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Palo Alto Networks PAN-OS · VPNs, firewalls & gateways
What it can lead to
The attacker can run commands on the machine — often the whole device is taken over.
CISA description
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Confirmed exploited
Oct 14, 2026
US federal patch deadline
Oct 17, 2026
Weakness type
CWE-94
How to protect
- Install the vendor's security update for PAN-OS (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-96951Oct 13, 2026Microsoft Windows Command Injection VulnerabilityCommand or code injection. The program treats text it receives as instructions instead of plain data.Could reach you
Could reach you. This one is aimed at devices or apps of the kind people own.
Product
Microsoft Windows · Computers & everyday apps
What it can lead to
The attacker can run commands on the machine — often the whole device is taken over.
CISA description
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Confirmed exploited
Oct 13, 2026
US federal patch deadline
Oct 16, 2026
Weakness type
CWE-77
How to protect
- Install the vendor's security update for Windows (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Turn on automatic updates for the operating system and for Office, PDF and archive apps.
- Be careful with unexpected attachments — documents, .zip/.rar files and shortcuts are common bait.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-104935Oct 13, 2026Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityLogin or permission bypass. A door that should be locked is not: part of the system can be reached without a valid login or permission.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Ivanti Connect Secure · VPNs, firewalls & gateways
What it can lead to
The attacker gets in as a user or administrator without knowing a password.
CISA description
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Confirmed exploited
Oct 13, 2026
US federal patch deadline
Oct 16, 2026
Weakness type
CWE-290
How to protect
- Install the vendor's security update for Connect Secure. If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
NVD record ↗
CVE-2023-22894Oct 8, 2026Strapi Cleartext Storage of Sensitive Information VulnerabilityInformation leak. The program reveals information it should keep private.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Strapi Strapi · Servers & business software
What it can lead to
Leaked secrets — tokens, passwords or memory contents — that help a bigger attack.
CISA description
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Confirmed exploited
Oct 8, 2026
US federal patch deadline
Oct 11, 2026
Weakness type
CWE-312
How to protect
- Install the vendor's security update for Strapi (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2021-3199Oct 8, 2026ONLYOFFICE Docs Server Path Traversal VulnerabilityFile path flaw. The program can be tricked into reading or writing files outside the folder it should stay in.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
ONLYOFFICE Docs · VPNs, firewalls & gateways
What it can lead to
Leaks files such as passwords and settings, or overwrites important ones.
CISA description
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Confirmed exploited
Oct 8, 2026
US federal patch deadline
Oct 11, 2026
Weakness type
CWE-22
How to protect
- Install the vendor's security update for Docs (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2016-3081Oct 8, 2026Apache Struts Command Injection VulnerabilityCommand or code injection. The program treats text it receives as instructions instead of plain data.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Apache Struts · Servers & business software
What it can lead to
The attacker can run commands on the machine — often the whole device is taken over.
CISA description
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Confirmed exploited
Oct 8, 2026
US federal patch deadline
Oct 11, 2026
Weakness type
CWE-77
How to protect
- Install the vendor's security update for Struts. If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
NVD record ↗
CVE-2015-5477Oct 8, 2026ISC BIND Data Processing Errors VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
ISC BIND · Servers & business software
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Confirmed exploited
Oct 8, 2026
US federal patch deadline
Oct 11, 2026
Weakness type
CWE-19
How to protect
- Install the vendor's security update for BIND (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2015-3306Oct 8, 2026ProFTPD Improper Access Control VulnerabilityLogin or permission bypass. A door that should be locked is not: part of the system can be reached without a valid login or permission.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
ProFTPD ProFTPD · Servers & business software
What it can lead to
The attacker gets in as a user or administrator without knowing a password.
CISA description
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Confirmed exploited
Oct 8, 2026
US federal patch deadline
Oct 11, 2026
Weakness type
CWE-284
How to protect
- Install the vendor's security update for ProFTPD (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-88779Oct 4, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityMemory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Citrix NetScaler · VPNs, firewalls & gateways
What it can lead to
Usually lets an attacker crash the program or run their own code with its permissions.
CISA description
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Confirmed exploited
Oct 4, 2026
US federal patch deadline
Oct 7, 2026
Weakness type
CWE-119
How to protect
- Install the vendor's security update for NetScaler (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-102490Oct 2, 2026Zammad GmbH Zammad Improper Privilege Management VulnerabilityPrivilege escalation. Something running with limited rights can promote itself to full control.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Zammad GmbH Zammad · Servers & business software
What it can lead to
Turns a small foothold (like a malicious app) into administrator or system-level access.
CISA description
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
Confirmed exploited
Oct 2, 2026
US federal patch deadline
Oct 5, 2026
Weakness type
CWE-269
How to protect
- Install the vendor's security update for Zammad (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-102489Oct 2, 2026Zammad GmbH Zammad Session Fixation VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Zammad GmbH Zammad · Servers & business software
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Confirmed exploited
Oct 2, 2026
US federal patch deadline
Oct 5, 2026
Weakness type
CWE-384
How to protect
- Install the vendor's security update for Zammad (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-104286Oct 1, 2026Fortinet FortiMail Path Traversal VulnerabilityFile path flaw. The program can be tricked into reading or writing files outside the folder it should stay in.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Fortinet FortiMail · VPNs, firewalls & gateways
What it can lead to
Leaks files such as passwords and settings, or overwrites important ones.
CISA description
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Confirmed exploited
Oct 1, 2026
US federal patch deadline
Oct 4, 2026
Weakness type
CWE-22, CWE-158
How to protect
- Install the vendor's security update for FortiMail (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-76504Sep 30, 2026Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilitySoftware flaw. A mistake in the software that attackers have found a way to abuse.Work IT
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
Product
Cisco Catalyst SD-WAN Manager · VPNs, firewalls & gateways
What it can lead to
Depends on the product — see the description and the vendor advisory.
CISA description
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
Confirmed exploited
Sep 30, 2026
US federal patch deadline
Oct 3, 2026
Weakness type
CWE-177
How to protect
- Install the vendor's security update for Catalyst SD-WAN Manager (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
Full details →
Vendor advisory ↗NVD record ↗
CVE-2026-86950Sep 29, 2026Apple Multiple Products Out-of-Bounds Write VulnerabilityMemory-safety flaw. The program mishandles the memory it uses to keep track of data. A specially made input can scramble that memory.Could reach you
Could reach you. This one is aimed at devices or apps of the kind people own.
Product
Apple Multiple Products · Computers & everyday apps
What it can lead to
Usually lets an attacker crash the program or run their own code with its permissions.
CISA description
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
Confirmed exploited
Sep 29, 2026
US federal patch deadline
Oct 13, 2026
Weakness type
CWE-787
How to protect
- Install the vendor's security update for Multiple Products (advisory linked below). If no update exists, follow the vendor's workaround or stop using the product.
- Turn on automatic updates for the operating system and for Office, PDF and archive apps.
- Be careful with unexpected attachments — documents, .zip/.rar files and shortcuts are common bait.
Full details →
Vendor advisory ↗NVD record ↗

What can be hacked

The same catalog, grouped by the thing it affects — with the honest risk and the fix for each.

Phones & tablets

135

iPhone, iPad, Android, Samsung and the chips inside them.

What's at risk: Messages, photos, location, microphone and camera. The most serious ones are "zero-click": no tap needed from the owner. They are usually used as spyware against a small number of chosen people.

How to protect

Install system updates the day they come out — most phone zero-days are fixed in a point release.
Restart your phone every few days; some spyware does not survive a reboot.
If you are a journalist, activist, lawyer, politician or executive, turn on Lockdown Mode (iPhone) or Advanced Protection (Android).
Only install apps from the official store and remove ones you no longer use.

Web browsers

162

Chrome, Edge, Safari, Firefox and the engines they share.

What's at risk: A malicious or hacked website can be enough. Browser bugs are often the first step in a longer attack on the whole computer or phone.

How to protect

Let the browser auto-update and relaunch it when it asks — the fix is not active until you do.
Keep extensions to a minimum and remove ones you do not recognise.
Stop using Internet Explorer and any browser that no longer gets updates.

Computers & everyday apps

387

Windows, macOS, Linux, Office, PDF readers, archive tools.

What's at risk: Your files, saved passwords and accounts. Many of these let a program that is already running gain full administrator control.

How to protect

Turn on automatic updates for the operating system and for Office, PDF and archive apps.
Be careful with unexpected attachments — documents, .zip/.rar files and shortcuts are common bait.
Use a normal (non-admin) account day to day and keep built-in protection like Microsoft Defender on.

VPNs, firewalls & gateways

296

The boxes that sit on the edge of a company network.

What's at risk: They face the internet and guard the whole network, so a flaw here can hand attackers a way in — and these devices usually run no antivirus, so break-ins go unnoticed.

How to protect

Patch edge devices first — attackers often start scanning for them within hours of a fix.
Never expose the device's admin page to the internet.
After patching a device that was exposed, follow the vendor's compromise checks, end active sessions and change passwords.
Send their logs to a central place so a break-in is noticed.

Routers, cameras & storage boxes

Home and small-office gear that rarely gets updated.

What's at risk: Taken over in bulk to join botnets, used to watch your traffic, or — for storage boxes — locked by ransomware.

How to protect

Turn on automatic firmware updates and replace gear the maker no longer supports.
Change default passwords and switch off remote administration and features you do not use.
Do not put storage boxes or cameras directly on the internet — use the maker's app or a VPN.

Servers & business software

693

Email, file-transfer, collaboration and IT tools run by companies.

What's at risk: Mass data theft and ransomware: a single flaw in a file-transfer or email server has exposed thousands of organisations at once.

How to protect

Keep a list of every internet-facing server you run so nothing is forgotten.
Patch anything in this catalog first, ahead of normal patch cycles.
Put admin and file-transfer apps behind a VPN or single sign-on instead of the open internet.
Keep offline, tested backups so ransomware cannot take everything.

How to protect yourself

Ten minutes, for everyone

Turn on automatic updates everywhere. Phone, computer, browser. Ten minutes now, then never again.
Restart your phone right now — then weekly. Kills spyware that lives only in memory. Set a reminder, it’s genuinely a defence.
Put a passkey or app code on your email. The single highest-value 3 minutes on this list.
Install a password manager and let it generate. You then only have to remember one strong password, not forty.
Change the router’s admin password, switch off remote admin. The sticker password is public knowledge.
Turn on automatic backup, keep one copy offline. The only thing that survives ransomware.
Delete apps you don’t use. Every app is another thing that needs updating.
High-risk? Turn on Lockdown Mode / Advanced Protection. Journalists, activists, lawyers, founders, politicians — do this one.

For businesses and IT teams

Patch this list first. Treat known-exploited vulnerabilities as emergencies, internet-facing systems before anything else.
Know what you run. Keep an inventory of devices, servers and the software inside them, so "are we affected?" takes minutes.
Shrink what faces the internet. Admin pages, file-transfer apps and remote-access tools belong behind a VPN or single sign-on.
Assume edge devices can be breached. After patching an exposed VPN or firewall, run the vendor's compromise checks, end sessions and rotate credentials.
Require phishing-resistant MFA. Passkeys or security keys for admins and remote access.
Segment, log and back up. Separate critical systems, centralise logs, and keep offline, tested backups.

If you think you've been hacked

Don’t panic-delete. Photos and messages are evidence, and often recoverable.
Change your email password from a different device. Email resets everything else, so it goes first. Then turn on two-step sign-in.
Sign out of everywhere. In each account’s security settings, use “sign out of all devices” and check for sessions you don’t know.
Update and reboot the device. Most active intrusions don’t survive a full update plus restart.
Check the boring stuff. Bank app, card alerts, email forwarding rules, and any new “recovery” address on your accounts.
Then tell someone. Your bank, and the company whose account was abused. Nobody is impressed by you handling it alone.

Walk through it with Cleus →

Questions

What is a zero-day vulnerability?

A security flaw that attackers know about before the software maker does, or before a fix exists. The name comes from the defenders having had "zero days" to fix it.

What is the difference between a zero-day and a CVE?

A CVE is just the public ID every known vulnerability gets, like CVE-2021-44228. A zero-day is a vulnerability that was being exploited before a fix existed. Most zero-days get a CVE once they are discovered, but most CVEs were never zero-days.

Is every vulnerability on this page a zero-day?

No. The list is every vulnerability CISA has confirmed was exploited in real attacks. Many were zero-days when first used; others were attacked soon after a fix came out, against people who had not updated yet. Either way, these are the ones to patch first.

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities catalog, published by the US Cybersecurity and Infrastructure Security Agency. It only lists vulnerabilities with reliable evidence of real-world attacks, and US federal agencies must patch them by a set deadline. This page reads it every few hours.

How do I know if I am affected?

Search the list for the apps, devices and companies you use. Every entry is tagged with whether it is aimed at kit people own or at company systems. If an entry matches something you run, check that the latest update is installed — automatic updates cover most of the list for everyday users.

What is the most likely way I personally get hacked?

A password you reused on a breached site, or a message that sounds like a normal day. Not a zero-day. That is why both are covered near the top of this page.

Can antivirus or a VPN stop zero-days?

Not reliably. Nobody has a signature for a brand-new attack yet, and a VPN only hides your traffic — it does not fix an out-of-date browser. Fast updates, fewer exposed services, two-step sign-in and backups matter more.

Source: CISA Known Exploited Vulnerabilities catalog, refreshed every few hours. Plain-English explanations by Cleus. "Right now" means the catalog as published, not a live attack map.

Newest exploited vulnerabilities

Apple Multiple Products

WordPress WordPress Core

Ivanti Connect Secure

Ivanti Connect Secure

GitLab Community Edition and Enterprise Edition

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

How people actually get hacked

A password you already used somewhere else

A message that sounds like a normal day

A “free” download with something extra

“Your computer is infected — call this number”

The router in the hall nobody has touched

Signing in on a network you do not own

A machine that stopped getting updates

What is a zero-day?

The life of a zero-day

All known exploited vulnerabilities

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

How to protect

What can be hacked

Phones & tablets

How to protect

Web browsers

How to protect

Computers & everyday apps

How to protect

VPNs, firewalls & gateways

How to protect

Routers, cameras & storage boxes

How to protect

Servers & business software

How to protect

How to protect yourself

Ten minutes, for everyone

For businesses and IT teams

If you think you've been hacked

Questions