CVE-20XX-?
agent?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

3 CVEs · updated 2026-11-06 15:49 UTC

Reset all
  1. CVE-2026-104935

    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

    exploited Code execution Network gear Ivanti Connect Secure

    8.6 HIGH 89% exploit odds Fix listed
  2. CVE-2026-119977

    WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

    exploited Code execution Web app WordPress

    8.1 HIGH 1% exploit odds Fix listed
  3. CVE-2026-110936

    A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

    exploited Code execution Device Siemens Software Center

    8.4 HIGH 1.0% exploit odds Fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.