CVE-20XX-?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

5 CVEs · updated 2026-11-06 05:35 UTC

Reset all
  1. CVE-2026-102764

    The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

    Drop everything exploited Denial of service Network gear Beyondtrust Remote Support

    9.3 CRITICAL 78% exploit odds Fix listed
  2. CVE-2026-76418

    A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

    exploited Denial of service Network gear Cisco Adaptive Security Appliance Software

    8.6 HIGH 0.8% exploit odds Fix listed
  3. CVE-2026-28318

    SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

    exploited Denial of service Server Solarwinds serv-u

    7.5 HIGH 44% exploit odds Fix listed
  4. CVE-2026-20349

    A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

    exploited Denial of service Network gear Cisco Adaptive Security Appliance Software

    8.6 HIGH 1% exploit odds Fix listed
  5. CVE-2026-45498

    Microsoft Defender Denial of Service Vulnerability

    exploited Denial of service Microsoft Defender Antimalware Platform

    4.0 MEDIUM 63% exploit odds Fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.