CVE-20XX-?
agent?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

2 CVEs · updated 2026-11-13 19:21 UTC

Reset all
  1. CVE-2026-42897

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    exploited XSS Server Microsoft Exchange Server

    8.1 HIGH 71% exploit odds Fix listed
  2. CVE-2024-11182

    An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

    exploited XSS Server Mdaemon

    5.3 MEDIUM 33% exploit odds No fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.