Sorry, you need to enable JavaScript to visit this website.
Newsletter
Latest

Vulnerability tracker

Latest critical vulnerabilities

Vulnerabilities rated critical (CVSS 9.0 or higher) published in the last 30 days, and critical ones CISA has seen exploited in attacks in the last 30 days. Each links to its official record on cve.org, and to our story when we wrote one. The list is refreshed every hour from the US National Vulnerability Database.

All critical Exploited only

  1. 10.0 CVE-2026-97229 Exploited

    GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

    Exploited, added Oct 28 · Our story

  2. 9.3 CVE-2026-48356 Exploited

    Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

    Exploited, added Oct 26

  3. 9.8 CVE-2026-111497 Exploited

    Google Brotli Unchecked Return Value Vulnerability

    Exploited, added Oct 26 · Our story

  4. 9.8 CVE-2026-109618 Exploited

    PHP Memory Corruption Vulnerability

    Exploited, added Oct 25 · Our story

  5. 9.8 CVE-2026-110447 Exploited

    Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

    Exploited, added Oct 22

  6. 9.9 CVE-2026-114625 Exploited

    Arista VeloCloud Orchestrator SQL Injection Vulnerability

    Exploited, added Oct 22

  7. 9.8 CVE-2026-102764 Exploited

    BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

    Exploited, added Oct 15

  8. 9.8 CVE-2026-76519 Exploited

    Cisco Secure Email Gateway Relative Path Traversal Vulnerability

    Exploited, added Oct 13

  9. 10.0 CVE-2026-105134 Exploited

    Ahsay AhsayCBS Command Injection Vulnerability

    Exploited, added Oct 13

  10. 10.0 CVE-2015-3306 Exploited

    ProFTPD Improper Access Control Vulnerability

    Exploited, added Oct 7

  11. 9.8 CVE-2021-3199 Exploited

    ONLYOFFICE Docs Server Path Traversal Vulnerability

    Exploited, added Oct 7

Updated November 1, 2026, 3:30 am EST. This product uses data from the NVD API but is not endorsed or certified by the NVD.