CVE-2026-109619Unknown● ACTIVELY EXPLOITED
PHP Stale Internal Request-State Vulnerability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Web
CISA mitigation guidanceApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are…
CVE-2026-109618Unknown● ACTIVELY EXPLOITED
PHP Memory Corruption Vulnerability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Web
CISA mitigation guidanceApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are…
CVE-2021-21985Unknown● ACTIVELY EXPLOITEDRansomware use reported
VMware vCenter Server Improper Input Validation Vulnerability
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Servers
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2021-22005Unknown● ACTIVELY EXPLOITEDRansomware use reported
VMware vCenter Server File Upload Vulnerability
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2019-11510Unknown● ACTIVELY EXPLOITEDRansomware use reported
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2021-34473Unknown● ACTIVELY EXPLOITEDRansomware use reported
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Servers
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2019-0708Unknown● ACTIVELY EXPLOITEDRansomware use reported
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Endpoints
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2018-13379Unknown● ACTIVELY EXPLOITEDRansomware use reported
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2021-35464Unknown● ACTIVELY EXPLOITEDRansomware use reported
ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Servers
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2020-5902Unknown● ACTIVELY EXPLOITEDRansomware use reported
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Other
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2019-19781Unknown● ACTIVELY EXPLOITEDRansomware use reported
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidanceApply updates per vendor instructions.
CVE-2021-1498Unknown● ACTIVELY EXPLOITED
Cisco HyperFlex HX Data Platform Command Injection Vulnerability
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.
CVSS SCORENot ratedEPSS 30-DAY100.00%ASSET TYPE*Network
CISA mitigation guidanceApply updates per vendor instructions.
CISA KEV catalog last checked: 2026-10-28 23:06:13 UTC. Reports reflect upstream publications and may lag; confirm affected versions and patch instructions with the original vendor. Asset categories are automatically inferred, not verified inventories.