Government ❯ Cybersecurity ❯ CISA ❯ Vulnerability Management

Known Exploited Vulnerabilities

CISA Flags Active Exploitation of Critical Gitea RCE

The agency set an August 28 federal patch deadline after warnings that attackers can gain code execution from repository-controlled content.

CISA Lists CVE-2026-21962 in KEV and Orders Rapid Federal Patching

CISA Orders Rapid Fixes After Active Exploitation of Critical MLflow SSRF

Zimbra Patches Critical Classic Web Client XSS

Active Exploits Hit Drupal SQL Injection Flaw CVE-2026-9082

CISA Adds Actively Exploited ‘Copy Fail’ Linux Bug to KEV With May 15 Patch Deadline

CISA Adds ActiveMQ RCE to KEV With April 30 Patch Deadline

Google Rushes Chrome 146 Update to Fix WebGPU Zero-Day Exploited in the Wild

CISA Flags SharePoint, Zimbra Flaws as Actively Exploited, Sets Rapid Federal Patching Deadlines

CISA Forces Three-Day Patch for Actively Exploited SolarWinds Web Help Desk Flaw

Microsoft’s January Patch Tuesday Fixes 112 Flaws, Confirms DWM Zero-Day Exploited

React2Shell Attacks Intensify as React Issues Second Round of Emergency Patches

CISA Orders Patch of Exploited Samsung Zero‑Day Used to Deliver LANDFALL Spyware

CISA Adds Motex Lanscope RCE Flaw to KEV, Citing Active Exploitation

CISA Adds Three D-Link Router Flaws to Known Exploited Vulnerabilities Catalog