CISA's latest release: 14 October 2026, 19:27 UTC
What attackers exploit, and what to patch first
As of , 1,745 vulnerabilities are on CISA's list of exploited vulnerabilities; CISA added 11 in the last 7 days. Patch first: CVE-2015-3306 in ProFTPD.
Patch first now
Our patch-first order for the entries CISA listed in the last 30 days.
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2015-3306Improper Access Control | ProFTPD ProFTPD | Patch nowForensic triage required by CISA; listed in the last 14 days; Metasploit module; verified Exploit-DB entry | 0.99 | ||
| 2 | CVE-2015-5477Data Processing Errors | ISC BIND | Patch nowListed in the last 14 days; Metasploit module; verified Exploit-DB entry | 0.99 | ||
| 3 | CVE-2016-3081Command Injection | Apache Struts | Patch nowForensic triage required by CISA; listed in the last 14 days; Metasploit module; verified Exploit-DB entry | 0.96 | ||
| 4 | CVE-2026-71362Incorrect Authorization | Adobe Commerce and Magento | Patch nowForensic triage required by CISA | 0.88 | ||
| 5 | CVE-2026-87902Remote File Inclusion | WordPress Core | Patch nowForensic triage required by CISA | 0.40 | ||
| 6 | CVE-2026-104935Authentication Bypass by Spoofing | Ivanti Connect Secure | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.26 | ||
| 7 | CVE-2021-3199Server Path Traversal | ONLYOFFICE Docs | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.19 | ||
| 8 | CVE-2026-93616Path Traversal | Check Point Multiple Products | Patch nowForensic triage required by CISA | 0.20 | ||
| 9 | CVE-2026-76460Incorrect Use of Privileged APIs | Cisco Identity Services Engine | Patch nowForensic triage required by CISA | 0.14 | ||
| 10 | CVE-2026-85102Improper Certificate Validation | Check Point Multiple Products | Patch nowForensic triage required by CISA | 0.08 |
Patch Tuesday
Every CVE Microsoft published on its monthly release day, in our patch-first order.
- Patch Tuesday, October 20261,407 CVEs; 1 on CISA's list
- Patch Tuesday, September 2026965 CVEs; 2 on CISA's list
- Every Patch Tuesday42 releases
Latest additions
Added each month
Most exploited vendors in 2026
Changes CISA did not announce
CISA's file keeps only the latest state of each entry. We keep what changed.
- CVE-2026-86950 Apple Multiple ProductsDeadline moved from 2 October 2026 to 13 October 2026. Forensic triage: Yes to No.
- CVE-2022-0995 Linux KernelDeadline moved from 9 September 2026 to 29 August 2026. Forensic triage: No to Yes.