CISA Known Exploited Vulnerabilities
CVE-2026-109619: PHP Stale Internal Request-State Vulnerability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
Summary from the publisher's feed.
More in Exploited now
- 10 NovCVE-2026-124194: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action VulnerabilityCISA Known Exploited Vulnerabilities
- 10 NovCVE-2026-111793: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres VulnerabilityCISA Known Exploited Vulnerabilities
- 10 NovCVE-2026-20320: Cisco BroadWorks Improper Restriction of XML External Entity Reference VulnerabilityCISA Known Exploited Vulnerabilities
- 10 NovCVE-2026-111560: Barracuda Networks Multiple Products OS Command Injection VulnerabilityCISA Known Exploited Vulnerabilities
- 10 NovCVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA Known Exploited Vulnerabilities
- 10 NovCVE-2026-125350: Google Chromium Use-After-Free VulnerabilityCISA Known Exploited Vulnerabilities
- 9 NovCVE-2026-102895: GPUStack Improper Authentication VulnerabilityCISA Known Exploited Vulnerabilities
- 9 NovCVE-2026-123158: OpenBSD OpenSSH Unexpected Status Code or Return Value VulnerabilityCISA Known Exploited Vulnerabilities