Cyber Threat Monitor
What attackers are actually exploiting right now — the newest vulnerabilities on CISA's Known Exploited list (the ones to patch first), this week's critical CVEs, which are tied to ransomware, and the latest UK NCSC advisories. Built for IT and security teams; refreshed several times a day.
- Actively exploited (KEV)
- Critical CVEs this week
- NCSC advisories
At a glance
updated 18 Oct 20269Added this weekto CISA's exploited list
32Added this monthnewly exploited
18Critical CVEs this weekCVSS 9.0+ (NVD)
361Ransomware-linkedof all exploited vulns
1,748Known exploited totalCISA KEV catalog
Critical active exploits
ransomware-linked · recently added These actively-exploited vulnerabilities are linked to ransomware campaigns — treat them as patch-now.
CVE-2026-59310Ransomwareadded 18 Aug 2026
Broadcom VMware vCenter
Broadcom VMware vCenter Path Traversal Vulnerability
CVE-2026-63077Ransomwareadded 5 Aug 2026
JetBrains TeamCity
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
CVE-2026-20316Ransomwareadded 29 Jul 2026
Cisco Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Most-targeted vendors right now
most newly-exploited vulnerabilities · last 90 days
#1
Microsoft
9 newly exploited
#2
Cisco
7 newly exploited
1 ransomware-linked
#3
Citrix
5 newly exploited
AI-related vulnerabilities — the new frontier
CVEs referencing LLM / prompt-injection termsA fast-rising class of flaws in AI systems — prompt injection, model and agent exploits, and bugs in LLM-powered and AI-generated code. This is a proxy drawn from CVE text, not a complete count of AI-driven attacks, but the trend is unmistakable.
Per year
0
2019
1
2020
0
2021
3
2022
5
2023
35
2024
99
2025
318
2026
Per month (last 12 months)
10
Nov
10
Dec
13
Jan
16
Feb
43
Mar
28
Apr
26
May
29
Jun
53
Jul
44
Aug
29
Sep
37
Oct
The current month and year (faded) are still in progress. Source: NVD keyword search for “prompt injection” and “LLM”.
AI-driven phishing & deepfake fraud
recent reports · emerging threat2 recent reports in the last 90 days. Unlike software flaws, AI-enabled phishing, voice-clone scams and deepfake fraud aren't catalogued as CVEs, so there is no reliable multi-year count — this tracks recent reporting from security news and the UK NCSC.
Newly exploited vulnerabilities per month
added to CISA KEV · last 12 months
11
Nov
20
Dec
17
Jan
28
Feb
26
Mar
31
Apr
21
May
23
Jun
26
Jul
31
Aug
43
Sep
18
Oct
The faded bar is the current month, which is still in progress.
Exploited vulnerabilities by disclosure year
by the year each CVE was published · last 10 years
86
2017
89
2018
119
2019
146
2020
216
2021
132
2022
166
2023
164
2024
189
2025
177
2026
Many vulnerabilities being exploited today were first disclosed years ago — unpatched legacy flaws remain a major risk. The current year (faded) is still in progress.
Passwords & accounts breached
Have I Been Pwned · by when the breach occurred87MPasswords leaked in 2026so far
2.7BWorst year: 2025passwords leaked
1,046Breaches trackedin the HIBP database
Passwords leaked per year
1B
2017
971M
2018
1.3B
2019
898M
2020
110M
2021
62M
2022
117M
2023
664M
2024
2.7B
2025
87M
2026
Passwords leaked per month (last 12 months)
2M
Nov
10M
Dec
178k
Jan
0
Feb
25M
Mar
302k
Apr
64k
May
61M
Jun
0
Jul
145k
Aug
0
Sep
0
Oct
Counts accounts whose passwords were exposed, dated to when the breach happened. Recent months and the current year (faded) undercount, because breaches are often disclosed long afterwards.
Actively exploited — newest
CISA Known Exploited Vulnerabilities · patch these first
CVE-2026-102764
added 16 Oct 2026
BeyondTrust Remote Support
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Federal fix-by date: 19 Oct 2026
CVE-2025-61624
added 16 Oct 2026
Fortinet Multiple Products
Fortinet Multiple Products Path Traversal Vulnerability
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary f…
Federal fix-by date: 19 Oct 2026
CVE-2026-21589
added 15 Oct 2026
Atlassian Multiple Products
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or…
Federal fix-by date: 18 Oct 2026
CVE-2026-105134
added 14 Oct 2026
Ahsay AhsayCBS
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api…
Federal fix-by date: 17 Oct 2026
CVE-2026-76519
added 14 Oct 2026
Cisco Secure Email Gateway
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Federal fix-by date: 17 Oct 2026
CVE-2026-105133
added 14 Oct 2026
Ahsay AhsayCBS
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vul…
Federal fix-by date: 17 Oct 2026
CVE-2026-0322
added 14 Oct 2026
Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Federal fix-by date: 17 Oct 2026
CVE-2026-104935
added 13 Oct 2026
Ivanti Connect Secure
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Federal fix-by date: 16 Oct 2026
CVE-2026-96951
added 13 Oct 2026
Microsoft Windows
Microsoft Windows Command Injection Vulnerability
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Federal fix-by date: 16 Oct 2026
CVE-2015-5477
added 8 Oct 2026
ISC BIND
ISC BIND Data Processing Errors Vulnerability
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Federal fix-by date: 11 Oct 2026
CVE-2016-3081
added 8 Oct 2026
Apache Struts
Apache Struts Command Injection Vulnerability
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Federal fix-by date: 11 Oct 2026
CVE-2023-22894
added 8 Oct 2026
Strapi Strapi
Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could…
Federal fix-by date: 11 Oct 2026
Critical CVEs this week
newly published, CVSS 9.0+ · NVD
10
CVE-2026-11095715 Oct 2026
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE…
9.8
CVE-2026-10956612 Oct 2026
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with passw…
9.8
CVE-2020-3728214 Oct 2026
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), bac…
9.8
CVE-2026-11063514 Oct 2026
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings pa…
9.8
CVE-2026-11063614 Oct 2026
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_fi…
9.8
CVE-2026-11064014 Oct 2026
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shel…
9.8
CVE-2026-10276415 Oct 2026
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allo…
9.8
CVE-2026-11128115 Oct 2026
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send sin…
9.8
CVE-2026-11164316 Oct 2026
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endp…
9.8
CVE-2026-11169016 Oct 2026
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. A…
UK NCSC advisories & news
National Cyber Security CentreNCSC8 Oct 2026
China-linked malicious actors called out by UK and international partners for targeting sensitive data globally
Joint advisory with international partners highlights malicious targeting of organisations from a range of sectors across the globe.
NCSC6 Oct 2026
Incident affecting ASOS customers
ASOS has said it is investigating a cyber incident and that some customer personal information may have been accessed.
NCSC28 Sep 2026
Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited.
NCSC15 Sep 2026
Iranian cyber targeting of dissidents, activists and journalists
Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.
NCSC15 Sep 2026
UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists
UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.
NCSC27 Aug 2026
Disruptive cyber activity highlights risk from internet-exposed systems and edge devices
Owners of operational technology encouraged to address avoidable vulnerabilities, and build long-term cyber resilience.
How to use this
The Known Exploited Vulnerabilities (KEV) list is CISA's record of flaws that are confirmed being exploited in the wild — so they are the ones to patch first, especially any flagged as used in ransomware. The federal fix-by date is the US government deadline; treat it as a strong hint for your own systems. Critical CVEs are newly disclosed flaws scored 9.0+ that may not be exploited yet but warrant attention.
This is an awareness dashboard, not a substitute for a vulnerability-management programme. Always confirm whether a vulnerability affects your specific products and versions.
Sources & updates
From the CISA KEV catalog, the NVD (NIST National Vulnerability Database) and the UK NCSC. Refreshed several times a day; each entry links to its NVD or NCSC page.
Related: the Website health check, IT security audit and Global Situation Monitor.