Patch what attackers are using. Today.

Today's headlines

1. CVE-2026-19175 Use after free in PaymentsMicrosoft Security Update Guide · Oct 28
2. python-pillow-12.3.0-6.fc45Fedora security updates (Bodhi) · Oct 28
3. python-pillow-12.3.0-6.fc44Fedora security updates (Bodhi) · Oct 28
4. Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE AgentsHacker News · Oct 28
5. Nango (YC W23) Is Hiring Across Eng, FDE, Marketing, DevRelHacker News · Oct 28
6. Court strikes down West Virginia law barring disclosure of public officials’ personal dataThe Record · Oct 28
7. Police seize Virtualine bulletproof service tied to ransowmare, cybercrimeBleepingComputer · Oct 28
8. Japan Airlines warns of data breach as country grapples with multiple cyber incidentsThe Record · Oct 28
9. Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution FlawWIRED Security · Oct 28
10. Discord to let search engines index public server messagesBleepingComputer · Oct 28

The full daily feed →

Exploited right now

New on CISA's Known Exploited Vulnerabilities list — if you run it, patch it first.

1. KEV: CVE-2026-41709 — Broadcom VMware ESX: Broadcom VMWare ESX Insufficient Logging VulnerabilityCISA Known Exploited Vulnerabilities (KEV) · Oct 28
2. KEV: CVE-2026-46300 — Linux Kernel: Linux Kernel Missing Initialization of a Variable VulnerabilityCISA Known Exploited Vulnerabilities (KEV) · Oct 28
3. KEV: CVE-2026-48356 — Adobe Commerce and Magento: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityCISA Known Exploited Vulnerabilities (KEV) · Oct 27
4. KEV: CVE-2026-111497 — Google Brotli: Google Brotli Unchecked Return Value VulnerabilityCISA Known Exploited Vulnerabilities (KEV) · Oct 27
5. KEV: CVE-2026-109618 — PHP Group PHP: PHP Memory Corruption VulnerabilityCISA Known Exploited Vulnerabilities (KEV) · Oct 26
6. KEV: CVE-2026-109619 — PHP Group PHP: PHP Stale Internal Request-State VulnerabilityCISA Known Exploited Vulnerabilities (KEV) · Oct 26
7. KEV: CVE-2026-114625 — Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator SQL Injection VulnerabilityCISA Known Exploited Vulnerabilities (KEV) · Oct 23
8. KEV: CVE-2026-110447 — Collabora Collabora Online – Built-in CODE Server: Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCISA Known Exploited Vulnerabilities (KEV) · Oct 23

Full KEV catalog →