CVE Watchlist — Actively Exploited Vulnerabilities to Patch Now (2026)

Name: GENZ TECH CVE Watchlist
Creator: GENZ TECH
License: https://creativecommons.org/licenses/by/4.0/

patch these first

CVE-2026-58231 is the newest entry and the one with the shortest fuse: a CVSS 10.0 unauthenticated remote code execution flaw in SAP Commerce Cloud's Data Hub Adapter that attackers began probing three days after SAP shipped the fix, with no public proof-of-concept ever published. That gap is the lesson rather than the score. Nobody needed exploit code, because diffing the vendor patch against the previous release identifies the vulnerable functions directly, so treating 'no known PoC' as breathing room is a risk model that no longer holds for internet-reachable enterprise software. Patching it also demands more than applying the note: Commerce Cloud is built and deployed, so the running environment must be rebuilt and verified or the vulnerable build keeps serving. CVE-2026-68820 still matters too: a use-after-free in afd.sys, the Windows kernel driver behind the Sockets API, exploited in the wild to escalate a normal user account to SYSTEM. CISA added it to the Known Exploited Vulnerabilities catalog on August 11, 2026, and Check Point Research ties the activity to Lazarus inside its Operation Dream Job campaign against defence and aerospace engineers. Its CVSS score is only 7.0, which is exactly why severity-sorted dashboards will bury it: local privilege escalation is penalised for needing local access, yet it is the rung that turns a phishing foothold into full host control. It is also the fourth exploited afd.sys zero-day since 2022, after CVE-2024-38193, CVE-2025-21418 and CVE-2025-32709, which makes the driver a standing risk rather than a one-off. It shipped inside an unusually heavy August Patch Tuesday, counted as 421 CVEs including third-party advisories or 398 Microsoft-owned flaws depending on the tally, with 236 in Windows alone. Also still live: JetBrains TeamCity CVE-2026-63077 (CVSS 9.8), an XStream deserialization flaw reachable through the agent polling protocol that is under active exploitation with a published proof of concept, where any internet-facing server left unpatched past August 5 should be treated as compromised rather than merely vulnerable. Older but unresolved in many estates are the SonicWall SMA 1000 chain, the actively exploited WordPress Core pair, and the Kemp LoadMaster command-injection bug CVE-2026-8037.

show moreshow less

the watchlist

CVE	Type	Severity	Status	Do this	Story
CVE-2026-58231SAP Commerce Cloud, specifically the Data Hub Adapter. Commerce Cloud 2211 deployments are the named affected line. Fixed in SAP Security Note 3771065, shipped on SAP's August 2026 Patch Day.	Unauthenticated remote code execution built from two stacked defects. An authorization gap lets an attacker abuse a default authentication client, one that ships in a usable state rather than locked down by the operator, and an input validation gap lets certain functions accept specially crafted input without checking it. Chained, an anonymous network request is accepted as legitimate and then turned into arbitrary code execution against internal components. No user interaction, no prior foothold and no privilege requirement anywhere in the chain, which is why it scores a flat 10.0 rather than the high-8s where most critical enterprise flaws land.	CVSS 10	exploited	Apply Security Note 3771065, then rebuild and redeploy the application and confirm the environment actually serving traffic has moved to a fixed release, because marking the note applied does not change the running build; if a redeploy cannot happen immediately, configure an IP Filter Set to restrict access to the vulnerable endpoint as a stopgap and hunt backwards through logs from patch day onward.	↗ story
CVE-2026-59310VMware vCenter Server. Fixed builds are 9.1.0.0300, 9.0.2.0100, 8.0 U3k and 8.0 U2f; every supported build below those is affected. Disclosed by Broadcom in advisory VMSA-2026-0006 alongside CVE-2026-59309, an authentication bypass in the same product.	Path traversal in the vCenter Syslog server leading to arbitrary code execution. Exploitable by an unauthenticated attacker with only network access to the vCenter Server, with no user interaction. Observed in-the-wild chain: path traversal against the Syslog service, then a malicious cron job written to the appliance for persistence, then reverse_ssh (an open-source tool for SSH connections back to attacker infrastructure) for an outbound command and control channel. Broadcom states there is no workaround, so the update is the only remediation for the entry point.	CVSS 9.8	exploited	Update vCenter to 9.1.0.0300, 9.0.2.0100, 8.0 U3k or 8.0 U2f now, then hunt for the persistence the patch does not remove: audit appliance cron for entries you did not create, review outbound SSH sessions from vCenter to unrecognised infrastructure, and treat any estate whose Syslog service was network-reachable between July 29 and patch day as scanned.	↗ story
CVE-2026-68820Microsoft Windows, all supported versions. The flaw is in afd.sys, the kernel-mode Ancillary Function Driver for WinSock, which is loaded on every Windows host and reachable by any process that opens a socket without requiring elevated privileges.	Use-after-free in the Windows Sockets kernel driver. A locally authenticated attacker runs a crafted application that triggers a race condition between two threads touching the same driver object: one frees it while the other retains a reference and keeps operating on the freed memory. Reclaiming that allocation with attacker-controlled data lets the driver act on attacker-shaped structures in kernel context, yielding NT AUTHORITY\SYSTEM. This is the fourth exploited afd.sys zero-day since 2022, after CVE-2024-38193, CVE-2025-21418 and CVE-2025-32709.	CVSS 7	exploited · KEV	Apply the August 2026 Patch Tuesday updates now, prioritising developer workstations and any fleet where standard-user accounts are relied on as a security boundary, since that boundary is exactly what this bug removes.	↗ story
CVE-2026-63077JetBrains TeamCity, on-premise servers. The flaw is reachable through the agent polling protocol, which internet-facing build servers commonly expose.	Deserialization of untrusted data leading to unauthenticated remote code execution. The XStream allowlist was built additively: it registered TeamCity protocol classes without first removing XStream's existing default permissions, so the effective permission set stayed a permissive union rather than an exclusive allowlist. Rapid7's Stephen Fewer traced the root cause; the patch inserts NoTypePermission.NONE ahead of the allowlist. A published proof of concept writes .JSPWS files, executes OS commands with the TeamCity server process privileges, then deletes the files from disk, so no web shell remains for a later file scan to find.	CVSS 9.8	exploited · KEV	Patch on-premise TeamCity immediately, then treat any internet-facing server left unpatched after August 5 as compromised: rotate source control tokens, registry keys, cloud roles and signing keys the server could reach, review recent build artifacts and pipeline definitions for unauthorised changes, and move the agent polling protocol off the public internet.	↗ story
No CVE assigned (Coldcard firmware RNG)Coinkite Coldcard hardware wallets. Seeds generated on Mk2/Mk3 firmware 4.0.0 through 4.1.9, Mk4/Mk5 before 5.6.0, Q before 1.5.0Q, and Edge builds before 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q).	Weak key generation from a build-configuration error. Coldcard's firmware set MICROPY_HW_ENABLE_RNG to zero because Coinkite supplied its own RNG wrapper, but the cryptographic support library tested whether the macro was defined rather than whether its value was non-zero. A macro set to zero is still defined, so the library concluded hardware randomness was active and bound seed generation to MicroPython's Yasmarang fallback PRNG instead of the STM32 hardware RNG. Yasmarang was initialised from the chip's unique ID and timer registers, neither of which is secret, and collected no fresh entropy afterwards. Coinkite estimates effective entropy at roughly 40 bits on the Mk3 and about 72 bits on Mk4, Mk5 and Q, against 128 bits for a correctly generated seed. Introduced in firmware 4.0.0 in March 2021 and undetected for five years.	—	exploited	Install the patched firmware, then treat that as step one of two: the update does NOT repair an existing seed. Generate a completely new seed on the patched build and move every coin to addresses derived from it. Do not restore the old seed onto new firmware. Any seed created on an affected version must be treated as compromised, because weak-key exposure offers no reliable self-test.	↗ story
CVE-2026-20316Cisco Secure Firewall Management Center (FMC) software, trains 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0.	Static credentials for a low-privilege account compiled into the shipped software image. Every installation of an affected version carries the same username and password, with no per-device derivation and no first-boot rotation, so an unauthenticated attacker who can reach the management interface simply logs in. The account cannot administer the appliance, but on a firewall management console read access covers access-control policy, object groups, network topology as expressed in rules, and device names and versions. Cisco assigned a Security Impact Rating of High despite the modest CVSS base score, because the leaked data is reconnaissance input for a follow-on attack and the flaw is expected to be chained with a privilege-escalation issue.	CVSS 5.3	exploited · KEV	Apply the Cisco hotfix for your FMC train immediately; there is no configuration workaround because the credential lives in the binary. Then hunt for prior compromise by searching the appliance message log for license activity (cat /var/log/messages \| grep license) and looking for references to /var/tmp/license.tmp, pulling archived log files too since exploitation dates to early July and rotation may have aged out the evidence. Independently, restrict the management interface to an out-of-band VLAN or jump host.	↗ story
Multiple (7)Langflow, n8n, Citrix NetScaler ADC, Apache Tomcat, Marimo Notebook, Palo Alto PAN-OS User-ID Portal and Windows IKE Extensions, as used together in one AI-orchestrated campaign documented by Palo Alto Networks Unit 42.	Not a single flaw but a toolkit: seven already-public CVEs assembled into one campaign in which DeepSeek, running inside the open-source Hermes Agent framework and tasked over Telegram, autonomously enumerated exposed hosts through FOFA, pulled proof-of-concept code from GitHub, ranked targets by CVSS and repository popularity, and probed them without operator input. The set is CVE-2026-33017 (Langflow, 9.8), CVE-2026-21858 with CVE-2025-68613 (n8n, 10.0 and 9.9), CVE-2026-3055 (NetScaler ADC out-of-bounds read, 9.8), CVE-2026-34486 (Tomcat, 7.5), CVE-2026-39987 (Marimo, 9.8), CVE-2026-0300 (PAN-OS, 9.8, non-functional PoC only) and CVE-2026-33824 (Windows IKE Extensions, 9.8). Both fully autonomous exploitation attempts, against Langflow and n8n, failed on authentication requirements; every confirmed compromise came from the operator working manually.	—	exploited	Patch the NetScaler ADC and Marimo Notebook flaws first, since those are the two with confirmed impact in this campaign, then work through the remaining five. Separately, audit internal tooling exposed to the internet with convenience toggles enabled: Langflow's auto_login being off and n8n requiring form authentication are what stopped the autonomous half of this campaign, so those defaults are functioning as a security control.	↗ story
CVE-2026-16812Arista VeloCloud Orchestrator On-Prem (self-hosted SD-WAN management plane). Cloud-hosted VeloCloud is not affected.	Unauthenticated OS command injection. A crafted HTTP request to an exposed orchestrator endpoint passes attacker-controlled input into a shell command, giving privileged code execution with no credentials required. Because the orchestrator holds the credentials and tunnel configuration for every managed branch, data-centre and cloud edge, compromise of it means control of the policy applied across the whole SD-WAN. The management web interface is exposed by default and no supported configuration removes that exposure entirely, so there is no mitigation that substitutes for patching.	CVSS 10	exploited · KEV	Patch VeloCloud Orchestrator On-Prem to 5.2.3.14, 6.1.3.4 or 6.4.2.4 immediately, then rotate orchestrator credentials and API tokens and diff edge policy against a known-good backup, since this was exploited as a zero-day before the fix shipped.	↗ story
CVE-2026-63030, CVE-2026-60137WordPress Core (versions before 7.0.2, 6.9.5, 6.8.6)	An authentication bypass (CVE-2026-60137) chained with a remote code execution flaw in the REST API batch-processing feature (CVE-2026-63030), letting an unauthenticated attacker send one crafted request to the /batch endpoint and run arbitrary code on the server. The flaw is in WordPress Core itself, so it affects the base install regardless of plugins or theme.	—	exploited	Update to WordPress 7.0.2, 6.9.5 or 6.8.6 immediately; automatic updates cover supported installs. Audit the plugin directory and active REST endpoints for webshells disguised as plugins, and treat any site left unpatched during the exploitation window as potentially compromised, not merely at risk.	↗ story
CVE-2026-6875ServiceNow AI Platform (formerly Now Platform)	Sandbox escape to unauthenticated remote code execution	CVSS 9.5	exploited	Apply the July 13 ServiceNow patch to every self-hosted and on-premise instance immediately, then hunt for prior compromise rather than assuming the patch closed the incident, and rotate the downstream credentials and API tokens the instance holds for the systems it orchestrates.	↗ story
CVE-2026-20230Cisco Unified Communications Manager	Server-side request forgery (SSRF)	—	exploited · KEV	Apply Cisco's fixed Unified Communications Manager release immediately, treating it as an incident-response task rather than routine patching. Until patched, restrict network access to the CUCM administrative and web interfaces, segment voice infrastructure away from sensitive internal services, and monitor the server for anomalous outbound requests that would indicate SSRF abuse.	↗ story
CVE-2024-42009Roundcube Webmail	Cross-site scripting (XSS), near-zero interaction	CVSS 9.3	exploited	Update Roundcube to a fixed release immediately; the patch has existed since 2024 and closes the flaw outright. Put webmail behind SSO with phishing-resistant MFA, enforce a strict content-security policy to blunt XSS, monitor for anomalous or mass mailbox reads, and rotate credentials and session tokens for any account that opened a suspicious message.	↗ story
CVE-2026-25089 / CVE-2026-39808 / CVE-2026-39813Fortinet FortiSandbox	Auth bypass + OS command injection to unauthenticated RCE	—	exploited	Apply Fortinet's April and June FortiSandbox updates immediately (all three are patched). Keep FortiSandbox management interfaces off the internet, and assume-breach on any appliance that was exposed and unpatched: review for unexpected accounts, tasks, and outbound connections, and rotate every credential the box could reach.	↗ story
ShareFile Storage Zone zero-day (CVE pending)Progress ShareFile Storage Zone Controller	Path traversal (arbitrary file read/write, filesystem enumeration)	—	exploited	Apply Progress's new Storage Zone Controller update before bringing any server back online, keep the controller off the public internet, and assume-breach on anything that was exposed: hunt for files written to unexpected directories, unfamiliar accounts, and outbound connections, and rotate every credential the service account could reach. Install February's 5.12.4/v6 updates too if you skipped them.	↗ story
CVE-2026-56155 / CVE-2026-56164Microsoft ADFS & SharePoint Server	Elevation of privilege (identity federation; unauthenticated network)	—	exploited	Patch both before anything else in July's Patch Tuesday. If a SharePoint server cannot be updated at once, apply Microsoft's interim mitigation: enable the Antimalware Scan Interface (AMSI) and set Request Body Scan to Full. Review ADFS and SharePoint logs for anomalous privilege elevation during the exposure window.	↗ story
CVE-2026-55255Langflow (AI agent orchestration platform)	Cross-tenant IDOR / authorization bypass via user-controlled flow ID	CVSS 6.1	exploited · KEV	Update to Langflow 1.9.2 or later, then rotate every API key, LLM provider credential and cloud key stored in any flow; audit /api/v1/responses logs for cross-user flow IDs	↗ story
CVE-2026-8037Progress Kemp LoadMaster	Command injection → RCE	CVSS 9.6	exploited	Patch now; take management interfaces off the internet	↗ story
CVE-2026-45659Microsoft SharePoint Server (on-prem)	Unsafe deserialization → RCE	CVSS 8.8	exploited · KEV	Apply the May 2026 patch — every unpatched on-prem server is a target	↗ story
GHSA-mqjf-5f49-2fjhGeoServer, and the underlying GeoTools PostGIS JDBC datastore. Fixed in GeoServer 3.0.1, 2.28.5 and 2.27.6. For direct consumers of the library, org.geotools:gt-jdbc-postgis 35.0 is fixed in 35.1, 34.0 and later in 34.5, and 33.1 and later in 33.6.	Unauthenticated SQL injection with a path to remote code execution. The jsonArrayContains(<column>, <pointer>, <value>) function writes its third argument into generated SQL without escaping, so any caller who can submit an OGC filter can submit SQL instead. Preconditions narrow the real exposure: it requires the PostGIS DataStore implementation, PostGIS 12 or later, and a String or JSON field reachable through the filter. The code execution path specifically involves certain H2 database deployments rather than every install.	CVSS 9.8	was exploited	Update GeoServer to 3.0.1, 2.28.5 or 2.27.6, or bump gt-jdbc-postgis to 35.1, 34.5 or 33.6, then hunt backwards through access logs from August 12 for filter requests containing jsonArrayContains alongside SQL syntax, because exploitation began before any fix existed.	↗ story
LiteLLM 1.82.7 / 1.82.8 (no CVE assigned)LiteLLM, the open-source LLM proxy and Python SDK, versions 1.82.7 and 1.82.8 as distributed on PyPI. Any CI/CD pipeline, container build or developer machine that resolved LiteLLM during the 40-minute window the poisoned releases were live in March 2026.	Software supply chain compromise reached through a third dependency rather than a vulnerability in LiteLLM itself. The threat actor TeamPCP compromised a release of Aqua Security's Trivy scanner; LiteLLM's CI pipeline installed that Trivy build automatically and unpinned, which exposed LiteLLM's package publishing credentials and let the attacker push malicious releases to PyPI. The payload executed on every Python invocation, not only at install time, and harvested cloud keys, SSH keys, registry publishing tokens, database connection strings, AI provider API keys and CI runner memory.	—	was exploited	Treat every secret readable by the LiteLLM process as compromised and rotate it now: cloud access keys, SSH keys, package registry tokens, database connection strings and all AI provider API keys. Then pin build tooling to hashes rather than floating tags, and scope CI credentials to the job that needs them.	↗ story
CVE-2026-24301Microsoft Copilot Personal, and specifically its connected-account integrations: Gmail, Google Drive, Google Calendar and OneDrive. Found by Varonis Threat Labs (researcher Lior Adar) and reported to Microsoft in December 2025. Microsoft shipped the fix on August 18, 2026, almost eight months later. The fix is server-side, so there is no patch for users to install.	One-click prompt-injection chain leading to silent data theft, nicknamed CoSnitch. Three separate weaknesses chain together: clicking a single malicious link plants an attacker-controlled prompt, an undocumented autorun query parameter makes Copilot execute that prompt automatically, the prompt then reads the victim’s connected accounts, and the results leave through Copilot’s own built-in URL-fetch capability to an attacker-controlled webhook. No meaningful user interaction is needed after the click. The exfiltration channel is a legitimate product feature rather than a coding bug, which is why this class of flaw keeps recurring across assistant products.	—	disclosed	Confirm your users are on the patched Copilot Personal build, then audit which third-party accounts they have connected to Copilot and revoke every connector scope that is not actively needed: connector scope is the blast radius of the next prompt injection, and this fix closes one chain rather than the class.	↗ story
Unisoc modem chain (no CVE assigned)Unisoc systems-on-chip and their modem firmware. Confirmed by SSD Secure Disclosure on T7250 (Xiaomi Redmi A5), T606 (Motorola E13), T612 (Realme C33) and UIS7862A (vehicle head units). No patch exists: SSD says it contacted Unisoc through email and LinkedIn and received no response.	Two-stage remote chain ending in full Android kernel access. Stage one, disclosed March 2026, is remote code execution in the modem firmware triggered by malformed SDP inside SIP signalling on an incoming VoLTE video call. Stage two, published August 17, 2026, escalates out of the modem: affected Unisoc SoCs share one physical memory space between the modem processor and the application processor with no hardware-enforced boundary, so modem-context code writes a full-access configuration into the ARM Memory Protection Unit through coprocessor registers and maps the entire 32-bit physical address space as readable, writable and executable. Classified CWE-1189, improper isolation of shared resources on a system-on-a-chip.	—	disclosed	Inventory which devices in your estate run the listed Unisoc parts, including vehicle head units, and treat their baseband boundary as permanently weaker than their Android patch level suggests. Where the risk is targeted surveillance rather than opportunistic crime, disable VoLTE video calling if the carrier and handset allow it, since the entry point is the video call path specifically.	↗ story
Spaghettifying DRAM (no CVE assigned)AMD processors of Family 16h (Jaguar and Puma, roughly 2013 to 2014), the platforms the research was developed and tested on. Family 17h and later, meaning every Zen desktop, laptop and server part, are not publicly demonstrated: AMD stopped documenting the DRAM controller translation registers after 16h, but did not add lock bits to them.	Memory controller address-remapping attack, published as tooling rather than as a single vulnerability. Ring 0 code writes bit 22 of MMIO register 0xf80c2094 to toggle bank swizzle mode in the DRAM controller, which changes the GF(2) linear map from physical addresses onto rank, bank, row and column coordinates. A z3 SMT solver recovers the new mapping from sentinel value pairs, producing aliases that land on the physical capacitors backing protected carveouts. Range checks such as TSEG, the SMM lock, the PSP carveout and the IOMMU all evaluate correctly and are never asked for a forbidden address, so nothing is bypassed at the permission layer. Demonstrated reads cover the Platform Security Processor carveout including fTPM and RSA routines, SMM entry vectors and handlers at SMBASE+0x8000, the per core C6 idle save area, and the microcode patch RAM backup. Writes are supported through the pseudo-inverse of the same transform.	—	disclosed	No patch, advisory or CVE exists. Treat ring 0 on affected AMD Family 16h silicon as equivalent to ring -2 and to the PSP: stop modelling the firmware TPM, SMM or microcode as opaque to a compromised kernel on those platforms, which affects fTPM-backed disk encryption and attestation assumptions. On newer silicon, track whether AGESA ever adds a lock bit to the DRAM controller translation configuration, since undocumented registers are not write-protected registers.	↗ story

how to read this

exploited means confirmed in-the-wild attacks are happening now — patch out of cycle, today. was exploited means attacks happened before a patch shipped; if you were exposed unpatched, assume compromise and investigate, don't just update. disclosed means details are public but no confirmed exploitation yet — attackers read the same write-ups, so patch on an accelerated cadence.

Curated from our coverage, not an exhaustive CVE database — for completeness use CISA KEV alongside this list.

cite & embed

Free to cite and embed with attribution. Raw data: JSON · CSV. Embedding this live table adds it to your site and credits GENZ TECH.

CiteGENZ TECH. (2026). CVE Watchlist. https://genztech.blog/cve-watchlist/

Embed

<iframe src="https://genztech.blog/cve-watchlist/embed/" width="100%" height="470" loading="lazy" title="CVE Watchlist by GENZ TECH" style="border:1px solid #26282b;border-radius:10px;max-width:560px"></iframe>

quick answers

Which vulnerabilities are being actively exploited right now?

CVE-2026-58231 (SAP Commerce Cloud, specifically the Data Hub Adapter. Commerce Cloud 2211 deployments are the named affected line. Fixed in SAP Security Note 3771065, shipped on SAP's August 2026 Patch Day.); CVE-2026-59310 (VMware vCenter Server. Fixed builds are 9.1.0.0300, 9.0.2.0100, 8.0 U3k and 8.0 U2f; every supported build below those is affected. Disclosed by Broadcom in advisory VMSA-2026-0006 alongside CVE-2026-59309, an authentication bypass in the same product.); CVE-2026-68820 (Microsoft Windows, all supported versions. The flaw is in afd.sys, the kernel-mode Ancillary Function Driver for WinSock, which is loaded on every Windows host and reachable by any process that opens a socket without requiring elevated privileges.); CVE-2026-63077 (JetBrains TeamCity, on-premise servers. The flaw is reachable through the agent polling protocol, which internet-facing build servers commonly expose.); No CVE assigned (Coldcard firmware RNG) (Coinkite Coldcard hardware wallets. Seeds generated on Mk2/Mk3 firmware 4.0.0 through 4.1.9, Mk4/Mk5 before 5.6.0, Q before 1.5.0Q, and Edge builds before 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q).); CVE-2026-20316 (Cisco Secure Firewall Management Center (FMC) software, trains 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0.); Multiple (7) (Langflow, n8n, Citrix NetScaler ADC, Apache Tomcat, Marimo Notebook, Palo Alto PAN-OS User-ID Portal and Windows IKE Extensions, as used together in one AI-orchestrated campaign documented by Palo Alto Networks Unit 42.); CVE-2026-16812 (Arista VeloCloud Orchestrator On-Prem (self-hosted SD-WAN management plane). Cloud-hosted VeloCloud is not affected.); CVE-2026-63030, CVE-2026-60137 (WordPress Core (versions before 7.0.2, 6.9.5, 6.8.6)); CVE-2026-6875 (ServiceNow AI Platform (formerly Now Platform)); CVE-2026-20230 (Cisco Unified Communications Manager); CVE-2024-42009 (Roundcube Webmail); CVE-2026-25089 / CVE-2026-39808 / CVE-2026-39813 (Fortinet FortiSandbox); ShareFile Storage Zone zero-day (CVE pending) (Progress ShareFile Storage Zone Controller); CVE-2026-56155 / CVE-2026-56164 (Microsoft ADFS & SharePoint Server); CVE-2026-55255 (Langflow (AI agent orchestration platform)); CVE-2026-8037 (Progress Kemp LoadMaster); CVE-2026-45659 (Microsoft SharePoint Server (on-prem)). All should be patched immediately — active exploitation means attackers are using these flaws in the wild today.

What does KEV mean?

KEV is CISA's Known Exploited Vulnerabilities catalog — the US government's authoritative list of flaws confirmed to be exploited in real attacks. US federal agencies are required to patch KEV entries by a deadline; everyone else should treat a KEV listing as a patch-now signal.

How is this watchlist maintained?

Every entry comes from a vulnerability we covered in depth; the Story link goes to our analysis with primary sources (vendor advisories, CISA, researcher write-ups). Entries are added as our daily security coverage confirms them.

// maintained by GENZ TECH — threats, decoded