Skip to the list

Patch Sonar

Zero-days under active attack, explained in plain English

Checking CISA… Exploited vulnerabilities from the last 90 days
Sources: CISA KEV catalog and vendor advisories

Status by technology

Patch today: widespread attacks or internet-facing Vendor-confirmed: the maker says it's exploited; CISA hasn't listed it yet New: just listed by CISA, details coming Update this week: targeted, or someone has to click All clear: nothing under attack Zero-day attacked before or as the fix came out

Everything under attack right now

Loading the latest list…

Adobe Commerce / MagentoHackers have broken into hundreds of online stores through a Magento upload flawPatch today · Oct 27, 2026
PHPTwo PHP flaws let attackers take over web servers with no loginPatch today · Oct 26, 2026 · zero-day
PHPTwo PHP flaws let attackers take over web servers with no loginPatch today · Oct 26, 2026 · zero-day
Ivanti Connect SecureAn Ivanti VPN flaw lets attackers in without a passwordPatch today · Oct 13, 2026 · zero-day
Cisco Secure Firewall Management CenterRansomware groups are exploiting a perfect-10 Cisco firewall flawPatch today · Sep 9, 2026
Citrix NetScalerA Citrix NetScaler login bypass has no workaroundPatch today · Sep 9, 2026
Fortinet FortiGateAttackers are hijacking unpatched FortiGate firewalls at scalePatch today · Sep 9, 2026
Cisco ASA and FTD firewallsCisco says attackers are exploiting a flaw in ASA and FTD firewallsVendor-confirmed zero-day · Oct 28, 2026 · zero-day
Linux KernelLinux Kernel Missing Initialization of a Variable VulnerabilityNewly listed by CISA · Oct 28, 2026
Broadcom VMware ESXBroadcom VMWare ESX Insufficient Logging VulnerabilityNewly listed by CISA · Oct 28, 2026
Arista VeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection VulnerabilityNewly listed by CISA · Oct 23, 2026 · zero-day
Collabora Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection VulnerabilityNewly listed by CISA · Oct 23, 2026
Plex Media ServerPlex Media Server External Control of File Name or Path VulnerabilityNewly listed by CISA · Oct 20, 2026
Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) VulnerabilityNewly listed by CISA · Oct 20, 2026
Plex Media ServerPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityNewly listed by CISA · Oct 20, 2026
Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) VulnerabilityNewly listed by CISA · Oct 20, 2026
Siemens Software CenterSiemens Software Center Uncontrolled Search Path Element VulnerabilityNewly listed by CISA · Oct 20, 2026 · zero-day
EG Secure Solutions SiteGuard Server EditionEG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityNewly listed by CISA · Oct 20, 2026 · zero-day
BeyondTrust Remote SupportBeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityNewly listed by CISA · Oct 16, 2026 · zero-day
Fortinet Multiple ProductsFortinet Multiple Products Path Traversal VulnerabilityNewly listed by CISA · Oct 16, 2026
Atlassian Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityNewly listed by CISA · Oct 15, 2026
Brotli / Node.jsA bug in a common compression library puts Node.js apps at riskUpdate this week · Oct 27, 2026 · zero-day
WindowsA Windows flaw lets booby-trapped files skip the “Are you sure?” warningUpdate this week · Oct 13, 2026 · zero-day
iPhone, iPad & MacApple fixes a flaw used in targeted attacks on iPhones and MacsUpdate this week · Sep 29, 2026 · zero-day
Google ChromeChrome's sixth zero-day of the year is patchedUpdate this week · Sep 4, 2026 · zero-day

Every flaw we've listed →

Free weekly email

The Monday Patch List

Every Monday: what's under attack, who needs to act, and exactly what to update. Five minutes to read.

Patch deadline calendar

Never miss a CISA deadline

Every actively exploited flaw comes with a federal fix deadline. Add them all to your calendar; it updates on its own.

Which deadlines Add to my calendar

Or subscribe by URL in Google Calendar ("From URL") or Outlook ("Subscribe from web"):

https://patchsonar.com/data/deadlines.ics

Patch Sonar Pro

Alerts for the tech you actually use

Pick your products, and we'll email you only when one of them is under attack. You can pick your stack now to filter this page; email alerts are coming later.

Pick my tech stack Email alerts coming later

Plain English

What's a zero-day?

A security hole that attackers found and used before the company that makes the software could fix it. "Zero days" is how much warning defenders got. Once a fix exists, the danger is people who haven't installed it yet. This list also includes older flaws attackers are still using; only flaws attacked before or as the fix came out get the Zero-day badge.

More plain-English terms · Vendor scorecards · Monthly reports

How we check

Every entry comes from CISA's catalog of vulnerabilities known to be exploited, or from the maker's own advisory, and links to its source. Every hour we check Microsoft, Google Chrome, Apple, Android, Fortinet, Palo Alto Networks, Cisco, VMware, Ivanti and Citrix, and list a flaw early only when the vendor itself says it's exploited, quoting its words. Attack-likelihood scores come from EPSS by FIRST.org. Always confirm version numbers with the vendor before you update. We never publish attack code.