Complete index
Zero-Day Vulnerability Archive
Search all tracked zero-day vulnerabilities and narrow the results by year, vendor, software, weakness type, or presence in the CISA and ENISA known exploited vulnerability catalogs.
| CVE | Vendor / Product | Vulnerability | CWE | Discovered | KEV |
|---|---|---|---|---|---|
| CVE-2026-118527 | IvantiIvanti Connect Secure (formerly Pulse Connect Secure) | Generation of Predictable Numbers or Identifiers in Ivanti Connect Secure (formerly Pulse Connect Secure) | CWE-340 | CISA KEV | |
| CVE-2026-111357 | IvantiIvanti Connect Secure (formerly Pulse Connect Secure) | Missing Authentication for Critical Function in Ivanti Connect Secure (formerly Pulse Connect Secure) | CWE-306 | CISA KEV | |
| CVE-2026-76418 | Cisco Systems, IncCisco Secure Firewall Adaptive Security Appliance (ASA) | Unchecked Return Value to NULL Pointer Dereference in Cisco Secure Firewall Threat Defense (FTD) and Cisco Secure Firewall Adaptive Security Appliance (ASA) | CWE-690 | — | |
| CVE-2026-114625 | Arista NetworksVeloCloud Orchestrator (VCO) | SQL injection in VeloCloud Orchestrator (VCO) | CWE-89 | — | |
| CVE-2026-102764 | BeyondTrustRemote Support | Authentication Bypass by Spoofing in Remote Support | CWE-290 | — | |
| CVE-2026-76519 | Cisco Systems, IncSecure Email Gateway | Relative Path Traversal in Secure Email Gateway | CWE-23 | CISA KEV | |
| CVE-2026-0322 | Palo Alto Networks, Inc.Palo Alto PAN-OS | Code Injection in Palo Alto PAN-OS | CWE-94 | — | |
| CVE-2026-96951 | MicrosoftMicrosoft Windows | Command injection in Microsoft Windows and Windows Server | CWE-77 | — | |
| CVE-2026-104935 | IvantiIvanti Connect Secure (formerly Pulse Connect Secure) | Authentication Bypass by Spoofing in Ivanti Connect Secure (formerly Pulse Connect Secure) | CWE-290 | — | |
| CVE-2026-105134 | AhsayAhsayCBS | Improper Authentication in AhsayCBS | CWE-287 | CISA KEV | |
| CVE-2026-105133 | AhsayAhsayCBS | Improper Authentication in AhsayCBS | CWE-287 | CISA KEV | |
| CVE-2026-102490 | ZammadZammad | Incorrect default permissions in Zammad | CWE-276 | — | |
| CVE-2026-102489 | ZammadZammad | Session fixation in Zammad | CWE-384 | ENISA KEV | |
| CVE-2026-104286 | Fortinet, IncFortiMail | Path traversal in FortiMail | CWE-22 | CISA KEV | |
| CVE-2026-76504 | Cisco Systems, IncCatalyst SD-WAN Manager (formerly SD-WAN vManage) | Improper Handling of URL Encoding (Hex Encoding) in Catalyst SD-WAN Manager (formerly SD-WAN vManage) | CWE-177 | — | |
| CVE-2026-84411 | MikroTikMikroTik RouterOS | Integer overflow in MikroTik RouterOS | CWE-190 | — | |
| CVE-2026-106931 | EG Secure SolutionsSiteGuard Server Edition | OS Command Injection in SiteGuard Server Edition | CWE-78 | — | |
| CVE-2026-86950 | Apple Inc.Apple iOS | Out-of-bounds write in Apple iOS and iPadOS | CWE-787 | — | |
| CVE-2026-88772 | CitrixCitrix Netscaler ADC | Buffer overflow in Citrix Netscaler ADC and Citrix NetScaler Gateway | CWE-119 | CISA KEV | |
| CVE-2026-88771 | CitrixCitrix Netscaler ADC | Input validation error in Citrix Netscaler ADC and Citrix NetScaler Gateway | CWE-20 | CISA KEV |
Showing 1–20 of 1,024 results