Actively-Exploited

Microsoft SharePoint Server WS-Federation SecurityContextToken Deserialization → Unauthenticated RCE (CVE-2026-50522) new KEV EPSS 85%CVE-2026-50522webCRITICAL 9.8Patched2026-07-27Joomla Balbooa Forms Unauthenticated Arbitrary File Upload → RCE (CVE-2026-56291) new KEV EPSS 15%CVE-2026-56291webCRITICAL 9.8Unverified2026-07-27SimpleHelp OIDC Authentication Bypass via Unverified JWT Signature (CVE-2026-48558) new KEV EPSS 12%CVE-2026-48558webCRITICAL 10Patched2026-07-19Cisco Unified Communications Manager WebDialer SSRF → Arbitrary File Write → Root (CVE-2026-20230) new KEV EPSS 88%CVE-2026-20230networkCRITICAL 8.6Patched2026-07-19Adobe ColdFusion RDS Path Traversal → Arbitrary File Read/Write → RCE (CVE-2026-48282) new KEV EPSS 42%CVE-2026-48282webCRITICAL 10Patched2026-07-19SonicWall SMA1000 WorkPlace SSRF → Internal Erlang RPC Remote Code Execution (CVE-2026-15409) new KEV RW EPSS 84%CVE-2026-15409networkCRITICAL 10Patched2026-07-15Gitea Docker Image Reverse-Proxy Authentication Bypass — "One Header, Any User" (CVE-2026-20896) newCVE-2026-20896webCRITICAL 9.8Patched2026-07-11FortiSandbox 4.4.0-4.4.8 — OS Command Injection via tracer-behavior Endpoint (CVE-2026-39808) new KEV EPSS 93%CVE-2026-39808networkCRITICAL 9.8Unverified2026-07-05