The 10 vulnerabilities from the past seven days that most need attention, ranked by a fixed rule: flaws CISA confirmed as actively exploited come first (those used in ransomware at the top, then newest first), followed by the highest-scoring Critical CVEs published by NIST’s National Vulnerability Database.
| # | CVE | What it affects | Why it ranks | Date |
|---|---|---|---|---|
| 1 | CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | Actively exploited (CISA KEV) | October 16, 2026 |
| 2 | CVE-2025-61624 | Fortinet Multiple Products Path Traversal Vulnerability | Actively exploited (CISA KEV) | October 16, 2026 |
| 3 | CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Actively exploited (CISA KEV) | October 15, 2026 |
| 4 | CVE-2026-105134 | Ahsay AhsayCBS Command Injection Vulnerability | Actively exploited (CISA KEV) | October 14, 2026 |
| 5 | CVE-2026-76519 | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | Actively exploited (CISA KEV) | October 14, 2026 |
| 6 | CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication Vulnerability | Actively exploited (CISA KEV) | October 14, 2026 |
| 7 | CVE-2026-0322 | Palo Alto Networks PAN-OS Code Injection Vulnerability | Actively exploited (CISA KEV) | October 14, 2026 |
| 8 | CVE-2026-96951 | Microsoft Windows Command Injection Vulnerability | Actively exploited (CISA KEV) | October 13, 2026 |
| 9 | CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | Actively exploited (CISA KEV) | October 13, 2026 |
| 10 | CVE-2026-110958 | A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attac… | CVSS 10 Critical (NVD) | October 15, 2026 |
Descriptions are quoted from CISA and NVD. Always confirm fixed versions in the vendor’s own advisory before prioritizing.
