Am I affected, and exactly how do I fix it?
Exploitation status, per-distro fixed versions and copy-paste commands for every vulnerability that matters.
7
Active exploited 0-days
3
Unpatched alerts
12
KEV additions (7d)
48
Patches verified (24h)
Exploited this week
Full trackerPHP2ShellCVE-2026-109618+5
PHP-CGI argument injection to remote code execution
ExploitedCISA KEVPatch availableEPSS 94.2%
9.8 CriticalOct 21, 2026
AgentJackCVE-2026-104221
OpenSSH ssh-agent forwarding PKCS#11 provider load
ExploitedCISA KEVPartial patchEPSS 61.1%
8.1 HighOct 19, 2026
QuicFallCVE-2026-108840
nginx HTTP/3 QPACK use-after-free
ExploitedCISA KEVNo patchEPSS 38.7%
8.2 HighOct 23, 2026
LuaBreakCVE-2026-107305+1
Redis Lua sandbox escape via cjson
ExploitedPatch availableEPSS 21.4%
8.8 HighOct 20, 2026
PostgreSQLCVE-2026-105512
PostgreSQL libpq quoting bypass in psql
Patch availableEPSS 8.7%
8.1 HighOct 16, 2026
Node.jsCVE-2026-106990+1
Node.js undici request smuggling via chunk extensions
Patch availableEPSS 4.1%
6.5 MediumOct 18, 2026
Still being actively exploited
Log4Shell
10.0 CriticalCVE-2021-44228
Still the most-scanned bug on the internet. Embedded Log4j in vendor appliances keeps it alive.
CISA KEVPatch available
EternalBlue
8.1 HighCVE-2017-0144
Unpatched SMBv1 on OT and legacy hosts remains a top ransomware entry point.
CISA KEVPatch available
Heartbleed
7.5 HighCVE-2014-0160
Long-tail embedded devices with OpenSSL 1.0.1 still leak memory to scanners.
CISA KEVPatch available
Confluence RCE
10.0 CriticalCVE-2023-22527
Self-hosted 8.x instances past end-of-life continue to be mass-exploited for crypto mining.
CISA KEVEOL