Actively-exploited / critical CVEs correlated to FedRAMP-authorized products, read by dex — the gist, which products are hit, and what to do. Sorted with those under active attack (CISA KEV) first. Click a CVE for full detail.
Citrix NetScaler ADC and Gateway suffer from HTTP request/response smuggling allowing attackers to bypass security controls and execute arbitrary code.
▸ DO Remote code execution — patch the affected products on priority.
An unauthenticated LDAP attacker can take over Oracle Internet Directory in versions 12.2.1.4.0 and 14.1.2.1.0.
▸ DO Remote code execution — patch the affected products on priority.
Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
▸ DO Critical severity — schedule patching of the affected products.
A critical remote code execution flaw in Oracle Identity Manager Connector allows low-privileged attackers to take over the system via network access.
▸ DO Remote code execution — patch the affected products on priority.
A critical remote code execution flaw in Oracle Managed File Transfer allows low-privileged attackers to take over the system via network access.
▸ DO Remote code execution — patch the affected products on priority.
A critical LDAP server vulnerability in Oracle Internet Directory allows low-privileged attackers to take over the system via network access.
▸ DO Remote code execution — patch the affected products on priority.
A critical RMI-based vulnerability in Oracle Identity Manager allows low-privileged attackers to take over the system.
▸ DO Remote code execution — patch the affected products on priority.
IBM i 7.3-7.6 systems allow remote authenticated attackers to execute arbitrary code via an uncontrolled search path element.
▸ DO Remote code execution — patch the affected products on priority.
A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited pr
▸ DO Critical severity — schedule patching of the affected products.
A stack-based buffer overflow in Brocade Fabric SNMP daemons before 10.0.1 allows remote unauthenticated attackers to crash the daemon or execute arbitrary code via crafted SNMPv3 packets.
▸ DO Remote code execution — patch the affected products on priority.
A critical authorization bypass in Brocade Fabric OS before 10.0.1 lets compromised switches bypass admin authentication and execute actions like password resets and reboots.
▸ DO Remote code execution — patch the affected products on priority.
Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contained multiple internally identified vulnerabilities grouped under CVE-2026-76285 due to improper adherence to coding standards.
▸ DO Critical severity — schedule patching of the affected products.
A memory overflow vulnerability in Citrix NetScaler ADC and Gateway allows denial of service or unpredictable behavior before version 14.1-73.37.
▸ DO Critical severity — schedule patching of the affected products.
A critical memory overflow flaw in Citrix NetScaler ADC and Gateway allows remote denial of service or unpredictable behavior before version 14.1-73.37.
▸ DO Critical severity — schedule patching of the affected products.
CVE-2026-88771 allows unauthenticated remote code execution in Citrix NetScaler ADC and Gateway via improper input validation.
▸ DO Remote code execution — patch the affected products on priority.
A memory overflow vulnerability in Citrix NetScaler ADC and Gateway allows denial of service or unpredictable behavior before version 14.1-73.37.
▸ DO Critical severity — schedule patching of the affected products.
GitHub Enterprise Server's notebook viewer allowed SSRF to internal services, enabling secret extraction and remote code execution.
▸ DO Remote code execution — patch the affected products on priority.
Incorrect authorization in Google Chrome extensions allowed remote attackers to bypass system access restrictions into a privileged page via a crafted HTML page.
▸ DO Critical severity — schedule patching of the affected products.
A missing authorization flaw in Chrome's WebView on Android allowed remote attackers to bypass system access restrictions via crafted network traffic.
▸ DO Critical severity — schedule patching of the affected products.
A heap-based buffer overflow in Microsoft SQL Server allows remote code execution over a network.
▸ DO Remote code execution — patch the affected products on priority.
A heap-based buffer overflow in Microsoft SQL Server allows remote code execution over a network.
▸ DO Remote code execution — patch the affected products on priority.
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 suffer a critical remote code execution flaw from improper pointer validation.
▸ DO Remote code execution — patch the affected products on priority.
Citrix NetScaler ADC and Gateway versions 14.1-73.32 and 13.1-63.21 contain a critical vulnerability (CVE-2026-19490) that could allow remote code execution.
▸ DO Remote code execution — patch the affected products on priority.
An unauthenticated LDAP vulnerability in Oracle Internet Directory allows remote takeover of the server.
▸ DO Remote code execution — patch the affected products on priority.
Unauthenticated remote RMI exploitation allows full takeover of Oracle WebLogic Server instances.
▸ DO Remote code execution — patch the affected products on priority.
Unauthenticated attackers can take over Oracle Access Manager via SAML-based network access.
▸ DO Remote code execution — patch the affected products on priority.
An unauthenticated attacker can invoke protected tools via legacy HTTP endpoints in Google's mcp-toolbox v1.3.0 and v1.4.0 when the --enable-api flag is active.
▸ DO Remote code execution — patch the affected products on priority.
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, i
▸ DO Critical severity — schedule patching of the affected products.
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
▸ DO Remote code execution — patch the affected products on priority.
Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
▸ DO Critical severity — schedule patching of the affected products.
Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured
▸ DO Critical severity — schedule patching of the affected products.
Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
▸ DO Critical severity — schedule patching of the affected products.
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
▸ DO Critical severity — schedule patching of the affected products.
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code ex
▸ DO Remote code execution — patch the affected products on priority.
CVE-2026-106237 allows remote attackers to bypass site isolation in Google Chrome via a crafted HTML page, exposing sensitive permission data.
▸ DO Critical severity — schedule patching of the affected products.
Adobe Campaign Classic suffers from an SSRF vulnerability allowing privilege escalation without user interaction.
▸ DO Critical severity — schedule patching of the affected products.
A critical unpatched vulnerability in Oracle Web Services Manager allows low-privileged attackers to compromise the system and access all data via HTTP.
▸ DO Critical severity — schedule patching of the affected products.
IBM i 7.3-7.6 privilege escalation flaw allows authenticated remote attackers to escalate privileges via improper high-authority thread handling.
▸ DO Critical severity — schedule patching of the affected products.
Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
▸ DO Critical severity — schedule patching of the affected products.
Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
▸ DO Critical severity — schedule patching of the affected products.