ThiRU Threat Centre

The threats our analysts are acting on, as they're published

Alerts and advisories from the Australian Signals Directorate's Australian Cyber Security Centre, and newly exploited vulnerabilities from CISA's catalogue. Refreshed every hour.

30 Oct 2026EXPLOITED
CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityCISA known exploited · Ivanti Connect Secure · US federal patch deadline 2026-11-13
30 Oct 2026EXPLOITED
CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityCISA known exploited · Ivanti Connect Secure · US federal patch deadline 2026-11-02
29 Oct 2026EXPLOITED
CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityCISA known exploited · GitLab Community Edition and Enterprise Edition · US federal patch deadline 2026-11-01
29 Oct 2026EXPLOITED
CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityCISA known exploited · Cisco Secure Firewall ASA Software and Cisco Secure FTD Software · US federal patch deadline 2026-11-01
28 Oct 2026EXPLOITED
CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging VulnerabilityCISA known exploited · Broadcom VMware ESX · US federal patch deadline 2026-11-11
28 Oct 2026EXPLOITED
CVE-2026-46300: Linux Kernel Missing Initialization of a Variable VulnerabilityCISA known exploited · Linux Kernel · US federal patch deadline 2026-10-31
27 Oct 2026EXPLOITED
CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityCISA known exploited · Adobe Commerce and Magento · US federal patch deadline 2026-11-10
27 Oct 2026EXPLOITED
CVE-2026-111497: Google Brotli Unchecked Return Value VulnerabilityCISA known exploited · Google Brotli · US federal patch deadline 2026-11-10
26 Oct 2026EXPLOITED
CVE-2026-109618: PHP Memory Corruption VulnerabilityCISA known exploited · PHP Group PHP · US federal patch deadline 2026-10-29
26 Oct 2026EXPLOITED
CVE-2026-109619: PHP Stale Internal Request-State VulnerabilityCISA known exploited · PHP Group PHP · US federal patch deadline 2026-10-29
23 Oct 2026EXPLOITED
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection VulnerabilityCISA known exploited · Arista VeloCloud Orchestrator · US federal patch deadline 2026-10-26
23 Oct 2026EXPLOITED
CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCISA known exploited · Collabora Collabora Online – Built-in CODE Server · US federal patch deadline 2026-10-26
20 Oct 2026EXPLOITED
CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityCISA known exploited · EG Secure Solutions SiteGuard Server Edition · US federal patch deadline 2026-10-23
20 Oct 2026EXPLOITED
CVE-2026-96656: Plex Media Server External Control of File Name or Path VulnerabilityCISA known exploited · Plex Media Server · US federal patch deadline 2026-10-23
20 Oct 2026EXPLOITED
CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCISA known exploited · Plex Media Server · US federal patch deadline 2026-11-03

Sources: ASD’s ACSC alerts and advisories, CISA Known Exploited VulnerabilitiesUpdated 4 Nov 2026, 4:16 am AEDT

Act on it

Are you exposed to these vulnerabilities?

ThiRU checks your environment against every new advisory and patches or contains the risk for you.

Get your own threat view