The ten most dangerous CVEs right now, ranked by real-world danger — confirmed exploitation first, then severity and exposure.
Ranked as of 27 Oct 2026. The top six are being exploited right now; the last four are 9.9–10.0 flaws with no exploitation reported yet — patch them before that changes.
Two PHP request-handling flaws that give unauthenticated remote code execution — memory corruption in one, stale request state in the other. CISA added both to its exploited catalog on October 26 after honeypots recorded 35 successful shell executions, and with roughly 36 million PHP endpoints exposed, this is the widest-open door on the list. Patches landed October 21. The Register reporting.
A Windows Shell command-injection flaw that bypasses Mark of the Web protections, so downloaded files can dodge SmartScreen and Protected View. Microsoft confirmed it as the one actively exploited zero-day in its record October Patch Tuesday, and CISA gave federal agencies three days to fix it. HackRead reporting.
SQL injection in on-premises VeloCloud Orchestrator that reaches privileged internal functionality with only an Enterprise Read Only session. Arista confirmed active exploitation — the third flaw in this product weaponized since July — with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. CyberSecureFox reporting.
OS command injection in the built-in CODE server for Nextcloud, reachable through proxy.php when the local document server isn't running. Attackers used it to plant web shells on Nextcloud servers and hunt credential stores and crypto wallets. Fixed in 26.4.303. CyberSecureFox reporting.
An out-of-bounds write in CoreGraphics that Apple says may have been used in an extremely sophisticated attack against specific people on iOS versions before 27. Fixed September 28 in 26.7.1, then backported to iOS 18 in the October 27.2 wave — the same flaw this blog reproduced crashing in the lab. Apple reporting.
Four chained Plex Media Server flaws exploited to deploy cryptominers and proxy malware. Fixed in Plex Media Server 1.43.3.10861 — self-hosted servers that haven't updated are the target. WorthView reporting.
An integer overflow in Ruby's Onigmo regex engine that lets an unauthenticated attacker run code on a self-managed GitLab server, via a crafted .org file in a public project. It reaches every release back to 7.0 (2014), and if you patched on October 12 you still need one patch higher. No exploitation reported as of October 22. The Hacker News reporting.
Unauthenticated arbitrary file read through the commits API: one URL-encoded character bypasses route handling and exposes files the GitLab process can read — including gitlab-secrets.json and database credentials. Needs a reachable instance with at least one public project. Truesec reporting.
Improper certificate validation in Partner Center that allows privilege escalation — the highest-severity flaw in Microsoft's record October release. No exploitation reported; the 10.0 score alone earns it a place here. ThreatAft reporting.
Authorization bypass through a user-controlled key in Microsoft Bookings — a near-maximum score on a widely deployed service. Patch with the October round. ThreatAft reporting.
Snapshot as of 27 Oct 2026. New exploited-catalog additions and disclosures will reshuffle this list — the live Cyber Feed tracks them daily.