Public record, CISA and CPSC data
Is your router, camera or home storage box on CISA's exploited list?
The US Cybersecurity and Infrastructure Security Agency keeps a list of security flaws that attackers are known to have used. 116 of them are in home and small office routers, cameras and storage devices from 30 makers. We list them by device type and brand, with what to do.
Most recently added
Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
Makers with three or more listed flaws
| Maker | Listed flaws | Device types |
|---|---|---|
| D-Link | 26 | Cameras and video recorders, Home storage and media servers, Routers and network gear |
| QNAP | 12 | Cameras and video recorders, Home storage and media servers |
| Cisco | 8 | Routers and network gear |
| NETGEAR | 8 | Routers and network gear |
| Zyxel | 7 | Home storage and media servers, Routers and network gear |
| TP-Link | 6 | Routers and network gear |
| MikroTik | 5 | Routers and network gear |
| Plex | 5 | Home storage and media servers |
| Ubiquiti | 4 | Routers and network gear |
| DrayTek | 3 | Routers and network gear |
| Realtek | 3 | Routers and network gear |
| Tenda | 3 | Routers and network gear |
More listings can reflect more devices in use, not only weaker security.
What this list means
CISA adds a flaw to its Known Exploited Vulnerabilities catalog when there is reliable evidence that attackers have used it in the wild and clear steps exist to fix or reduce it. A listed flaw usually has a patch or workaround from the maker. Some older devices are no longer supported and will not be fixed. If you own an affected model, check the maker's notice, update the firmware or replace the device if it is out of support.
Sources
- Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, version 2026.10.28, released 28 October 2026
- US Consumer Product Safety Commission, Recalls API (SaferProducts.gov), recalls dated 5 January 2023 to 22 October 2026
Checked 29 October 2026.