{"meta":{"product":"Wildcard Watch","generated_at":"2026-10-24T10:46:08Z","today":"2026-10-24","windows":{"live":30,"act":14,"detail":120},"alerts_open":false,"kev_version":"2026.10.23","sources":[{"name":"CISA Known Exploited Vulnerabilities","count":1756},{"name":"ENISA EU Vulnerability Database","count":99},{"name":"Centre for Cybersecurity Belgium (CCB)","count":10},{"name":"CVE Program (cvelistV5) + CISA Vulnrichment","count":293},{"name":"FIRST EPSS","count":459},{"name":"CERT-EU security advisories","count":10},{"name":"Proof-of-concept repositories on GitHub (nomi-sec/PoC-in-GitHub)","count":194},{"name":"Exploit-DB (OffSec)","count":25094},{"name":"Metasploit Framework (Rapid7)","count":3176},{"name":"Nuclei-templates (ProjectDiscovery)","count":4515}],"news_outlets":["Cisco PSIRT","Fortinet PSIRT","Full Disclosure","GitLab security releases","GreyNoise research","Help Net Security","Ivanti security advisories (blog)","Juniper security advisories","Microsoft Security Update Guide","OPNsense announcements","Palo Alto Networks security advisories","QNAP security advisories","SecurityWeek","Siemens ProductCERT","Socket blog","Sophos security advisories","StepSecurity blog","Synology security advisories","The Hacker News","The Record","Veeam knowledge base (security)","WatchGuard PSIRT","oss-security"]},"stats":{"act":27,"act_nofix":5,"live":84,"new_7d":27,"no_fix":5,"ransomware_live":1,"be_live":10,"kinds":{"exploited":57,"critical":6,"warning":7,"breach":6,"supply-chain":8},"radar":10,"code_live":51,"days_since_critical":1,"last_critical":"2026-10-23-collabora-collabora-online-built-in-code-server","kev_12m":309},"incidents":[{"id":"2026-10-23-collabora-collabora-online-built-in-code-server","kind":"exploited","title":"Collabora Online – Built-in CODE Server: OS Command Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.","vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","product_display":"Collabora Online – Built-in CODE Server","keys":["collabora","collabora:collabora-online-built-in-code-server"],"cves":[{"id":"CVE-2026-110447","name":"OS Command Injection","description":"Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","epss":0.01225,"epss_pct":0.68615,"automatable":true,"impact":"total","fixed":["26.4.303"],"patch":"fixed","cwes":["CWE-78"]}],"severity":"critical","cvss":9.2,"epss":0.01225,"epss_pct":0.68615,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["26.4.303"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-23","added":"2026-10-23","updated":"2026-10-24","due":"2026-10-26","refs":[{"url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","label":"Vendor advisory (help.nextcloud.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100780","label":"ENISA EUVD EUVD-2026-100780","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110447","label":"CVE record CVE-2026-110447","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-110447","label":"Bluesky: search for CVE-2026-110447","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-14","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-110447","url":null},{"d":"2026-10-15","lane":"social","label":"2 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-16","lane":"social","label":"5 posts from 4 accounts (Bluesky 4)","url":null,"n":4},{"d":"2026-10-17","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-21","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-23","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447"},{"d":"2026-10-23","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100780"}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":1,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Collabora Online – Built-in CODE Server to 26.4.303 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":1},{"id":"2026-10-23-arista-velocloud-orchestrator","kind":"exploited","title":"Arista VeloCloud Orchestrator: SQL Injection","plain":"Attackers can read or change the database, over the internet.","summary":"Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","vendor":"Arista","product":"VeloCloud Orchestrator","product_display":"Arista VeloCloud Orchestrator","keys":["arista","arista:velocloud-orchestrator"],"cves":[{"id":"CVE-2026-114625","name":"SQL Injection","description":"Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","cvss":9.9,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.00555,"epss_pct":0.45586,"automatable":false,"impact":"total","fixed":["5.2.3.18","6.1.3.10","6.4.2.12"],"patch":"fixed","cwes":["CWE-89"]},{"id":"CVE-2026-110447","name":null,"description":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","fixed":[],"cwes":[]}],"severity":"critical","cvss":9.9,"epss":0.00555,"epss_pct":0.45586,"exploited":true,"sources":["CISA KEV","ENISA EUVD","News"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["5.2.3.18","6.1.3.10","6.4.2.12"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-22","added":"2026-10-23","updated":"2026-10-24","due":"2026-10-26","refs":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199","label":"Vendor advisory (arista.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108511","label":"ENISA EUVD EUVD-2026-108511","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114625","label":"CVE record CVE-2026-114625","kind":"registry"},{"url":"https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/","label":"SecurityWeek: Attackers Exploit Third Arista VCO Zero-Day in Four Months","kind":"news"},{"url":"https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html","label":"The Hacker News: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks","kind":"news"},{"url":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html","label":"The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud","kind":"news"},{"url":"https://bsky.app/search?q=CVE-2026-114625","label":"Bluesky: search for CVE-2026-114625","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-14","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-110447","url":null},{"d":"2026-10-15","lane":"social","label":"2 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-16","lane":"social","label":"5 posts from 4 accounts (Bluesky 4)","url":null,"n":4},{"d":"2026-10-17","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-21","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-22","lane":"press","label":"The Hacker News: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks","url":"https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html"},{"d":"2026-10-23","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625"},{"d":"2026-10-23","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108511"},{"d":"2026-10-23","lane":"press","label":"SecurityWeek: Attackers Exploit Third Arista VCO Zero-Day in Four Months","url":"https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/"},{"d":"2026-10-23","lane":"social","label":"8 posts from 7 accounts (Bluesky 7)","url":null,"n":7},{"d":"2026-10-24","lane":"press","label":"The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud","url":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html"},{"d":"2026-10-24","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1}],"outlets":["SecurityWeek","The Hacker News"],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":8,"recent":8,"platforms":["Bluesky"],"rising":true,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Arista VeloCloud Orchestrator to the fixed version for your release line (for example 5.2.3.18, 6.1.3.10 or 6.4.2.12).","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":2},{"id":"2026-10-22-ccb-php","kind":"exploited","title":"Multiple Critical vulnerabilities in PHP that can lead to Remote Code Execution","plain":"Attackers can run their own code.","summary":"The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.","vendor":null,"product":"PHP","product_display":"PHP","keys":["php"],"cves":[{"id":"CVE-2026-109618","name":"RCE via OOM corruption","description":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-109619","name":"RCE via stale global state","description":"PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-115560","name":null,"description":null,"cvss":null,"cvss_version":null,"vector":null,"severity":null,"fixed":[],"cwes":[]}],"severity":"critical","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["CCB","News"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":"Per the CCB advisory","label":"Fix available"},"be":{"title":"Multiple Critical vulnerabilities in PHP that can lead to Remote Code Execution","url":"https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-php-can-lead-remote-code-execution-patch","date":"2026-10-22"},"first_seen":"2026-10-21","added":"2026-10-22","updated":"2026-10-24","due":null,"refs":[{"url":"https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-php-can-lead-remote-code-execution-patch","label":"CCB warning (Belgium)","kind":"be"},{"url":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html","label":"The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware","kind":"news"},{"url":"https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html","label":"The Hacker News: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches","kind":"news"},{"url":"https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html","label":"The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't","kind":"news"},{"url":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html","label":"The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","kind":"news"},{"url":"https://therecord.media/php-php2shell-exploitation-attempts-pocs","label":"The Record: Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits","kind":"news"},{"url":"https://cert.europa.eu/publications/security-advisories/2026-018/","label":"CERT-EU security advisories: Critical Vulnerabilities in PHP","kind":"news"},{"url":"https://www.exploit-db.com/exploits/52704","label":"Exploit-DB 52704: PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-109618.yaml","label":"Nuclei template: PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection","kind":"exploit"},{"url":"https://bsky.app/search?q=CVE-2026-109618","label":"Bluesky: search for CVE-2026-109618","kind":"discussion"},{"url":"https://news.ycombinator.com/item?id=50193416","label":"Hacker News: the discussion","kind":"discussion"}],"events":[{"d":null,"lane":"scanner","label":"Nuclei template: PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-109618.yaml"},{"d":"2026-10-18","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-109618 (now 591 repositories)","url":null},{"d":"2026-10-20","lane":"social","label":"13 posts from 7 accounts (Bluesky 6, Hacker News 1)","url":null,"n":7},{"d":"2026-10-21","lane":"press","label":"The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't","url":"https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html"},{"d":"2026-10-21","lane":"press","label":"The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Aler","url":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html"},{"d":"2026-10-21","lane":"press","label":"The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emer","url":"https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html"},{"d":"2026-10-21","lane":"cert","label":"Fortinet PSIRT: PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-186"},{"d":"2026-10-21","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-109619 (now 20 repositories)","url":null},{"d":"2026-10-21","lane":"social","label":"535 posts from 227 accounts (Bluesky 201, Hacker News 26)","url":null,"n":227},{"d":"2026-10-21","lane":"cert","label":"WatchGuard advisory: WGSA-2026-0032 — PHP2Shell (CVE-2026-109618 and CVE-2026-109619)","url":"https://psirt.watchguard.com/WGSA-2026-0032"},{"d":"2026-10-21","lane":"cert","label":"OPNsense advisory: PHP2Shell (CVE-2026-109618, CVE-2026-109619) fix for 26.4.2p4, 26.1.11, 26.7.7","url":"https://forum.opnsense.org/index.php?topic=53191.msg276103#msg276103"},{"d":"2026-10-22","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-php-can-lead-remote-code-execution-patch"},{"d":"2026-10-22","lane":"press","label":"The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclos","url":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html"},{"d":"2026-10-22","lane":"code","label":"Exploit-DB 52704: PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE","url":"https://www.exploit-db.com/exploits/52704"},{"d":"2026-10-22","lane":"social","label":"266 posts from 120 accounts (Bluesky 110, Hacker News 10)","url":null,"n":120},{"d":"2026-10-22","lane":"cert","label":"Sophos advisory: Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell"},{"d":"2026-10-22","lane":"cert","label":"Veeam advisory: PHP2Shell Vulnerability (CVE-2026-109618/CVE-2026-109619)","url":"https://www.veeam.com/kb4953"},{"d":"2026-10-22","lane":"cert","label":"HPE Aruba Networking advisory: Multiple \"PHP2Shell\" Vulnerabilities identified in PHP allow for Unauthenticated Remote Co","url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05171.json"},{"d":"2026-10-23","lane":"press","label":"The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware","url":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html"},{"d":"2026-10-23","lane":"press","label":"The Hacker News: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches","url":"https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html"},{"d":"2026-10-23","lane":"cert","label":"Cisco PSIRT: Vulnerabilities in PHP Affecting Cisco Products: October 2026","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1"},{"d":"2026-10-23","lane":"press","label":"The Record: Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits","url":"https://therecord.media/php-php2shell-exploitation-attempts-pocs"},{"d":"2026-10-23","lane":"cert","label":"CERT-EU security advisories: Critical Vulnerabilities in PHP","url":"https://cert.europa.eu/publications/security-advisories/2026-018/"},{"d":"2026-10-23","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-115560 (now 6 repositories)","url":null},{"d":"2026-10-23","lane":"chatter","label":"oss-security: PHP Informational advisory: Session upload progress (CVE-2026-115560)","url":"https://seclists.org/oss-sec/2026/q4/359"},{"d":"2026-10-23","lane":"social","label":"120 posts from 55 accounts (Bluesky 52, Hacker News 3)","url":null,"n":55},{"d":"2026-10-23","lane":"cert","label":"Siemens advisory: SSA-566435 V1.0: PHP2Shell Vulnerabilities in Siemens Software Products","url":"https://cert-portal.siemens.com/productcert/html/ssa-566435.html"},{"d":"2026-10-23","lane":"cert","label":"Siemens advisory: SSA-566512 V1.0: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE18","url":"https://cert-portal.siemens.com/productcert/html/ssa-566512.html"},{"d":"2026-10-23","lane":"cert","label":"Juniper advisory: 2026-10 Reference Advisory: Status of PHP2Shell vulnerabilities on Juniper Products (CVE-2","url":"https://supportportal.juniper.net/s/article/2026-10-Reference-Advisory-Status-of-PHP2Shell-vulnerabilities-on-Juniper-Products-CVE-2026-109618-CVE-2026-109619"},{"d":"2026-10-23","lane":"cert","label":"F5 advisory: K000163878: PHP vulnerability CVE-2026-115560 (BIG-IP, BIG-IQ: still under evaluation)","url":"https://my.f5.com/manage/s/article/K000163878"},{"d":"2026-10-24","lane":"social","label":"48 posts from 17 accounts (Bluesky 17)","url":null,"n":17}],"curated":true,"featured":false,"note":null,"outlets":["The Hacker News","Cisco PSIRT","Fortinet PSIRT","Socket blog","Palo Alto Networks security advisories","The Record","CERT-EU security advisories"],"signals":{"poc":591,"exploitdb":1,"metasploit":0,"nuclei":true,"lists":1,"code":true,"measured":null,"social":{"week":389,"recent":67,"platforms":["Bluesky","Hacker News"],"rising":false,"partial":[],"talked":true}},"vendor_advisories":[{"vendor":"F5","title":"K000163878: PHP vulnerability CVE-2026-115560 (BIG-IP, BIG-IQ: still under evaluation)","url":"https://my.f5.com/manage/s/article/K000163878","date":"2026-10-23","key":"f5"},{"vendor":"HPE Aruba Networking","title":"Multiple \"PHP2Shell\" Vulnerabilities identified in PHP allow for Unauthenticated Remote Code Execution","url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05171.json","date":"2026-10-22","key":"hpe-aruba-networking"},{"vendor":"Juniper","title":"2026-10 Reference Advisory: Status of PHP2Shell vulnerabilities on Juniper Products (CVE-2026-109618, CVE-2026-109619)","url":"https://supportportal.juniper.net/s/article/2026-10-Reference-Advisory-Status-of-PHP2Shell-vulnerabilities-on-Juniper-Products-CVE-2026-109618-CVE-2026-109619","date":"2026-10-23","key":"juniper"},{"vendor":"OPNsense","title":"PHP2Shell (CVE-2026-109618, CVE-2026-109619) fix for 26.4.2p4, 26.1.11, 26.7.7","url":"https://forum.opnsense.org/index.php?topic=53191.msg276103#msg276103","date":"2026-10-21","key":"opnsense"},{"vendor":"Siemens","title":"SSA-566435 V1.0: PHP2Shell Vulnerabilities in Siemens Software Products","url":"https://cert-portal.siemens.com/productcert/html/ssa-566435.html","date":"2026-10-23","key":"siemens"},{"vendor":"Siemens","title":"SSA-566512 V1.0: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices","url":"https://cert-portal.siemens.com/productcert/html/ssa-566512.html","date":"2026-10-23","key":"siemens"},{"vendor":"Sophos","title":"Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell","date":"2026-10-22","key":"sophos"},{"vendor":"Veeam","title":"PHP2Shell Vulnerability (CVE-2026-109618/CVE-2026-109619)","url":"https://www.veeam.com/kb4953","date":"2026-10-22","key":"veeam"},{"vendor":"WatchGuard","title":"WGSA-2026-0032 — PHP2Shell (CVE-2026-109618 and CVE-2026-109619)","url":"https://psirt.watchguard.com/WGSA-2026-0032","date":"2026-10-21","key":"watchguard"}],"advisory_keys":["f5","hpe-aruba-networking","juniper","opnsense","siemens","sophos","veeam","watchguard"],"hidden":false,"action":"Install the security update for PHP from the vendor advisory.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":3},{"id":"2026-10-20-plex-media-server","kind":"exploited","title":"Plex Media Server: 4 flaws exploited together","plain":"Attackers can make the server send requests on their behalf, over the internet, with an admin account.","summary":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","vendor":"Plex","product":"Media Server","product_display":"Plex Media Server","keys":["plex","plex:media-server"],"cves":[{"id":"CVE-2026-96652","name":"Server-Side Request Forgery (SSRF)","description":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","severity":"medium","epss":0.00455,"epss_pct":0.38559,"automatable":false,"impact":"partial","fixed":["1.43.3.10861"],"patch":"fixed","cwes":["CWE-918"]},{"id":"CVE-2026-96654","name":"Improper Neutralization of Encoded URI Schemes in a Web Page","description":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","cvss":6.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","severity":"medium","epss":0.00465,"epss_pct":0.39325,"automatable":true,"impact":"partial","fixed":["1.43.3.10861"],"patch":"fixed","cwes":["CWE-84"]},{"id":"CVE-2026-96655","name":"Server-Side Request Forgery (SSRF)","description":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","severity":"medium","epss":0.00455,"epss_pct":0.3856,"automatable":false,"impact":"partial","fixed":["1.43.3.10861"],"patch":"fixed","cwes":["CWE-918"]},{"id":"CVE-2026-96656","name":"External Control of File Name or Path","description":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","cvss":7.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.00816,"epss_pct":0.56677,"automatable":false,"impact":"total","fixed":["1.43.3.10861"],"patch":"fixed","cwes":["CWE-73"]}],"severity":"high","cvss":7.2,"epss":0.00816,"epss_pct":0.56677,"exploited":true,"sources":["CISA KEV","ENISA EUVD","News"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["1.43.3.10861"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-20","added":"2026-10-20","updated":"2026-10-21","due":"2026-10-23","refs":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","label":"Vendor advisory (forums.plex.tv)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85367","label":"ENISA EUVD EUVD-2026-85367","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85368","label":"ENISA EUVD EUVD-2026-85368","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85369","label":"ENISA EUVD EUVD-2026-85369","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85370","label":"ENISA EUVD EUVD-2026-85370","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96656","label":"CVE record CVE-2026-96656","kind":"registry"},{"url":"https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html","label":"The Hacker News: CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws","kind":"news"},{"url":"https://bsky.app/search?q=CVE-2026-96654","label":"Bluesky: search for CVE-2026-96654","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-23","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-17","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-96652 (now 5 repositories)","url":null},{"d":"2026-10-18","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-96656","url":null},{"d":"2026-10-20","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656"},{"d":"2026-10-20","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85367"},{"d":"2026-10-21","lane":"press","label":"The Hacker News: CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws","url":"https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html"},{"d":"2026-10-21","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-23","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"outlets":["The Hacker News"],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":1,"recent":1,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Plex Media Server to 1.43.3.10861 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":4},{"id":"2026-10-20-inc","kind":"exploited","title":"Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.","vendor":"Palo Alto Networks","product":"multiple products","product_display":"Palo Alto Networks (multiple products)","keys":["palo-alto-networks","palo-alto-networks:cloud-ngfw","palo-alto-networks:pan-os","palo-alto-networks:prisma-access"],"cves":[{"id":"CVE-2026-0257","name":"PAN-OS: GlobalProtect Authentication Bypass","description":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.","cvss":7.8,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red","severity":"high","epss":0.96895,"epss_pct":0.9989,"automatable":false,"impact":"total","fixed":["12.1.4-h6","11.2.4-h17","11.1.4-h33","10.2.7-h34","10.2.10-h36","11.2.7-h13"],"patch":"fixed","cwes":[]}],"severity":"high","cvss":7.8,"epss":0.96895,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["The Hacker News"],"ransomware":true,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["12.1.4-h6","11.2.4-h17","11.1.4-h33","10.2.7-h34","10.2.10-h36","11.2.7-h13"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-20","added":"2026-10-20","updated":"2026-10-20","due":null,"refs":[{"url":"https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html","label":"The Hacker News: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA","kind":"news"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0257","label":"CVE record CVE-2026-0257","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-0257.yaml","label":"Nuclei template: Palo Alto Networks PAN-OS - Authentication Bypass","kind":"exploit"},{"url":"https://bsky.app/search?q=CVE-2026-0257","label":"Bluesky: search for CVE-2026-0257","kind":"discussion"}],"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Palo Alto Networks PAN-OS - Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-0257.yaml"},{"d":"2026-05-13","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-05-29","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-0257 (now 7 repositories)","url":null},{"d":"2026-10-11","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-12","lane":"social","label":"2 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-19","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-20","lane":"press","label":"The Hacker News: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA","url":"https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html"},{"d":"2026-10-20","lane":"social","label":"3 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-21","lane":"social","label":"2 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-24","lane":"social","label":"3 posts from 1 account (Bluesky 1)","url":null,"n":1}],"curated":false,"featured":false,"note":null,"signals":{"poc":7,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":7,"recent":1,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"Update the affected Palo Alto Networks products to the fixed version for your release line (for example 12.1.4-h6, 11.2.4-h17 or 11.1.4-h33).","also":["Ransomware groups are known to use this."],"urgency":"act","action_label":"Patch now","live":true,"age_days":4},{"id":"2026-10-16-beyondtrust-remote-support","kind":"exploited","title":"BeyondTrust Remote Support: Authentication Bypass by Spoofing","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.","vendor":"BeyondTrust","product":"Remote Support","product_display":"BeyondTrust Remote Support","keys":["beyondtrust","beyondtrust:remote-support"],"cves":[{"id":"CVE-2026-102764","name":"Authentication Bypass by Spoofing","description":"BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.","cvss":9.3,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","epss":0.0118,"epss_pct":0.67457,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-290"]}],"severity":"critical","cvss":9.3,"epss":0.0118,"epss_pct":0.67457,"exploited":true,"sources":["CISA KEV","ENISA EUVD","CCB"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":{"title":"Critical Vulnerability in BeyondTrust Remote Support","url":"https://ccb.belgium.be/advisories/warning-critical-vulnerability-beyondtrust-remote-support-patch-immediately","date":"2026-10-19"},"first_seen":"2026-10-16","added":"2026-10-16","updated":"2026-10-17","due":"2026-10-19","refs":[{"url":"https://ccb.belgium.be/advisories/warning-critical-vulnerability-beyondtrust-remote-support-patch-immediately","label":"CCB warning (Belgium)","kind":"be"},{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","label":"Vendor advisory (beyondtrust.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102427","label":"ENISA EUVD EUVD-2026-102427","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102764","label":"CVE record CVE-2026-102764","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-102764","label":"Bluesky: search for CVE-2026-102764","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-15","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-15","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-16","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764"},{"d":"2026-10-16","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102427"},{"d":"2026-10-16","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-102764 (now 3 repositories)","url":null},{"d":"2026-10-16","lane":"social","label":"9 posts from 9 accounts (Bluesky 9)","url":null,"n":9},{"d":"2026-10-17","lane":"social","label":"3 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-19","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-critical-vulnerability-beyondtrust-remote-support-patch-immediately"},{"d":"2026-10-19","lane":"social","label":"9 posts from 6 accounts (Bluesky 6)","url":null,"n":6},{"d":"2026-10-20","lane":"social","label":"3 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-21","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-22","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":3,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":11,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for BeyondTrust Remote Support: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":8},{"id":"2026-10-15-atlassian-multiple-products","kind":"exploited","title":"Atlassian (multiple products): Files or Directories Accessible to External Parties","plain":"Attackers can read files they should not reach, over the internet, without logging in.","summary":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.","vendor":"Atlassian","product":"Multiple Products","product_display":"Atlassian (multiple products)","keys":["atlassian","atlassian:multiple-products"],"cves":[{"id":"CVE-2026-21589","name":"Files or Directories Accessible to External Parties","description":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.","cvss":9.3,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","severity":"critical","epss":0.12711,"epss_pct":0.96263,"automatable":false,"impact":"total","fixed":["10.2.24","12.1.12","10.2.8","10.5.1","9.4.26","10.2.19"],"patch":"fixed","cwes":["CWE-552"]}],"severity":"critical","cvss":9.3,"epss":0.12711,"epss_pct":0.96263,"exploited":true,"sources":["CISA KEV","ENISA EUVD","CCB"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["10.2.24","12.1.12","10.2.8","10.5.1","9.4.26","10.2.19"],"note":null,"label":"Fix available"},"be":{"title":"Critical, unauthenticated path traversal in Atlassian (Bitbucket, Jira, Confluence, Bamboo, Crowd) Data Centre, Cricible, Fisheye","url":"https://ccb.belgium.be/advisories/warning-critical-unauthenticated-path-traversal-atlassian-bitbucket-jira-confluence","date":"2026-10-19"},"first_seen":"2026-10-15","added":"2026-10-15","updated":"2026-10-19","due":"2026-10-18","refs":[{"url":"https://ccb.belgium.be/advisories/warning-critical-unauthenticated-path-traversal-atlassian-bitbucket-jira-confluence","label":"CCB warning (Belgium)","kind":"be"},{"url":"https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com","label":"Vendor advisory (confluence.atlassian.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92807","label":"ENISA EUVD EUVD-2026-92807","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21589","label":"CVE record CVE-2026-21589","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml","label":"Nuclei template: Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read","kind":"exploit"},{"url":"https://bsky.app/search?q=CVE-2026-21589","label":"Bluesky: search for CVE-2026-21589","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml"},{"d":"2026-10-05","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-06","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-21589 (now 13 repositories)","url":null},{"d":"2026-10-10","lane":"social","label":"3 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-12","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-14","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-15","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"},{"d":"2026-10-15","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92807"},{"d":"2026-10-15","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-16","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-17","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-19","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-critical-unauthenticated-path-traversal-atlassian-bitbucket-jira-confluence"},{"d":"2026-10-20","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-22","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":13,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":2,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update the affected Atlassian products to the fixed version for your release line (for example 10.2.24, 12.1.12 or 10.2.8).","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":9},{"id":"2026-10-14-ahsay-ahsaycbs","kind":"exploited","title":"AhsayCBS: 2 flaws exploited together","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.","vendor":"Ahsay","product":"AhsayCBS","product_display":"AhsayCBS","keys":["ahsay","ahsay:ahsaycbs"],"cves":[{"id":"CVE-2026-105133","name":"Improper Authentication","description":"Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.","cvss":7.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","severity":"high","epss":0.05794,"epss_pct":0.93098,"automatable":true,"impact":"partial","fixed":["10.3.4"],"patch":"fixed","cwes":["CWE-287"]},{"id":"CVE-2026-105134","name":"Command Injection","description":"Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C","severity":"critical","epss":0.3831,"epss_pct":0.98568,"automatable":true,"impact":"total","fixed":["10.3.4"],"patch":"fixed","cwes":["CWE-77","CWE-78"]}],"severity":"critical","cvss":10.0,"epss":0.3831,"epss_pct":0.98568,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["10.3.4"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-14","added":"2026-10-14","updated":"2026-10-15","due":"2026-10-17","refs":[{"url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","label":"Vendor advisory (ahsay.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92079","label":"ENISA EUVD EUVD-2026-92079","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92078","label":"ENISA EUVD EUVD-2026-92078","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105134","label":"CVE record CVE-2026-105134","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-105133.yaml","label":"Nuclei template: AhsayCBS - JSON API Authentication Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: AhsayCBS - JSON API Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-105133.yaml"},{"d":"2026-10-04","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-05","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-105134","url":null},{"d":"2026-10-14","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134"},{"d":"2026-10-14","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92079"},{"d":"2026-10-14","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-105133","url":null},{"d":"2026-10-14","lane":"social","label":"3 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-15","lane":"social","label":"3 posts from 2 accounts (Bluesky 2)","url":null,"n":2}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update AhsayCBS to 10.3.4 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":10},{"id":"2026-10-14-cisco-secure-email-gateway","kind":"exploited","title":"Cisco Secure Email Gateway: Relative Path Traversal","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.","vendor":"Cisco","product":"Secure Email Gateway","product_display":"Cisco Secure Email Gateway","keys":["cisco","cisco:secure-email-gateway"],"cves":[{"id":"CVE-2026-76519","name":"Relative Path Traversal","description":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.01573,"epss_pct":0.75231,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-23"]},{"id":"CVE-2026-20353","name":"Cisco Secure Email Gateway Security Hardening Release","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-76440","name":"Cisco Secure Email Gateway Security Hardening Release","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76440 are related to path traversal issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-23.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-76441","name":"Cisco Secure Email Gateway Security Hardening Release","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76441 are related to issues with improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-76442","name":"Cisco Secure Email Gateway Security Hardening Release","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76442 are related to issues with improper validation of specified quantity in input that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-1284.","cvss":7.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-76443","name":"Cisco Secure Email Gateway Security Hardening Release","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","fixed":[],"cwes":[]}],"severity":"critical","cvss":9.8,"epss":0.01573,"epss_pct":0.75231,"exploited":true,"sources":["CISA KEV","ENISA EUVD","News"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-14","added":"2026-10-14","updated":"2026-10-15","due":"2026-10-17","refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","label":"Vendor advisory (sec.cloudapps.cisco.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101420","label":"ENISA EUVD EUVD-2026-101420","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76519","label":"CVE record CVE-2026-76519","kind":"registry"},{"url":"https://cert.europa.eu/publications/security-advisories/2026-017/","label":"CERT-EU security advisories: Critical Vulnerability in Cisco Secure Email Gateway","kind":"news"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20and%20Secure%20Email%20and%20Web%20Manager%20Security%20Hardening%20Release:%20September%202026%26vs_k=1","label":"Cisco PSIRT: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026","kind":"news"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20Arbitrary%20File%20Write%20Vulnerability%26vs_k=1","label":"Cisco PSIRT: Cisco Secure Email Gateway Arbitrary File Write Vulnerability","kind":"news"},{"url":"https://bsky.app/search?q=CVE-2026-76519","label":"Bluesky: search for CVE-2026-76519","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-14","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519"},{"d":"2026-10-14","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101420"},{"d":"2026-10-14","lane":"cert","label":"Cisco PSIRT: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: Se","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20and%20Secure%20Email%20and%20Web%20Manager%20Security%20Hardening%20Release:%20September%202026%26vs_k=1"},{"d":"2026-10-14","lane":"cert","label":"Cisco PSIRT: Cisco Secure Email Gateway Arbitrary File Write Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20Arbitrary%20File%20Write%20Vulnerability%26vs_k=1"},{"d":"2026-10-14","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-76519","url":null},{"d":"2026-10-14","lane":"social","label":"3 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-15","lane":"cert","label":"CERT-EU security advisories: Critical Vulnerability in Cisco Secure Email Gateway","url":"https://cert.europa.eu/publications/security-advisories/2026-017/"},{"d":"2026-10-15","lane":"social","label":"6 posts from 6 accounts (Bluesky 6)","url":null,"n":6},{"d":"2026-10-16","lane":"social","label":"5 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-19","lane":"social","label":"4 posts from 3 accounts (Bluesky 3)","url":null,"n":3}],"outlets":["CERT-EU security advisories","Cisco PSIRT"],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":3,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Cisco Secure Email Gateway: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":10},{"id":"2026-10-14-palo-alto-networks-pan-os","kind":"exploited","title":"Palo Alto Networks PAN-OS: Code Injection","plain":"Attackers can run their own code, over the internet, with an admin account.","summary":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.","vendor":"Palo Alto Networks","product":"PAN-OS","product_display":"Palo Alto Networks PAN-OS","keys":["palo-alto-networks","palo-alto-networks:pan-os"],"cves":[{"id":"CVE-2026-0322","name":"Code Injection","description":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.","cvss":8.6,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red","severity":"high","epss":0.01215,"epss_pct":0.68361,"automatable":false,"impact":"total","fixed":["12.2.4","12.1.10-h2","11.2.16","11.1.16-h3","10.2.18-h12"],"patch":"fixed","cwes":["CWE-94"]},{"id":"CVE-2026-0307","name":"GlobalProtect App: Local Privilege Escalation","description":"Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. This GlobalProtect app on iOS, Android and ChromeOS is not impacted.","cvss":5.9,"cvss_version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-0312","name":"Checkov by Prisma Cloud: Path Traversal","description":"Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.","cvss":4.3,"cvss_version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-0313","name":"Cortex XSOAR: OS Command Injection","description":"A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.","cvss":6.1,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-0314","name":"GlobalProtect App: Local Denial of Service (DoS) on Windows","description":"A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.","cvss":4.3,"cvss_version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-0315","name":"GlobalProtect App: Local Privilege Escalation Vulnerability on macOS","description":"A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.","cvss":5.9,"cvss_version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-0316","name":"PAN-OS: Stored Cross-Site Scripting (XSS)","description":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS® software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by these vulnerabilities.","cvss":1.1,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-0317","name":"PAN-OS: Denial of Service","description":"A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request. The security risk posed by this issue is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Cloud NGFW, Panorama, and Prisma® Access are not affected by this vulnerability.","cvss":1.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:L/U:Amber","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-0318","name":"PAN-OS: Denial of Service (DoS) on Panorama","description":"A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode. Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.","cvss":4.6,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-0319","name":"PAN-OS: Improper Input Handling","description":"An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability.","cvss":4.9,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-0320","name":"PAN-OS: Authenticated Admin Command Injection","description":"A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface. The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.","cvss":6.1,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-0321","name":"PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services","description":"Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Cloud NGFW and Panorama are not affected by this vulnerability.","cvss":6.6,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","severity":"medium","fixed":[],"cwes":[]}],"severity":"high","cvss":8.6,"epss":0.01215,"epss_pct":0.68361,"exploited":true,"sources":["CISA KEV","ENISA EUVD","News"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["12.2.4","12.1.10-h2","11.2.16","11.1.16-h3","10.2.18-h12"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-14","added":"2026-10-14","updated":"2026-10-17","due":"2026-10-17","refs":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0322","label":"Vendor advisory (security.paloaltonetworks.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101495","label":"ENISA EUVD EUVD-2026-101495","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0322","label":"CVE record CVE-2026-0322","kind":"registry"},{"url":"https://security.paloaltonetworks.com/CVE-2026-0317","label":"Palo Alto Networks security advisories: CVE-2026-0317 PAN-OS: Denial of Service Vulnerability (Severity: LOW)","kind":"news"},{"url":"https://security.paloaltonetworks.com/CVE-2026-0318","label":"Palo Alto Networks security advisories: CVE-2026-0318 PAN-OS: Denial of Service (DoS) on Panorama (Severity: MEDIUM)","kind":"news"},{"url":"https://security.paloaltonetworks.com/CVE-2026-0319","label":"Palo Alto Networks security advisories: CVE-2026-0319 PAN-OS: Improper Input Handling Vulnerability (Severity: MEDIUM)","kind":"news"},{"url":"https://security.paloaltonetworks.com/CVE-2026-0313","label":"Palo Alto Networks security advisories: CVE-2026-0313 Cortex XSOAR: OS Command Injection Vulnerability (Severity: MEDIUM)","kind":"news"},{"url":"https://bsky.app/search?q=CVE-2026-0322","label":"Bluesky: search for CVE-2026-0322","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-10","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-14","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322"},{"d":"2026-10-14","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101495"},{"d":"2026-10-14","lane":"cert","label":"Palo Alto Networks security advisories: CVE-2026-0318 PAN-OS: Denial of Service (DoS) on Panorama (Severity: MEDIUM)","url":"https://security.paloaltonetworks.com/CVE-2026-0318"},{"d":"2026-10-14","lane":"cert","label":"Palo Alto Networks security advisories: CVE-2026-0319 PAN-OS: Improper Input Handling Vulnerability (Severity: MEDIUM)","url":"https://security.paloaltonetworks.com/CVE-2026-0319"},{"d":"2026-10-14","lane":"cert","label":"Palo Alto Networks security advisories: CVE-2026-0313 Cortex XSOAR: OS Command Injection Vulnerability (Severity: MEDIUM)","url":"https://security.paloaltonetworks.com/CVE-2026-0313"},{"d":"2026-10-14","lane":"cert","label":"Palo Alto Networks security advisories: CVE-2026-0316 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability (Severity: LOW)","url":"https://security.paloaltonetworks.com/CVE-2026-0316"},{"d":"2026-10-14","lane":"cert","label":"Palo Alto Networks security advisories: CVE-2026-0312 Checkov by Prisma Cloud: Path Traversal Vulnerabilities (Severity: MEDIUM)","url":"https://security.paloaltonetworks.com/CVE-2026-0312"},{"d":"2026-10-14","lane":"cert","label":"Palo Alto Networks security advisories: CVE-2026-0314 GlobalProtect App: Local Denial of Service (DoS) on Windows (Severity: MEDIU","url":"https://security.paloaltonetworks.com/CVE-2026-0314"},{"d":"2026-10-14","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-15","lane":"cert","label":"Palo Alto Networks security advisories: CVE-2026-0317 PAN-OS: Denial of Service Vulnerability (Severity: LOW)","url":"https://security.paloaltonetworks.com/CVE-2026-0317"},{"d":"2026-10-15","lane":"cert","label":"Palo Alto Networks security advisories: CVE-2026-0320 PAN-OS: Authenticated Admin Command Injection Vulnerability (Severity: MEDIU","url":"https://security.paloaltonetworks.com/CVE-2026-0320"},{"d":"2026-10-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-0322","url":null},{"d":"2026-10-15","lane":"social","label":"3 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-16","lane":"social","label":"3 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-17","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-20","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"outlets":["Palo Alto Networks security advisories"],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":1,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Palo Alto Networks PAN-OS to the fixed version for your release line (for example 12.2.4, 12.1.10-h2 or 11.2.16).","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":10},{"id":"2026-10-13-ivanti-connect-secure","kind":"exploited","title":"Ivanti Connect Secure: Authentication Bypass by Spoofing","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.","vendor":"Ivanti","product":"Connect Secure","product_display":"Ivanti Connect Secure","keys":["ivanti","ivanti:connect-secure"],"cves":[{"id":"CVE-2026-104935","name":"Authentication Bypass by Spoofing","description":"Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.","cvss":8.6,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","severity":"high","epss":0.25982,"epss_pct":0.97984,"automatable":true,"impact":"total","fixed":["25.1.3.0","25.1.3.1","22.8R2.5","22.7R2.14"],"patch":"fixed","cwes":["CWE-290"]}],"severity":"high","cvss":8.6,"epss":0.25982,"epss_pct":0.97984,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["25.1.3.0","25.1.3.1","22.8R2.5","22.7R2.14"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-13","added":"2026-10-13","updated":"2026-10-13","due":"2026-10-16","refs":[{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98816","label":"ENISA EUVD EUVD-2026-98816","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104935","label":"CVE record CVE-2026-104935","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-104935.yaml","label":"Nuclei template: Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header","kind":"exploit"},{"url":"https://bsky.app/search?q=CVE-2026-104935","label":"Bluesky: search for CVE-2026-104935","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-104935.yaml"},{"d":"2026-10-13","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935"},{"d":"2026-10-13","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98816"},{"d":"2026-10-13","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-13","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-104935 (now 5 repositories)","url":null},{"d":"2026-10-13","lane":"social","label":"6 posts from 6 accounts (Bluesky 6)","url":null,"n":6},{"d":"2026-10-14","lane":"social","label":"9 posts from 8 accounts (Bluesky 8)","url":null,"n":8},{"d":"2026-10-15","lane":"social","label":"6 posts from 6 accounts (Bluesky 6)","url":null,"n":6},{"d":"2026-10-16","lane":"social","label":"5 posts from 4 accounts (Bluesky 4)","url":null,"n":4},{"d":"2026-10-17","lane":"social","label":"2 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-18","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-19","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":2,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Ivanti Connect Secure to the fixed version for your release line (for example 25.1.3.0, 25.1.3.1 or 22.8R2.5).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Patch now","live":true,"age_days":11},{"id":"2026-10-08-strapi-strapi","kind":"exploited","title":"Strapi: Cleartext Storage of Sensitive Information","plain":"Attackers can read sensitive data, over the internet, with an admin account.","summary":"Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.","vendor":"Strapi","product":"Strapi","product_display":"Strapi","keys":["strapi","strapi:strapi"],"cves":[{"id":"CVE-2023-22894","name":"Cleartext Storage of Sensitive Information","description":"Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.","cvss":7.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.03609,"epss_pct":0.89437,"automatable":false,"impact":"total","fixed":[],"patch":"eol","cwes":["CWE-312"]}],"severity":"high","cvss":7.2,"epss":0.03609,"epss_pct":0.89437,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"eol","versions":[],"note":null,"label":"Unsupported"},"be":null,"first_seen":"2026-10-08","added":"2026-10-08","updated":"2026-10-09","due":"2026-10-11","refs":[{"url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve","label":"Vendor advisory (strapi.io)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22894","label":"CVE record CVE-2023-22894","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2023-04-19","lane":"disclosure","label":"CVE published","url":null},{"d":"2023-04-24","lane":"code","label":"First public proof of concept on GitHub for CVE-2023-22894 (now 2 repositories)","url":null},{"d":"2026-10-08","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894"}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"This version of Strapi may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Upgrade or isolate","live":true,"age_days":16},{"id":"2026-09-22-f5-big-ip-apm","kind":"exploited","title":"F5 BIG-IP APM: Heap-based Buffer Overflow","plain":"Memory corruption that can let attackers run code, over the internet, without logging in.","summary":"F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.","vendor":"F5","product":"BIG-IP APM","product_display":"F5 BIG-IP APM","keys":["f5","f5:big-ip-apm"],"cves":[{"id":"CVE-2026-94127","name":"Heap-based Buffer Overflow","description":"F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.02226,"epss_pct":0.82601,"automatable":true,"impact":"total","fixed":["Hotfix-BIGIP-21.1.0.2.0.30.22-ENG","Hotfix-BIGIP-17.5.1.9.0.160.12-ENG","Hotfix-BIGIP-17.1.3.5.0.41.14-ENG"],"patch":"partial","cwes":["CWE-122"]}],"severity":"critical","cvss":9.8,"epss":0.02226,"epss_pct":0.82601,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"partial","versions":["Hotfix-BIGIP-21.1.0.2.0.30.22-ENG","Hotfix-BIGIP-17.5.1.9.0.160.12-ENG","Hotfix-BIGIP-17.1.3.5.0.41.14-ENG"],"note":"Engineering hotfixes only, through vendor support; no general release yet.","label":"Partial fix"},"be":null,"first_seen":"2026-09-22","added":"2026-09-22","updated":"2026-09-23","due":"2026-09-25","refs":[{"url":"https://my.f5.com/manage/s/article/K000162605","label":"Vendor advisory (my.f5.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84427","label":"ENISA EUVD EUVD-2026-84427","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94127","label":"CVE record CVE-2026-94127","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-22","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127"},{"d":"2026-09-22","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84427"},{"d":"2026-09-22","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-23","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-94127 (now 2 repositories)","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Only engineering hotfixes exist, through F5 support. Ask for the hotfix or apply the vendor's mitigation, and restrict who can reach F5 BIG-IP APM until a regular release is out.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Mitigate now","live":true,"age_days":32},{"id":"2026-09-18-linux-kernel","kind":"exploited","title":"Linux Kernel: 3 flaws exploited together","plain":"Memory corruption that can let attackers run code, over the internet, without logging in.","summary":"Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. CISA lists 2 more flaws in Linux Kernel as exploited on the same day (CVE-2025-39964, CVE-2026-53266).","vendor":"Linux","product":"Kernel","product_display":"Linux Kernel","keys":["linux","linux:kernel"],"cves":[{"id":"CVE-2025-39682","name":"Improper Check for Unusual or Exceptional Conditions","description":"Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.0288,"epss_pct":0.86761,"automatable":true,"impact":"total","fixed":["2902c3ebcca52ca845c03182000e8d71d3a5196f","c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677","3439c15ae91a517cf3c650ea15a8987699416ad9","29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e","62708b9452f8eb77513115b17c4f8d1a22ebf843","6.1.149"],"patch":"eol","cwes":["CWE-754"]},{"id":"CVE-2025-39964","name":"Race Condition","description":"Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.01362,"epss_pct":0.71568,"automatable":false,"impact":"total","fixed":["0f28c4adbc4a97437874c9b669fd7958a8c6d6ce","e4c1ec11132ec466f7362a95f36a506ce4dc08c9","1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8","7c4491b5644e3a3708f3dbd7591be0a570135b84","9aee87da5572b3a14075f501752e209801160d3d","45bcf60fe49b37daab1acee57b27211ad1574042"],"patch":"fixed","cwes":["CWE-362"]},{"id":"CVE-2026-53266","name":"Out-of-Bounds Write","description":"Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","severity":"high","epss":0.00827,"epss_pct":0.57056,"automatable":false,"impact":"total","fixed":["bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87","76280b78cc9f23bdc6438e10ad6dff148ef8375b","b7e91939ba9be805a62a257fa4e227dffbb88fa0","afd64b59c3de9bbbdd3759e834fdc55cda716e0b","153ea96c806aea395daba907a4f88480b6ad5093","b18675263db1147c8e1cab625400c13a0d87bd2d"],"patch":"eol","cwes":["CWE-787"]}],"severity":"critical","cvss":9.8,"epss":0.0288,"epss_pct":0.86761,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"eol","versions":["2902c3ebcca52ca845c03182000e8d71d3a5196f","c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677","3439c15ae91a517cf3c650ea15a8987699416ad9","29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e","62708b9452f8eb77513115b17c4f8d1a22ebf843","6.1.149"],"note":null,"label":"Unsupported"},"be":null,"first_seen":"2026-09-18","added":"2026-09-18","updated":"2026-10-15","due":"2026-09-21","refs":[{"url":"https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f","label":"Vendor advisory (git.kernel.org)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-39682","label":"CVE record CVE-2025-39682","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2025-09-05","lane":"disclosure","label":"CVE published","url":null},{"d":"2025-10-14","lane":"code","label":"First public proof of concept on GitHub for CVE-2025-39682 (now 2 repositories)","url":null},{"d":"2025-11-13","lane":"code","label":"First public proof of concept on GitHub for CVE-2025-39964 (now 2 repositories)","url":null},{"d":"2026-09-18","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682"},{"d":"2026-09-20","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-53266","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"This version of Linux Kernel may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Upgrade or isolate","live":true,"age_days":36},{"id":"2026-08-26-ajax-net-professional-ajax-net-professional","kind":"exploited","title":"Ajax.NET Professional: Deserialization of Untrusted Data","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","vendor":"Ajax.NET Professional","product":"Ajax.NET Professional","product_display":"Ajax.NET Professional","keys":["ajax-net-professional","ajax-net-professional:ajax-net-professional"],"cves":[{"id":"CVE-2021-23758","name":"Deserialization of Untrusted Data","description":"Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","cvss":8.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.82578,"epss_pct":0.99666,"automatable":false,"impact":"total","fixed":[],"patch":"eol","cwes":["CWE-502"]}],"severity":"high","cvss":8.1,"epss":0.82578,"epss_pct":0.99666,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"eol","versions":[],"note":null,"label":"Unsupported"},"be":null,"first_seen":"2026-08-26","added":"2026-08-26","updated":"2026-08-27","due":"2026-09-09","refs":[{"url":"https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23758","label":"CVE record CVE-2021-23758","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/windows/http/ajaxpro_deserialization_rce/","label":"Metasploit exploit: AjaxPro Deserialization Remote Code Execution","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2021-12-03","lane":"disclosure","label":"CVE published","url":null},{"d":"2021-12-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2021-23758","url":null},{"d":"2025-12-17","lane":"code","label":"Metasploit exploit: AjaxPro Deserialization Remote Code Execution","url":"https://www.rapid7.com/db/modules/exploit/windows/http/ajaxpro_deserialization_rce/"},{"d":"2026-08-26","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758"}],"signals":{"poc":1,"exploitdb":0,"metasploit":1,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"This version of Ajax.NET Professional may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.","also":[],"urgency":"act","action_label":"Upgrade or isolate","live":true,"age_days":59},{"id":"2026-08-26-red-hat-automatic-bug-reporting-tool","kind":"exploited","title":"Red Hat Automatic Bug Reporting Tool: Privilege Escalation","plain":"Attackers can gain higher privileges, once they have access to the device.","summary":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","vendor":"Red Hat","product":"Automatic Bug Reporting Tool","product_display":"Red Hat Automatic Bug Reporting Tool","keys":["red-hat","red-hat:automatic-bug-reporting-tool"],"cves":[{"id":"CVE-2015-5287","name":"Privilege Escalation","description":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.05003,"epss_pct":0.92212,"automatable":false,"impact":"total","fixed":[],"patch":"eol","cwes":[]}],"severity":"high","cvss":7.8,"epss":0.05003,"epss_pct":0.92212,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"eol","versions":[],"note":null,"label":"Unsupported"},"be":null,"first_seen":"2026-08-26","added":"2026-08-26","updated":"2026-08-27","due":"2026-09-09","refs":[{"url":"https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5287","label":"CVE record CVE-2015-5287","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/47421","label":"Exploit-DB 47421: ABRT - sosreport Privilege Escalation (Metasploit)","kind":"exploit"},{"url":"https://www.exploit-db.com/exploits/38832","label":"Exploit-DB 38832: RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation","kind":"exploit"},{"url":"https://www.exploit-db.com/exploits/38835","label":"Exploit-DB 38835: abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation","kind":"exploit"},{"url":"https://www.rapid7.com/db/modules/exploit/linux/local/abrt_sosreport_priv_esc/","label":"Metasploit exploit: ABRT sosreport Privilege Escalation","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2015-12-01","lane":"code","label":"Exploit-DB 38832: RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation","url":"https://www.exploit-db.com/exploits/38832"},{"d":"2015-12-01","lane":"code","label":"Exploit-DB 38835: abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation","url":"https://www.exploit-db.com/exploits/38835"},{"d":"2015-12-07","lane":"disclosure","label":"CVE published","url":null},{"d":"2019-09-25","lane":"code","label":"Exploit-DB 47421: ABRT - sosreport Privilege Escalation (Metasploit)","url":"https://www.exploit-db.com/exploits/47421"},{"d":"2026-04-22","lane":"code","label":"Metasploit exploit: ABRT sosreport Privilege Escalation","url":"https://www.rapid7.com/db/modules/exploit/linux/local/abrt_sosreport_priv_esc/"},{"d":"2026-08-26","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287"},{"d":"2026-08-27","lane":"code","label":"First public proof of concept on GitHub for CVE-2015-5287","url":null}],"signals":{"poc":1,"exploitdb":4,"metasploit":1,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"This version of Red Hat Automatic Bug Reporting Tool may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.","also":[],"urgency":"act","action_label":"Upgrade or isolate","live":true,"age_days":59},{"id":"2026-10-22-artex","kind":"supply-chain","title":"China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["The Hacker News"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-22","added":"2026-10-22","updated":"2026-10-22","due":null,"refs":[{"url":"https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html","label":"The Hacker News: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack","kind":"news"}],"events":[{"d":"2026-10-22","lane":"press","label":"The Hacker News: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack","url":"https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Check now","live":true,"age_days":2},{"id":"2026-10-22-cd","kind":"supply-chain","title":"eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["StepSecurity blog"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-22","added":"2026-10-22","updated":"2026-10-22","due":null,"refs":[{"url":"https://www.stepsecurity.io/blog/emudhra-emsign-ca-compromise-python-pip-ci-cd-update","label":"StepSecurity blog: eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update","kind":"news"}],"events":[{"d":"2026-10-22","lane":"press","label":"StepSecurity blog: eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update","url":"https://www.stepsecurity.io/blog/emudhra-emsign-ca-compromise-python-pip-ci-cd-update"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Check now","live":true,"age_days":2},{"id":"2026-10-21-litellm","kind":"supply-chain","title":"LiteLLM Compromised in Fresh Supply Chain Attack","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["SecurityWeek","Help Net Security","The Hacker News","Socket blog","StepSecurity blog"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-21","added":"2026-10-21","updated":"2026-10-24","due":null,"refs":[{"url":"https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/","label":"SecurityWeek: LiteLLM Compromised in Fresh Supply Chain Attack","kind":"news"},{"url":"https://www.helpnetsecurity.com/2026/10/22/litellm-compromised-supply-chain-attack-pypi-docker/","label":"Help Net Security: LiteLLM hit by second supply chain attack this year, users urged to rotate credentials","kind":"news"},{"url":"https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html","label":"The Hacker News: LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor","kind":"news"},{"url":"https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html","label":"The Hacker News: LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release","kind":"news"},{"url":"https://socket.dev/blog/litellm-compromise?utm_medium=feed","label":"Socket blog: LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials","kind":"news"},{"url":"https://socket.dev/blog/litellm-attack-timeline?utm_medium=feed","label":"Socket blog: New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack","kind":"news"}],"events":[{"d":"2026-10-21","lane":"press","label":"The Hacker News: LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor","url":"https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html"},{"d":"2026-10-21","lane":"press","label":"Socket blog: LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials","url":"https://socket.dev/blog/litellm-compromise?utm_medium=feed"},{"d":"2026-10-22","lane":"press","label":"Help Net Security: LiteLLM hit by second supply chain attack this year, users urged to rotate credentials","url":"https://www.helpnetsecurity.com/2026/10/22/litellm-compromised-supply-chain-attack-pypi-docker/"},{"d":"2026-10-22","lane":"press","label":"The Hacker News: LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release","url":"https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html"},{"d":"2026-10-22","lane":"press","label":"StepSecurity blog: litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Ho","url":"https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer"},{"d":"2026-10-23","lane":"press","label":"SecurityWeek: LiteLLM Compromised in Fresh Supply Chain Attack","url":"https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/"},{"d":"2026-10-23","lane":"press","label":"Socket blog: New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attac","url":"https://socket.dev/blog/litellm-attack-timeline?utm_medium=feed"},{"d":"2026-10-24","lane":"press","label":"StepSecurity blog: OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and","url":"https://www.stepsecurity.io/blog/ovhcloud-cli-github-release-swap-glassworm"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Check now","live":true,"age_days":3},{"id":"2026-10-18-ai","kind":"supply-chain","title":"OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["StepSecurity blog"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-18","added":"2026-10-18","updated":"2026-10-18","due":null,"refs":[{"url":"https://www.stepsecurity.io/blog/opencode-security-breach","label":"StepSecurity blog: OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond","kind":"news"}],"events":[{"d":"2026-10-18","lane":"press","label":"StepSecurity blog: OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. ","url":"https://www.stepsecurity.io/blog/opencode-security-breach"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"act","action_label":"Check now","live":true,"age_days":6},{"id":"2026-10-23-crafted","kind":"critical","title":"Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image","plain":null,"summary":"Pillow is a Python imaging library.","vendor":null,"product":null,"product_display":"","keys":[],"cves":[{"id":"CVE-2026-112900","name":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","description":"Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","epss":0.00431,"epss_pct":0.36366,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":9.2,"epss":0.00431,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["The Hacker News"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-23","added":"2026-10-23","updated":"2026-10-23","due":null,"refs":[{"url":"https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html","label":"The Hacker News: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image","kind":"news"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112900","label":"CVE record CVE-2026-112900","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-112900","label":"Bluesky: search for CVE-2026-112900","kind":"discussion"}],"events":[{"d":"2026-10-19","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-20","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-23","lane":"press","label":"The Hacker News: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted","url":"https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html"},{"d":"2026-10-23","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-112900","url":null},{"d":"2026-10-23","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"curated":false,"featured":false,"note":null,"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":2,"recent":1,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"act","action_label":"Patch now","live":true,"age_days":1},{"id":"2026-10-22-ccb-gitlab","kind":"warning","title":"Critical Unauthenticated Remote Code Execution in GitLab","plain":"Attackers can run their own code.","summary":"The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.","vendor":null,"product":"GitLab","product_display":"GitLab","keys":["gitlab"],"cves":[{"id":"CVE-2026-103515","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.","cvss":2.7,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-105711","name":"Use of Cache Containing Sensitive Information in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.","cvss":3.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-105777","name":"Insertion of Sensitive Information Into Sent Data in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-110264","name":"Integer Overflow or Wraparound in GitLab","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-112212","name":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.","cvss":7.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-112326","name":"Improper Cleanup on Thrown Exception in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.","cvss":3.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-112378","name":"Use of Less Trusted Source in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-12664","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing the token's restrictions, due to insufficient scope enforcement on a GraphQL field.","cvss":6.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-13319","name":"Authorization Bypass Through User-Controlled Key in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-14288","name":"Use of Incorrectly-Resolved Name or Reference in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.","cvss":3.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-15723","name":"Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.","cvss":8.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-16255","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.","cvss":5.9,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-100104","name":"Server-Side Request Forgery (SSRF) in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a time-of-check to time-of-use race condition in URL validation during repository import operations.","cvss":3.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-100755","name":"Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction.","cvss":4.6,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-101168","name":"Insertion of Sensitive Information into Log File in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.","cvss":6.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-103549","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.","cvss":2.7,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-104661","name":"Incorrect Privilege Assignment in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-105458","name":"Reliance on Untrusted Inputs in a Security Decision in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-14210","name":"Insufficient Granularity of Access Control in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-14552","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-14814","name":"Permissive Regular Expression in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.","cvss":8.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-16275","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-16301","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.","cvss":8.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-5954","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.","cvss":4.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-6567","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.","cvss":4.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-7767","name":"URL Redirection to Untrusted Site ('Open Redirect') in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.","cvss":5.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-78335","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token's scope, due to incorrect authorization checks.","cvss":4.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-81839","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.","cvss":7.7,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-82632","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token's intended scope, due to incorrect authorization of the import target namespace.","cvss":3.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-84284","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-85529","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-92528","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.","cvss":4.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-9268","name":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.","cvss":2.7,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","severity":"low","fixed":[],"cwes":[]},{"id":"CVE-2026-92883","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.","cvss":8.7,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-96893","name":"Improper Neutralization of Input Used for LLM Prompting in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.","cvss":7.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-97229","name":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","fixed":[],"cwes":[]}],"severity":"critical","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["CCB","News"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":"Per the CCB advisory","label":"Fix available"},"be":{"title":"Critical Unauthenticated Remote Code Execution in GitLab","url":"https://ccb.belgium.be/advisories/warning-critical-unauthenticated-remote-code-execution-gitlab-patch-immediately","date":"2026-10-22"},"first_seen":"2026-10-22","added":"2026-10-22","updated":"2026-10-23","due":null,"refs":[{"url":"https://ccb.belgium.be/advisories/warning-critical-unauthenticated-remote-code-execution-gitlab-patch-immediately","label":"CCB warning (Belgium)","kind":"be"},{"url":"https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html","label":"The Hacker News: Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws","kind":"news"},{"url":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html","label":"The Hacker News: Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases","kind":"news"},{"url":"https://cert.europa.eu/publications/security-advisories/2026-019/","label":"CERT-EU security advisories: Critical Vulnerability in GitLab Community and Enterprise Editions","kind":"news"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","label":"GitLab security releases: GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13","kind":"news"},{"url":"https://cert.europa.eu/publications/security-advisories/2026-016/","label":"CERT-EU security advisories: Critical Vulnerability in GitLab CE and EE","kind":"news"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","label":"GitLab security releases: GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8","kind":"news"},{"url":"https://bsky.app/search?q=CVE-2026-110264","label":"Bluesky: search for CVE-2026-110264","kind":"discussion"},{"url":"https://news.ycombinator.com/item?id=50158408","label":"Hacker News: the discussion","kind":"discussion"}],"events":[{"d":"2026-10-12","lane":"cert","label":"CERT-EU security advisories: Critical Vulnerability in GitLab CE and EE","url":"https://cert.europa.eu/publications/security-advisories/2026-016/"},{"d":"2026-10-12","lane":"cert","label":"GitLab security releases: GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"},{"d":"2026-10-12","lane":"social","label":"5 posts from 4 accounts (Bluesky 4)","url":null,"n":4},{"d":"2026-10-13","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-13","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-97229 (now 2 repositories)","url":null},{"d":"2026-10-13","lane":"social","label":"12 posts from 11 accounts (Bluesky 11)","url":null,"n":11},{"d":"2026-10-14","lane":"social","label":"7 posts from 6 accounts (Bluesky 6)","url":null,"n":6},{"d":"2026-10-15","lane":"social","label":"5 posts from 5 accounts (Bluesky 5)","url":null,"n":5},{"d":"2026-10-16","lane":"social","label":"2 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-17","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-18","lane":"social","label":"2 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-19","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-21","lane":"press","label":"The Hacker News: Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releas","url":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html"},{"d":"2026-10-21","lane":"cert","label":"GitLab security releases: GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"},{"d":"2026-10-21","lane":"social","label":"16 posts from 13 accounts (Bluesky 12, Hacker News 1)","url":null,"n":13},{"d":"2026-10-22","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-critical-unauthenticated-remote-code-execution-gitlab-patch-immediately"},{"d":"2026-10-22","lane":"cert","label":"CERT-EU security advisories: Critical Vulnerability in GitLab Community and Enterprise Editions","url":"https://cert.europa.eu/publications/security-advisories/2026-019/"},{"d":"2026-10-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-110264 (now 8 repositories)","url":null},{"d":"2026-10-22","lane":"social","label":"12 posts from 11 accounts (Bluesky 10, Hacker News 1)","url":null,"n":11},{"d":"2026-10-23","lane":"press","label":"The Hacker News: Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws","url":"https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html"},{"d":"2026-10-23","lane":"social","label":"15 posts from 11 accounts (Bluesky 11)","url":null,"n":11},{"d":"2026-10-24","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1}],"curated":false,"featured":false,"note":null,"outlets":["The Hacker News","CERT-EU security advisories","GitLab security releases"],"signals":{"poc":8,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":34,"recent":11,"platforms":["Bluesky","Hacker News"],"rising":false,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for GitLab from the vendor advisory.","also":[],"urgency":"act","action_label":"Patch now","live":true,"age_days":2},{"id":"2026-10-22-ccb-fortinet-releases-critical-security-hardening-updates-for-multiple-products","kind":"warning","title":"Fortinet Releases Critical Security Hardening Updates for Multiple Products","plain":null,"summary":"The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.","vendor":null,"product":"Fortinet Releases Critical Security Hardening Updates for Multiple Products","product_display":"Fortinet Releases Critical Security Hardening Updates for Multiple Products","keys":["fortinet-releases-critical-security-hardening-updates-for-multiple-products"],"cves":[],"severity":"critical","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["CCB"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":"Per the CCB advisory","label":"Fix available"},"be":{"title":"Fortinet Releases Critical Security Hardening Updates for Multiple Products","url":"https://ccb.belgium.be/advisories/warning-fortinet-releases-critical-security-hardening-updates-multiple-products-patch","date":"2026-10-22"},"first_seen":"2026-10-22","added":"2026-10-22","updated":"2026-10-22","due":null,"refs":[{"url":"https://ccb.belgium.be/advisories/warning-fortinet-releases-critical-security-hardening-updates-multiple-products-patch","label":"CCB warning (Belgium)","kind":"be"}],"events":[{"d":"2026-10-22","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-fortinet-releases-critical-security-hardening-updates-multiple-products-patch"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Fortinet Releases Critical Security Hardening Updates for Multiple Products. The CCB advisory lists the affected and fixed versions.","also":[],"urgency":"act","action_label":"Patch now","live":true,"age_days":2},{"id":"2026-10-22-ksmbd","kind":"critical","title":"Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"critical","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["The Hacker News"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-22","added":"2026-10-22","updated":"2026-10-22","due":null,"refs":[{"url":"https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html","label":"The Hacker News: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes","kind":"news"}],"events":[{"d":"2026-10-22","lane":"press","label":"The Hacker News: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes","url":"https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.","also":[],"urgency":"act","action_label":"Patch now","live":true,"age_days":2},{"id":"2026-10-21-expressway","kind":"critical","title":"Cisco Expressway Series Remote Code Execution Vulnerability","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root.","vendor":"Cisco","product":"Cisco TelePresence Video Communication Server (VCS) Expressway","product_display":"Cisco TelePresence Video Communication Server (VCS) Expressway","keys":["cisco","cisco:cisco-telepresence-video-communication-server-vcs-expressway"],"cves":[{"id":"CVE-2026-76466","name":"Cisco Expressway Series Remote Code Execution","description":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00381,"epss_pct":0.30934,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76473","name":"Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74. &nbsp;","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-76474","name":"Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-76475","name":"Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.","cvss":9.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","severity":"critical","fixed":[],"cwes":[]},{"id":"CVE-2026-76476","name":"Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp; The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-76477","name":"Cisco Unified Communications Products Hardening Release: October 2026 - Injection","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76477 are related to issues concerning improper neutralization of special elements used in an SQL command that are grouped under the Common Weakness Enumeration (CWE) Base CWE-89.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-76478","name":"Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-76479","name":"Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76479 are related to issues concerning improper limitation of a pathname to a restricted directory that are grouped under the Common Weakness Enumeration (CWE) Base CWE-22.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","fixed":[],"cwes":[]},{"id":"CVE-2026-76481","name":"Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76481 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.","cvss":7.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","severity":"high","fixed":[],"cwes":[]}],"severity":"critical","cvss":9.8,"epss":0.00381,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["Cisco PSIRT"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-21","added":"2026-10-21","updated":"2026-10-21","due":null,"refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1","label":"Cisco PSIRT: Cisco Expressway Series Remote Code Execution Vulnerability","kind":"news"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76466","label":"CVE record CVE-2026-76466","kind":"registry"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Products%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","label":"Cisco PSIRT: Cisco Unified Communications Products Security Hardening Release: October 2026","kind":"news"},{"url":"https://bsky.app/search?q=CVE-2026-76466","label":"Bluesky: search for CVE-2026-76466","kind":"discussion"}],"events":[{"d":"2026-10-21","lane":"cert","label":"Cisco PSIRT: Cisco Expressway Series Remote Code Execution Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1"},{"d":"2026-10-21","lane":"cert","label":"Cisco PSIRT: Cisco Unified Communications Products Security Hardening Release: October 2026","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Products%20Security%20Hardening%20Release:%20October%202026%26vs_k=1"},{"d":"2026-10-21","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-23","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":1,"recent":1,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"act","action_label":"Patch now","live":true,"age_days":3},{"id":"2026-10-20-fortisiem","kind":"critical","title":"Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.","vendor":null,"product":null,"product_display":"","keys":[],"cves":[{"id":"CVE-2026-106173","name":null,"description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.","cvss":9.4,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","severity":"critical","epss":0.00459,"epss_pct":0.38811,"automatable":true,"impact":"total","fixed":[],"patch":"fixed","cwes":[]}],"severity":"critical","cvss":9.4,"epss":0.00459,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["The Hacker News"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-20","added":"2026-10-20","updated":"2026-10-20","due":null,"refs":[{"url":"https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html","label":"The Hacker News: Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution","kind":"news"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106173","label":"CVE record CVE-2026-106173","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-106173","label":"Bluesky: search for CVE-2026-106173","kind":"discussion"},{"url":"https://news.ycombinator.com/item?id=50177101","label":"Hacker News: the discussion","kind":"discussion"}],"events":[{"d":"2026-10-13","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-20","lane":"press","label":"The Hacker News: Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution","url":"https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html"},{"d":"2026-10-20","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-106173 (now 4 repositories)","url":null},{"d":"2026-10-20","lane":"social","label":"5 posts from 5 accounts (Bluesky 5)","url":null,"n":5},{"d":"2026-10-21","lane":"social","label":"3 posts from 2 accounts (Bluesky 1, Hacker News 1)","url":null,"n":2}],"curated":false,"featured":false,"note":null,"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":7,"recent":0,"platforms":["Bluesky","Hacker News"],"rising":false,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"act","action_label":"Patch now","live":true,"age_days":4},{"id":"2026-10-16-ccb-juniper-networks-junos-os","kind":"warning","title":"Multiple Critical Vulnerabilities in Juniper Networks Junos OS","plain":null,"summary":"The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.","vendor":null,"product":"Juniper Networks Junos OS","product_display":"Juniper Networks Junos OS","keys":["juniper-networks-junos-os"],"cves":[],"severity":"critical","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["CCB"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":"Per the CCB advisory","label":"Fix available"},"be":{"title":"Multiple Critical Vulnerabilities in Juniper Networks Junos OS","url":"https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-juniper-networks-junos-os-patch-immediately","date":"2026-10-16"},"first_seen":"2026-10-16","added":"2026-10-16","updated":"2026-10-16","due":null,"refs":[{"url":"https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-juniper-networks-junos-os-patch-immediately","label":"CCB warning (Belgium)","kind":"be"}],"events":[{"d":"2026-10-16","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-juniper-networks-junos-os-patch-immediately"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Juniper Networks Junos OS. The CCB advisory lists the affected and fixed versions.","also":[],"urgency":"act","action_label":"Patch now","live":true,"age_days":8},{"id":"2026-10-20-eg-secure-solutions-siteguard-server-edition","kind":"exploited","title":"EG Secure Solutions SiteGuard Server Edition: OS Command Injection","plain":"Attackers can run their own code, once they have access to the device.","summary":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.","vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","product_display":"EG Secure Solutions SiteGuard Server Edition","keys":["eg-secure-solutions","eg-secure-solutions:siteguard-server-edition"],"cves":[{"id":"CVE-2026-106931","name":"OS Command Injection","description":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.","cvss":8.5,"cvss_version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"high","epss":0.0117,"epss_pct":0.67173,"automatable":false,"impact":"total","fixed":["Ver8.00 Update 5","Ver3.10","Ver7.00 Update 6"],"patch":"fixed","cwes":["CWE-78"]}],"severity":"high","cvss":8.5,"epss":0.0117,"epss_pct":0.67173,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["Ver8.00 Update 5","Ver3.10","Ver7.00 Update 6"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-20","added":"2026-10-20","updated":"2026-10-21","due":"2026-10-23","refs":[{"url":"https://www.eg-secure.co.jp/siteguard/news/alert-202610-1","label":"Vendor advisory (eg-secure.co.jp)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100814","label":"ENISA EUVD EUVD-2026-100814","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106931","label":"CVE record CVE-2026-106931","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-106931","label":"Bluesky: search for CVE-2026-106931","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-18","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-19","lane":"social","label":"4 posts from 4 accounts (Bluesky 4)","url":null,"n":4},{"d":"2026-10-20","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931"},{"d":"2026-10-20","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100814"},{"d":"2026-10-21","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":6,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"Update EG Secure Solutions SiteGuard Server Edition to the fixed version for your release line (for example Ver8.00 Update 5, Ver3.10 or Ver7.00 Update 6).","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":4},{"id":"2026-10-20-siemens-software-center","kind":"exploited","title":"Siemens Software Center: Uncontrolled Search Path Element","plain":"Attackers can run their own code, once they have access to the device, with an admin account.","summary":"Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.","vendor":"Siemens","product":"Software Center","product_display":"Siemens Software Center","keys":["siemens","siemens:software-center"],"cves":[{"id":"CVE-2026-110936","name":"Uncontrolled Search Path Element","description":"Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.","cvss":6.7,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","severity":"medium","epss":0.00238,"epss_pct":0.14021,"automatable":false,"impact":"total","fixed":["V4.0.9.8"],"patch":"fixed","cwes":["CWE-427"]}],"severity":"medium","cvss":6.7,"epss":0.00238,"epss_pct":0.14021,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["V4.0.9.8"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-19","added":"2026-10-20","updated":"2026-10-21","due":"2026-11-03","refs":[{"url":"https://productcert.siemens.com/productcert/html/ssa-580366.html","label":"Vendor advisory (productcert.siemens.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102072","label":"ENISA EUVD EUVD-2026-102072","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110936","label":"CVE record CVE-2026-110936","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-110936","label":"Bluesky: search for CVE-2026-110936","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-15","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-19","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102072"},{"d":"2026-10-20","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936"},{"d":"2026-10-20","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-110936","url":null},{"d":"2026-10-21","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-22","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":3,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Siemens Software Center to V4.0.9.8 or later.","also":[],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":5},{"id":"2026-10-16-fortinet-multiple-products","kind":"exploited","title":"Fortinet (multiple products): Path Traversal","plain":"Attackers can read or write files they should not reach, once they have access to the device, with an admin account.","summary":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","vendor":"Fortinet","product":"Multiple Products","product_display":"Fortinet (multiple products)","keys":["fortinet","fortinet:multiple-products"],"cves":[{"id":"CVE-2025-61624","name":"Path Traversal","description":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","cvss":5.4,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C","severity":"medium","epss":0.01081,"epss_pct":0.64866,"automatable":false,"impact":"total","fixed":[],"patch":"fixed","cwes":["CWE-22"]}],"severity":"medium","cvss":5.4,"epss":0.01081,"epss_pct":0.64866,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-16","added":"2026-10-16","updated":"2026-10-17","due":"2026-10-19","refs":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-122","label":"Vendor advisory (fortiguard.fortinet.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61624","label":"CVE record CVE-2025-61624","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2025-61624","label":"Bluesky: search for CVE-2025-61624","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-04-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-16","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624"},{"d":"2026-10-16","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-18","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-19","lane":"social","label":"3 posts from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":2,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for the affected Fortinet products from the vendor advisory.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":8},{"id":"2026-10-13-microsoft-windows","kind":"exploited","title":"Microsoft Windows: Command Injection","plain":"Attackers can run their own code, over the internet, without logging in, once a user opens a file or link.","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","vendor":"Microsoft","product":"Windows","product_display":"Microsoft Windows","keys":["microsoft","microsoft:windows"],"cves":[{"id":"CVE-2026-96951","name":"Command Injection","description":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","severity":"high","epss":0.01512,"epss_pct":0.74285,"automatable":false,"impact":"total","fixed":["20260925.100","10.0.14393.9612","10.0.17763.9376","10.0.19044.7807","10.0.19045.7807","10.0.22631.7652"],"patch":"fixed","cwes":["CWE-77"]}],"severity":"high","cvss":8.8,"epss":0.01512,"epss_pct":0.74285,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["20260925.100","10.0.14393.9612","10.0.17763.9376","10.0.19044.7807","10.0.19045.7807","10.0.22631.7652"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-13","added":"2026-10-13","updated":"2026-10-23","due":"2026-10-16","refs":[{"url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100274","label":"ENISA EUVD EUVD-2026-100274","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96951","label":"CVE record CVE-2026-96951","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-96951","label":"Bluesky: search for CVE-2026-96951","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-13","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951"},{"d":"2026-10-13","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100274"},{"d":"2026-10-13","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-13","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-14","lane":"social","label":"13 posts from 13 accounts (Bluesky 13)","url":null,"n":13},{"d":"2026-10-15","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-16","lane":"social","label":"3 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-18","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-19","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":2,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft Windows to the fixed version for your release line (for example 20260925.100, 10.0.14393.9612 or 10.0.17763.9376).","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":11},{"id":"2026-10-08-onlyoffice-docs","kind":"exploited","title":"ONLYOFFICE Docs: Server Path Traversal","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.","vendor":"ONLYOFFICE","product":"Docs","product_display":"ONLYOFFICE Docs","keys":["onlyoffice","onlyoffice:docs"],"cves":[{"id":"CVE-2021-3199","name":"Server Path Traversal","description":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.20136,"epss_pct":0.97454,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-22"]}],"severity":"critical","cvss":9.8,"epss":0.20136,"epss_pct":0.97454,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-08","added":"2026-10-08","updated":"2026-10-09","due":"2026-10-11","refs":[{"url":"https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3199","label":"CVE record CVE-2021-3199","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2021-01-22","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-08","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199"},{"d":"2026-10-12","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for ONLYOFFICE Docs: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":16},{"id":"2026-10-08-proftpd-proftpd","kind":"exploited","title":"ProFTPD: Improper Access Control","plain":"Attackers can reach functions they should not have access to, over the internet, without logging in.","summary":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","vendor":"ProFTPD","product":"ProFTPD","product_display":"ProFTPD","keys":["proftpd","proftpd:proftpd"],"cves":[{"id":"CVE-2015-3306","name":"Improper Access Control","description":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.99497,"epss_pct":0.99946,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-284"]}],"severity":"critical","cvss":10.0,"epss":0.99497,"epss_pct":0.99946,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-08","added":"2026-10-08","updated":"2026-10-09","due":"2026-10-11","refs":[{"url":"http://www.proftpd.org/","label":"Vendor advisory (proftpd.org)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3306","label":"CVE record CVE-2015-3306","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/37262","label":"Exploit-DB 37262: ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)","kind":"exploit"},{"url":"https://www.exploit-db.com/exploits/36803","label":"Exploit-DB 36803: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution","kind":"exploit"},{"url":"https://www.exploit-db.com/exploits/49908","label":"Exploit-DB 49908: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)","kind":"exploit"},{"url":"https://www.exploit-db.com/exploits/36742","label":"Exploit-DB 36742: ProFTPd 1.3.5 - File Copy","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: ProFTPd - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2015/CVE-2015-3306.yaml"},{"d":"2015-04-13","lane":"code","label":"Exploit-DB 36742: ProFTPd 1.3.5 - File Copy","url":"https://www.exploit-db.com/exploits/36742"},{"d":"2015-04-21","lane":"code","label":"Exploit-DB 36803: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution","url":"https://www.exploit-db.com/exploits/36803"},{"d":"2015-04-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2015-3306 (now 18 repositories)","url":null},{"d":"2015-05-18","lane":"disclosure","label":"CVE published","url":null},{"d":"2015-06-10","lane":"code","label":"Exploit-DB 37262: ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)","url":"https://www.exploit-db.com/exploits/37262"},{"d":"2021-05-26","lane":"code","label":"Exploit-DB 49908: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)","url":"https://www.exploit-db.com/exploits/49908"},{"d":"2026-04-22","lane":"code","label":"Metasploit exploit: ProFTPD 1.3.5 Mod_Copy Command Execution","url":"https://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec/"},{"d":"2026-10-08","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306"}],"signals":{"poc":18,"exploitdb":4,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for ProFTPD: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":16},{"id":"2026-10-08-isc-bind","kind":"exploited","title":"ISC BIND: Data Processing Errors","plain":"Attackers can crash or block the service, over the internet, without logging in.","summary":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.","vendor":"ISC","product":"BIND","product_display":"ISC BIND","keys":["isc","isc:bind"],"cves":[{"id":"CVE-2015-5477","name":"Data Processing Errors","description":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.","cvss":7.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","severity":"high","epss":0.99409,"epss_pct":0.99942,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-19"]}],"severity":"high","cvss":7.5,"epss":0.99409,"epss_pct":0.99942,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-08","added":"2026-10-08","updated":"2026-10-09","due":"2026-10-11","refs":[{"url":"https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272","label":"Vendor advisory (web.archive.org)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5477","label":"CVE record CVE-2015-5477","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/37721","label":"Exploit-DB 37721: ISC BIND 9 - TKEY (PoC)","kind":"exploit"},{"url":"https://www.exploit-db.com/exploits/37723","label":"Exploit-DB 37723: ISC BIND 9 - TKEY Remote Denial of Service (PoC)","kind":"exploit"},{"url":"https://www.rapid7.com/db/modules/auxiliary/dos/dns/bind_tkey/","label":"Metasploit auxiliary: BIND TKEY Query Denial of Service","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2015-07-29","lane":"disclosure","label":"CVE published","url":null},{"d":"2015-07-31","lane":"code","label":"First public proof of concept on GitHub for CVE-2015-5477 (now 7 repositories)","url":null},{"d":"2015-08-01","lane":"code","label":"Exploit-DB 37721: ISC BIND 9 - TKEY (PoC)","url":"https://www.exploit-db.com/exploits/37721"},{"d":"2015-08-05","lane":"code","label":"Exploit-DB 37723: ISC BIND 9 - TKEY Remote Denial of Service (PoC)","url":"https://www.exploit-db.com/exploits/37723"},{"d":"2025-05-15","lane":"code","label":"Metasploit auxiliary: BIND TKEY Query Denial of Service","url":"https://www.rapid7.com/db/modules/auxiliary/dos/dns/bind_tkey/"},{"d":"2026-10-08","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477"}],"signals":{"poc":7,"exploitdb":2,"metasploit":1,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for ISC BIND: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":16},{"id":"2026-10-08-apache-struts","kind":"exploited","title":"Apache Struts: Command Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","vendor":"Apache","product":"Struts","product_display":"Apache Struts","keys":["apache","apache:struts"],"cves":[{"id":"CVE-2016-3081","name":"Command Injection","description":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","cvss":8.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.96052,"epss_pct":0.99879,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-77"]}],"severity":"high","cvss":8.1,"epss":0.96052,"epss_pct":0.99879,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-08","added":"2026-10-08","updated":"2026-10-09","due":"2026-10-11","refs":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-032","label":"Vendor advisory (cwiki.apache.org)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3081","label":"CVE record CVE-2016-3081","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/39756","label":"Exploit-DB 39756: Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)","kind":"exploit"},{"url":"https://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec/","label":"Metasploit exploit: Apache Struts Dynamic Method Invocation Remote Code Execution","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3081.yaml","label":"Nuclei template: Apache S2-032 Struts - Remote Code Execution","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Apache S2-032 Struts - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3081.yaml"},{"d":"2016-04-26","lane":"disclosure","label":"CVE published","url":null},{"d":"2016-05-02","lane":"code","label":"Exploit-DB 39756: Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)","url":"https://www.exploit-db.com/exploits/39756"},{"d":"2026-04-22","lane":"code","label":"Metasploit exploit: Apache Struts Dynamic Method Invocation Remote Code Execution","url":"https://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec/"},{"d":"2026-10-08","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081"},{"d":"2026-10-10","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":0,"exploitdb":1,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Apache Struts: install the update or apply the mitigation it lists.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":16},{"id":"2026-10-04-citrix-netscaler","kind":"exploited","title":"Citrix NetScaler: Improper Restriction of Operations within the Bounds of a Memory Buffer","plain":"Attackers can crash or block the service, over the internet, without logging in.","summary":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.","vendor":"Citrix","product":"NetScaler","product_display":"Citrix NetScaler","keys":["citrix","citrix:netscaler"],"cves":[{"id":"CVE-2026-88779","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.","cvss":8.7,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","severity":"high","epss":0.00592,"epss_pct":0.47623,"automatable":true,"impact":"partial","fixed":["14.1-73.41","13.1-64.28","14.1-73.41 FIPS","13.1-37.282"],"patch":"fixed","cwes":["CWE-119"]}],"severity":"high","cvss":8.7,"epss":0.00592,"epss_pct":0.47623,"exploited":true,"sources":["CISA KEV","ENISA EUVD","News"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["14.1-73.41","13.1-64.28","14.1-73.41 FIPS","13.1-37.282"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-02","added":"2026-10-04","updated":"2026-10-05","due":"2026-10-07","refs":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174","label":"Vendor advisory (support.citrix.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92065","label":"ENISA EUVD EUVD-2026-92065","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88779","label":"CVE record CVE-2026-88779","kind":"registry"},{"url":"https://cert.europa.eu/publications/security-advisories/2026-014/","label":"CERT-EU security advisories: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway","kind":"news"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-27","lane":"cert","label":"CERT-EU security advisories: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway","url":"https://cert.europa.eu/publications/security-advisories/2026-014/"},{"d":"2026-10-02","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92065"},{"d":"2026-10-04","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779"},{"d":"2026-10-04","lane":"disclosure","label":"CVE published","url":null}],"outlets":["CERT-EU security advisories"],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Citrix NetScaler to the fixed version for your release line (for example 14.1-73.41, 13.1-64.28 or 14.1-73.41 FIPS).","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":22},{"id":"2026-10-01-fortinet-fortimail","kind":"exploited","title":"Fortinet FortiMail: Path Traversal","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.","vendor":"Fortinet","product":"FortiMail","product_display":"Fortinet FortiMail","keys":["fortinet","fortinet:fortimail"],"cves":[{"id":"CVE-2026-104286","name":"Path Traversal","description":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","severity":"critical","epss":0.02201,"epss_pct":0.82394,"automatable":true,"impact":"total","fixed":[],"patch":"fixed","cwes":["CWE-22","CWE-158"]}],"severity":"critical","cvss":9.8,"epss":0.02201,"epss_pct":0.82394,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-01","added":"2026-10-01","updated":"2026-10-07","due":"2026-10-04","refs":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-175","label":"Vendor advisory (fortiguard.fortinet.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91042","label":"ENISA EUVD EUVD-2026-91042","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104286","label":"CVE record CVE-2026-104286","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-01","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286"},{"d":"2026-10-01","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91042"},{"d":"2026-10-01","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-01","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-104286 (now 4 repositories)","url":null}],"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Fortinet FortiMail from the vendor advisory.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":23},{"id":"2026-09-30-cisco-catalyst-sd-wan-manager","kind":"exploited","title":"Cisco Catalyst SD-WAN Manager: Hex Encoding","plain":null,"summary":"Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.","vendor":"Cisco","product":"Catalyst SD-WAN Manager","product_display":"Cisco Catalyst SD-WAN Manager","keys":["cisco","cisco:catalyst-sd-wan-manager"],"cves":[{"id":"CVE-2026-76504","name":"Hex Encoding","description":"Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.01819,"epss_pct":0.78591,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-177"]}],"severity":"critical","cvss":9.8,"epss":0.01819,"epss_pct":0.78591,"exploited":true,"sources":["CISA KEV","ENISA EUVD","News"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-30","added":"2026-09-30","updated":"2026-10-02","due":"2026-10-03","refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU","label":"Vendor advisory (sec.cloudapps.cisco.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89950","label":"ENISA EUVD EUVD-2026-89950","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76504","label":"CVE record CVE-2026-76504","kind":"registry"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Manager%20API%20Authentication%20Bypass%20Vulnerability%26vs_k=1","label":"Cisco PSIRT: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability","kind":"news"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-30","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504"},{"d":"2026-09-30","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89950"},{"d":"2026-09-30","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-30","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-76504 (now 3 repositories)","url":null},{"d":"2026-10-02","lane":"cert","label":"Cisco PSIRT: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Manager%20API%20Authentication%20Bypass%20Vulnerability%26vs_k=1"},{"d":"2026-10-10","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-14","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"outlets":["Cisco PSIRT"],"signals":{"poc":3,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Cisco Catalyst SD-WAN Manager: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":24},{"id":"2026-10-02-zammad-gmbh-zammad","kind":"exploited","title":"Zammad: 2 flaws exploited together","plain":"Attackers can gain higher privileges, over the internet, without logging in, once a user opens a file or link.","summary":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.","vendor":"Zammad GmbH","product":"Zammad","product_display":"Zammad","keys":["zammad","zammad:zammad"],"cves":[{"id":"CVE-2026-102489","name":"GmbH Zammad Session Fixation","description":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.","cvss":8.7,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C","severity":"high","epss":0.01255,"epss_pct":0.69301,"automatable":false,"impact":"total","fixed":["6.5.4"],"patch":"fixed","cwes":["CWE-384"]},{"id":"CVE-2026-102490","name":"GmbH Zammad Improper Privilege Management","description":"Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.","cvss":8.5,"cvss_version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D","severity":"high","epss":0.0055,"epss_pct":0.45264,"automatable":false,"impact":"total","fixed":["7.2.2"],"patch":"fixed","cwes":["CWE-269"]}],"severity":"high","cvss":8.7,"epss":0.01255,"epss_pct":0.69301,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["6.5.4","7.2.2"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-30","added":"2026-10-02","updated":"2026-10-19","due":"2026-10-05","refs":[{"url":"https://zammad.com/en/product/releases/","label":"Vendor advisory (zammad.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90080","label":"ENISA EUVD EUVD-2026-90080","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90081","label":"ENISA EUVD EUVD-2026-90081","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102489","label":"CVE record CVE-2026-102489","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-30","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90080"},{"d":"2026-09-30","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-02","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489"},{"d":"2026-10-06","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-102489 (now 3 repositories)","url":null}],"signals":{"poc":3,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Zammad to 6.5.4 or 7.2.2 or later.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":24},{"id":"2026-09-29-apple-multiple-products","kind":"exploited","title":"Apple (multiple products): Out-of-Bounds Write","plain":"Memory corruption that can let attackers run code, over the internet, without logging in, once a user opens a file or link.","summary":"Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.","vendor":"Apple","product":"Multiple Products","product_display":"Apple (multiple products)","keys":["apple","apple:multiple-products"],"cves":[{"id":"CVE-2026-86950","name":"Out-of-Bounds Write","description":"Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","severity":"high","epss":0.01242,"epss_pct":0.68988,"automatable":false,"impact":"total","fixed":["26.7.1","15.8.1"],"patch":"fixed","cwes":["CWE-787"]}],"severity":"high","cvss":8.8,"epss":0.01242,"epss_pct":0.68988,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["26.7.1","15.8.1"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-29","added":"2026-09-29","updated":"2026-10-01","due":"2026-10-13","refs":[{"url":"https://support.apple.com/en-us/149226","label":"Vendor advisory (support.apple.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88445","label":"ENISA EUVD EUVD-2026-88445","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86950","label":"CVE record CVE-2026-86950","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-28","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-29","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950"},{"d":"2026-09-29","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88445"},{"d":"2026-10-01","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-86950 (now 6 repositories)","url":null},{"d":"2026-10-16","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":6,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update the affected Apple products to 26.7.1 or 15.8.1 or later.","also":[],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":25},{"id":"2026-09-27-citrix-netscaler","kind":"exploited","title":"Citrix NetScaler: 2 flaws exploited together","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. CISA lists 1 more flaw in Citrix NetScaler as exploited on the same day (CVE-2026-88772).","vendor":"Citrix","product":"NetScaler","product_display":"Citrix NetScaler","keys":["citrix","citrix:netscaler"],"cves":[{"id":"CVE-2026-88771","name":"Improper Input Validation","description":"Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.","cvss":9.5,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","severity":"critical","epss":0.04722,"epss_pct":0.91805,"automatable":true,"impact":"total","fixed":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"patch":"fixed","cwes":["CWE-119"]},{"id":"CVE-2026-88772","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service","cvss":9.5,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","severity":"critical","epss":0.05305,"epss_pct":0.92568,"automatable":false,"impact":"total","fixed":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"patch":"fixed","cwes":["CWE-119"]}],"severity":"critical","cvss":9.5,"epss":0.05305,"epss_pct":0.92568,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-27","added":"2026-09-27","updated":"2026-09-29","due":"2026-09-30","refs":[{"url":"https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778","label":"Vendor advisory (community.citrix.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958","label":"ENISA EUVD EUVD-2026-87958","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87959","label":"ENISA EUVD EUVD-2026-87959","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88771","label":"CVE record CVE-2026-88771","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/freebsd/http/citrix_netscaler_cve_2026_88771/","label":"Metasploit exploit: Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)","kind":"exploit"},{"url":"https://bsky.app/search?q=CVE-2026-88771","label":"Bluesky: search for CVE-2026-88771","kind":"discussion"},{"url":"https://news.ycombinator.com/item?id=50200681","label":"Hacker News: the discussion","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-27","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771"},{"d":"2026-09-27","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87958"},{"d":"2026-09-27","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-27","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-88771 (now 12 repositories)","url":null},{"d":"2026-09-27","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-88772 (now 4 repositories)","url":null},{"d":"2026-10-12","lane":"social","label":"4 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-18","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-19","lane":"social","label":"4 posts from 4 accounts (Bluesky 4)","url":null,"n":4},{"d":"2026-10-22","lane":"code","label":"Metasploit exploit: Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)","url":"https://www.rapid7.com/db/modules/exploit/freebsd/http/citrix_netscaler_cve_2026_88771/"},{"d":"2026-10-22","lane":"social","label":"2 posts from 1 account (Hacker News 1)","url":null,"n":1}],"signals":{"poc":12,"exploitdb":0,"metasploit":2,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":6,"recent":0,"platforms":["Bluesky","Hacker News"],"rising":false,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Citrix NetScaler to the fixed version for your release line (for example 14.1-73.37, 13.1-64.23 or 14.1-73.37 FIPS).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":27},{"id":"2026-09-25-checkpoint-cve-2026-85103","kind":"exploited","title":"Check Point Quantum (several versions): Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding","plain":"Memory corruption that can let attackers run code, over the internet, without logging in.","summary":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","vendor":"checkpoint","product":"Quantum (several versions)","product_display":"Check Point Quantum (several versions)","keys":["check-point","check-point:quantum-security-gateway","check-point:quantum-security-management"],"cves":[{"id":"CVE-2026-85103","name":"Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding","description":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.04327,"epss_pct":0.91147,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":9.8,"epss":0.04327,"epss_pct":0.91147,"exploited":true,"sources":["ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-25","added":"2026-09-25","updated":"2026-09-25","due":null,"refs":[{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75010","label":"ENISA EUVD EUVD-2026-75010","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85103","label":"CVE record CVE-2026-85103","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-09","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-25","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75010"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for the affected Check Point products: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":29},{"id":"2026-09-25-microsoft-sharepoint","kind":"exploited","title":"Microsoft SharePoint: Code Injection","plain":"Attackers can run their own code, over the internet.","summary":"Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.","vendor":"Microsoft","product":"SharePoint","product_display":"Microsoft SharePoint","keys":["microsoft","microsoft:sharepoint"],"cves":[{"id":"CVE-2026-65660","name":"Code Injection","description":"Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","severity":"high","epss":0.02101,"epss_pct":0.81581,"automatable":false,"impact":"total","fixed":["16.0.5565.1001","16.0.10417.20198","16.0.19725.20522"],"patch":"fixed","cwes":["CWE-94"]}],"severity":"high","cvss":8.8,"epss":0.02101,"epss_pct":0.81581,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["16.0.5565.1001","16.0.10417.20198","16.0.19725.20522"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-25","added":"2026-09-25","updated":"2026-10-21","due":"2026-09-28","refs":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56431","label":"ENISA EUVD EUVD-2026-56431","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65660","label":"CVE record CVE-2026-65660","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-11","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-25","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660"},{"d":"2026-09-25","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56431"},{"d":"2026-09-25","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-65660 (now 2 repositories)","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft SharePoint to the fixed version for your release line (for example 16.0.5565.1001, 16.0.10417.20198 or 16.0.19725.20522).","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":29},{"id":"2026-09-25-mikrotik-routeros","kind":"exploited","title":"MikroTik RouterOS: Improper Enforcement of Behavioral Workflow","plain":null,"summary":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.","vendor":"MikroTik","product":"RouterOS","product_display":"MikroTik RouterOS","keys":["mikrotik","mikrotik:routeros"],"cves":[{"id":"CVE-2026-67279","name":"Improper Enforcement of Behavioral Workflow","description":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.","cvss":6.9,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","severity":"medium","epss":0.01046,"epss_pct":0.63892,"automatable":true,"impact":"partial","fixed":["7.24.2","7.23.4","6.49.21"],"patch":"fixed","cwes":["CWE-841"]}],"severity":"medium","cvss":6.9,"epss":0.01046,"epss_pct":0.63892,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["7.24.2","7.23.4","6.49.21"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-25","added":"2026-09-25","updated":"2026-09-26","due":"2026-09-28","refs":[{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability","label":"Vendor advisory (mikrotik.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72027","label":"ENISA EUVD EUVD-2026-72027","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67279","label":"CVE record CVE-2026-67279","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-05","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-25","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279"},{"d":"2026-09-25","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72027"},{"d":"2026-09-26","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-67279 (now 4 repositories)","url":null}],"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update MikroTik RouterOS to the fixed version for your release line (for example 7.24.2, 7.23.4 or 6.49.21).","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":29},{"id":"2026-09-24-wso2-multiple-products","kind":"exploited","title":"WSO2 (multiple products): Path Traversal","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.","vendor":"WSO2","product":"Multiple Products","product_display":"WSO2 (multiple products)","keys":["wso2","wso2:multiple-products"],"cves":[{"id":"CVE-2026-5430","name":"Path Traversal","description":"WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.00588,"epss_pct":0.47448,"automatable":true,"impact":"total","fixed":["4.5.0.57","4.6.0.21","4.5.0.56","4.5.0.58","4.6.0.22","4.1.0.257"],"patch":"fixed","cwes":["CWE-347"]}],"severity":"critical","cvss":10.0,"epss":0.00588,"epss_pct":0.47448,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["4.5.0.57","4.6.0.21","4.5.0.56","4.5.0.58","4.6.0.22","4.1.0.257"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-24","added":"2026-09-24","updated":"2026-09-25","due":"2026-09-27","refs":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/","label":"Vendor advisory (security.docs.wso2.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53822","label":"ENISA EUVD EUVD-2026-53822","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5430","label":"CVE record CVE-2026-5430","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-06","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-16","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-5430 (now 4 repositories)","url":null},{"d":"2026-09-24","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430"},{"d":"2026-09-24","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53822"}],"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update the affected WSO2 products to the fixed version for your release line (for example 4.5.0.57, 4.6.0.21 or 4.5.0.56).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":30},{"id":"2026-09-24-adobe-commerce-and-magento","kind":"exploited","title":"Adobe Commerce and Magento: Incorrect Authorization","plain":"Attackers can reach functions they should not have access to, over the internet, without logging in.","summary":"Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.","vendor":"Adobe","product":"Commerce and Magento ","product_display":"Adobe Commerce and Magento","keys":["adobe","adobe:commerce-and-magento"],"cves":[{"id":"CVE-2026-71362","name":"Incorrect Authorization","description":"Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.","cvss":9.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","severity":"critical","epss":0.87507,"epss_pct":0.9976,"automatable":true,"impact":"total","fixed":["2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug","1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug","2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug"],"patch":"fixed","cwes":["CWE-863"]}],"severity":"critical","cvss":9.1,"epss":0.87507,"epss_pct":0.9976,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug","1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug","2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-24","added":"2026-09-24","updated":"2026-09-25","due":"2026-09-27","refs":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-92.html","label":"Vendor advisory (helpx.adobe.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56844","label":"ENISA EUVD EUVD-2026-56844","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71362","label":"CVE record CVE-2026-71362","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71362.yaml","label":"Nuclei template: Adobe Commerce/Magento - Customer Session Identity Switch","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Adobe Commerce/Magento - Customer Session Identity Switch","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71362.yaml"},{"d":"2026-08-11","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-71362 (now 2 repositories)","url":null},{"d":"2026-09-24","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362"},{"d":"2026-09-24","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56844"}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Adobe Commerce and Magento to the fixed version for your release line (for example 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug, 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug or 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":30},{"id":"2026-10-09-ghostaction","kind":"supply-chain","title":"GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["StepSecurity blog"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-09","added":"2026-10-09","updated":"2026-10-09","due":null,"refs":[{"url":"https://www.stepsecurity.io/blog/ghostaction-returns","label":"StepSecurity blog: GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories","kind":"news"}],"events":[{"d":"2026-10-09","lane":"press","label":"StepSecurity blog: GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire","url":"https://www.stepsecurity.io/blog/ghostaction-returns"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Check your dependencies","live":true,"age_days":15},{"id":"2026-10-08-tensorlake","kind":"supply-chain","title":"Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["StepSecurity blog"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-08","added":"2026-10-08","updated":"2026-10-08","due":null,"refs":[{"url":"https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm","label":"StepSecurity blog: Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It","kind":"news"}],"events":[{"d":"2026-10-08","lane":"press","label":"StepSecurity blog: Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If","url":"https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Check your dependencies","live":true,"age_days":16},{"id":"2026-10-05-subquery","kind":"supply-chain","title":"SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["StepSecurity blog"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-05","added":"2026-10-05","updated":"2026-10-05","due":null,"refs":[{"url":"https://www.stepsecurity.io/blog/subql-ecosystem-compromised","label":"StepSecurity blog: SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors","kind":"news"}],"events":[{"d":"2026-10-05","lane":"press","label":"StepSecurity blog: SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors","url":"https://www.stepsecurity.io/blog/subql-ecosystem-compromised"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Check your dependencies","live":true,"age_days":19},{"id":"2026-09-30-memtensor","kind":"supply-chain","title":"Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":true,"sources":["News"],"outlets":["StepSecurity blog"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-30","added":"2026-09-30","updated":"2026-09-30","due":null,"refs":[{"url":"https://www.stepsecurity.io/blog/sckit-supply-chain-worm-hits-memtensor-npm-pypi-scopes","label":"StepSecurity blog: Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes","kind":"news"}],"events":[{"d":"2026-09-30","lane":"press","label":"StepSecurity blog: Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes","url":"https://www.stepsecurity.io/blog/sckit-supply-chain-worm-hits-memtensor-npm-pypi-scopes"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"soon","action_label":"Check your dependencies","live":true,"age_days":24},{"id":"2026-10-22-ccb-node-js","kind":"warning","title":"Multiple High Severity Vulnerabilities in Node.js","plain":null,"summary":"The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.","vendor":null,"product":"Node.js","product_display":"Node.js","keys":["node-js"],"cves":[{"id":"CVE-2026-111497","name":"Out-of-Bounds Write in Google Brotli Decoder","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","fixed":[],"cwes":[]}],"severity":"high","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["CCB","News"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":"Per the CCB advisory","label":"Fix available"},"be":{"title":"Multiple High Severity Vulnerabilities in Node.js","url":"https://ccb.belgium.be/advisories/warning-multiple-high-severity-vulnerabilities-nodejs-patch-immediately","date":"2026-10-22"},"first_seen":"2026-10-22","added":"2026-10-22","updated":"2026-10-24","due":null,"refs":[{"url":"https://ccb.belgium.be/advisories/warning-multiple-high-severity-vulnerabilities-nodejs-patch-immediately","label":"CCB warning (Belgium)","kind":"be"},{"url":"https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html","label":"The Hacker News: Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions","kind":"news"},{"url":"https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html","label":"The Hacker News: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data","kind":"news"},{"url":"https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html","label":"The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software","kind":"news"},{"url":"https://bsky.app/search?q=CVE-2026-111497","label":"Bluesky: search for CVE-2026-111497","kind":"discussion"},{"url":"https://news.ycombinator.com/item?id=50189292","label":"Hacker News: the discussion","kind":"discussion"}],"events":[{"d":"2026-10-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-111497 (now 22 repositories)","url":null},{"d":"2026-10-21","lane":"social","label":"14 posts from 12 accounts (Bluesky 11, Hacker News 1)","url":null,"n":12},{"d":"2026-10-22","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-multiple-high-severity-vulnerabilities-nodejs-patch-immediately"},{"d":"2026-10-22","lane":"press","label":"The Hacker News: Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions","url":"https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html"},{"d":"2026-10-22","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-22","lane":"social","label":"11 posts from 8 accounts (Bluesky 7, Hacker News 1)","url":null,"n":8},{"d":"2026-10-23","lane":"press","label":"The Hacker News: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data","url":"https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html"},{"d":"2026-10-23","lane":"social","label":"33 posts from 26 accounts (Bluesky 24, Hacker News 2)","url":null,"n":26},{"d":"2026-10-24","lane":"press","label":"The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Soft","url":"https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html"},{"d":"2026-10-24","lane":"social","label":"30 posts from 14 accounts (Bluesky 11, Hacker News 3)","url":null,"n":14}],"curated":false,"featured":false,"note":null,"outlets":["The Hacker News"],"signals":{"poc":22,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":56,"recent":38,"platforms":["Bluesky","Hacker News"],"rising":true,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Node.js from the vendor advisory.","also":[],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":2},{"id":"2026-10-20-ccb-apache-camel","kind":"warning","title":"Multiple High Severity Vulnerabilities in Apache Camel","plain":null,"summary":"The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.","vendor":null,"product":"Apache Camel","product_display":"Apache Camel","keys":["apache-camel"],"cves":[],"severity":"high","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["CCB"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":"Per the CCB advisory","label":"Fix available"},"be":{"title":"Multiple High Severity Vulnerabilities in Apache Camel","url":"https://ccb.belgium.be/advisories/warning-multiple-high-severity-vulnerabilities-apache-camel-patch-immediately","date":"2026-10-20"},"first_seen":"2026-10-20","added":"2026-10-20","updated":"2026-10-20","due":null,"refs":[{"url":"https://ccb.belgium.be/advisories/warning-multiple-high-severity-vulnerabilities-apache-camel-patch-immediately","label":"CCB warning (Belgium)","kind":"be"}],"events":[{"d":"2026-10-20","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-multiple-high-severity-vulnerabilities-apache-camel-patch-immediately"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Apache Camel. The CCB advisory lists the affected and fixed versions.","also":[],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":4},{"id":"2026-10-19-ccb-nginx-plus-and-nginx-open-source","kind":"warning","title":"Heap-Based Buffer Overflows in NGINX Plus and NGINX Open Source Can Be Exploited to Cause Denial of Service or Code Execution","plain":"Memory corruption that can let attackers run code.","summary":"The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.","vendor":null,"product":"NGINX Plus and NGINX Open Source","product_display":"NGINX Plus and NGINX Open Source","keys":["nginx-plus","nginx-open-source"],"cves":[],"severity":"high","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["CCB"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":"Per the CCB advisory","label":"Fix available"},"be":{"title":"Heap-Based Buffer Overflows in NGINX Plus and NGINX Open Source Can Be Exploited to Cause Denial of Service or Code Execution","url":"https://ccb.belgium.be/advisories/warning-heap-based-buffer-overflows-nginx-plus-and-nginx-open-source-can-be-exploited","date":"2026-10-19"},"first_seen":"2026-10-19","added":"2026-10-19","updated":"2026-10-19","due":null,"refs":[{"url":"https://ccb.belgium.be/advisories/warning-heap-based-buffer-overflows-nginx-plus-and-nginx-open-source-can-be-exploited","label":"CCB warning (Belgium)","kind":"be"}],"events":[{"d":"2026-10-19","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-heap-based-buffer-overflows-nginx-plus-and-nginx-open-source-can-be-exploited"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for NGINX Plus and NGINX Open Source. The CCB advisory lists the affected and fixed versions.","also":[],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":5},{"id":"2026-10-19-ccb-adobe-commerce-and-magento-open-source","kind":"warning","title":"Template Injection Vulnerability in Adobe Commerce and Magento Open Source Can Be Exploited to Execute Arbitrary Code","plain":"Attackers can run their own code.","summary":"The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.","vendor":null,"product":"Adobe Commerce and Magento Open Source","product_display":"Adobe Commerce and Magento Open Source","keys":["adobe-commerce","magento-open-source"],"cves":[],"severity":"high","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["CCB"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":[],"note":"Per the CCB advisory","label":"Fix available"},"be":{"title":"Template Injection Vulnerability in Adobe Commerce and Magento Open Source Can Be Exploited to Execute Arbitrary Code","url":"https://ccb.belgium.be/advisories/warning-template-injection-vulnerability-adobe-commerce-and-magento-open-source-can-be","date":"2026-10-19"},"first_seen":"2026-10-19","added":"2026-10-19","updated":"2026-10-19","due":null,"refs":[{"url":"https://ccb.belgium.be/advisories/warning-template-injection-vulnerability-adobe-commerce-and-magento-open-source-can-be","label":"CCB warning (Belgium)","kind":"be"}],"events":[{"d":"2026-10-19","lane":"cert","label":"CCB warning","url":"https://ccb.belgium.be/advisories/warning-template-injection-vulnerability-adobe-commerce-and-magento-open-source-can-be"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Adobe Commerce and Magento Open Source. The CCB advisory lists the affected and fixed versions.","also":[],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":5},{"id":"2026-10-07-nx-os","kind":"critical","title":"Cisco NX-OS Software Python Sandbox Escape Vulnerability","plain":"Attackers can crash or block the service, once they have access to the device.","summary":"A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected&nbsp;device.","vendor":"Cisco","product":"Cisco NX-OS Software","product_display":"Cisco NX-OS Software","keys":["cisco","cisco:cisco-nx-os-software"],"cves":[{"id":"CVE-2026-20032","name":"Cisco NX-OS Software Python Sandbox Escape","description":"A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected&nbsp;device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user.","cvss":4.4,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","severity":"medium","epss":0.00108,"epss_pct":0.01139,"automatable":false,"impact":"partial","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-20038","name":"Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass","description":"A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts. This vulnerability is due to an improper control with EPG contracts. An attacker could exploit this vulnerability by sending IPv4 or IPv6 packets using UDP source and destination ports that are assigned to&nbsp;DHCP traffic through an affected device. A successful exploit could allow the attacker to bypass EPG contracts on the affected device.","cvss":5.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","severity":"medium","epss":0.00301,"epss_pct":0.21704,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-20173","name":"Cisco NX-OS Software Denial of Service","description":"A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition. This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by sending a high rate of UDP or TCP connections to a data plane interface on an affected device. A successful exploit could allow the attacker to cause instability to various routing and control plane protocols through some packet loss and temporary disruptions, causing a DoS condition. This DoS condition will clear without manual intervention soon after the high rate of traffic is stopped.","cvss":5.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","severity":"medium","epss":0.00373,"epss_pct":0.3007,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76453","name":"Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76453 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.00336,"epss_pct":0.25761,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76455","name":"Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76455 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00284,"epss_pct":0.19857,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76456","name":"Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76456 are related to improper input validation of special elements used in a command issue that are grouped under the Common Weakness Enumeration (CWE) CWE-20.","cvss":8.6,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","severity":"high","epss":0.00278,"epss_pct":0.19224,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76457","name":"Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76457 are related to out-of-bounds read issues that are grouped under the Common Weakness Enumeration (CWE) CWE-125.","cvss":8.6,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","severity":"high","epss":0.00278,"epss_pct":0.19223,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76458","name":"Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Exceptional Conditions","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76458 are related to improper handling of exceptional conditions issues that are grouped under the Common Weakness Enumeration (CWE) CWE-703.","cvss":8.6,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","severity":"high","epss":0.00278,"epss_pct":0.19223,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76459","name":"Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76459 are related to out-of-bounds write issues that are grouped under the Common Weakness Enumeration (CWE) CWE-787.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00307,"epss_pct":0.22336,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76465","name":"Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution","description":"A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with&nbsp;root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with&nbsp;root privileges and could cause process crashes, which could result in a device reload and a DoS condition.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00448,"epss_pct":0.38001,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76471","name":"Cisco NX-OS Software NX-API Remote Code Execution","description":"A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.&nbsp; The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00523,"epss_pct":0.4356,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76485","name":"Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution","description":"A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00509,"epss_pct":0.42619,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76486","name":"Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution","description":"A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00509,"epss_pct":0.42619,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]},{"id":"CVE-2026-76501","name":"Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution","description":"A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM and SRv6 features are enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00509,"epss_pct":0.42619,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":9.8,"epss":0.00523,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["Cisco PSIRT"],"ransomware":false,"forensic":false,"automatable":true,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-07","added":"2026-10-07","updated":"2026-10-08","due":null,"refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mppe-dhKZAFgb?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20Python%20Sandbox%20Escape%20Vulnerability%26vs_k=1","label":"Cisco PSIRT: Cisco NX-OS Software Python Sandbox Escape Vulnerability","kind":"news"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","label":"Cisco PSIRT: Cisco NX-OS Software Security Hardening Release: October 2026","kind":"news"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20NX-API%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1","label":"Cisco PSIRT: Cisco NX-OS Software NX-API Remote Code Execution Vulnerability","kind":"news"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20Control%20Plane%20Denial%20of%20Service%20Vulnerability%26vs_k=1","label":"Cisco PSIRT: Cisco NX-OS Software Control Plane Denial of Service Vulnerability","kind":"news"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-fBn58ELx?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Advance%20Notification%20for%20Publication%20of%20October%207,%202026,%20Security%20Advisories%26vs_k=1","label":"Cisco PSIRT: Cisco Advance Notification for Publication of October 7, 2026, Security Advisories","kind":"news"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Nexus%203000%20and%209000%20Series%20Switches%20NGOAM%20Remote%20Code%20Execution%20Vulnerabilities%26vs_k=1","label":"Cisco PSIRT: Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities","kind":"news"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20032","label":"CVE record CVE-2026-20032","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20038","label":"CVE record CVE-2026-20038","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20173","label":"CVE record CVE-2026-20173","kind":"registry"}],"events":[{"d":"2026-10-07","lane":"cert","label":"Cisco PSIRT: Cisco NX-OS Software Python Sandbox Escape Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mppe-dhKZAFgb?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20Python%20Sandbox%20Escape%20Vulnerability%26vs_k=1"},{"d":"2026-10-07","lane":"cert","label":"Cisco PSIRT: Cisco NX-OS Software Security Hardening Release: October 2026","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20Security%20Hardening%20Release:%20October%202026%26vs_k=1"},{"d":"2026-10-07","lane":"cert","label":"Cisco PSIRT: Cisco NX-OS Software Control Plane Denial of Service Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20Control%20Plane%20Denial%20of%20Service%20Vulnerability%26vs_k=1"},{"d":"2026-10-07","lane":"cert","label":"Cisco PSIRT: Cisco Advance Notification for Publication of October 7, 2026, Security Advisories","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-fBn58ELx?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Advance%20Notification%20for%20Publication%20of%20October%207,%202026,%20Security%20Advisories%26vs_k=1"},{"d":"2026-10-07","lane":"cert","label":"Cisco PSIRT: Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Nexus%203000%20and%209000%20Series%20Switches%20NGOAM%20Remote%20Code%20Execution%20Vulnerabilities%26vs_k=1"},{"d":"2026-10-07","lane":"cert","label":"Cisco PSIRT: Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Nexus%203000%20and%209000%20Series%20Switches%20MPLS%20OAM%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1"},{"d":"2026-10-07","lane":"cert","label":"Cisco PSIRT: Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnera","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLf?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Nexus%209000%20Series%20Fabric%20Switches%20in%20ACI%20Mode%20Endpoint%20Group%20Contract%20Bypass%20Vulnerability%26vs_k=1"},{"d":"2026-10-07","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-08","lane":"cert","label":"Cisco PSIRT: Cisco NX-OS Software NX-API Remote Code Execution Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20NX-API%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.","also":[],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":17},{"id":"2026-10-02-gitlab","kind":"critical","title":"GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1","plain":null,"summary":"GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the…","vendor":"GitLab","product":"GitLab AI Gateway","product_display":"GitLab AI Gateway","keys":["gitlab","gitlab:gitlab-ai-gateway"],"cves":[{"id":"CVE-2026-90970","name":"Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway","description":"GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.","cvss":9.9,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.00943,"epss_pct":0.60694,"automatable":false,"impact":"total","fixed":["19.2.4","19.3.2","19.4.1"],"patch":"fixed","cwes":[]}],"severity":"critical","cvss":9.9,"epss":0.00943,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["GitLab security releases"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["19.2.4","19.3.2","19.4.1"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-02","added":"2026-10-02","updated":"2026-10-02","due":null,"refs":[{"url":"https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/","label":"GitLab security releases: GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1","kind":"news"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90970","label":"CVE record CVE-2026-90970","kind":"registry"}],"events":[{"d":"2026-10-02","lane":"cert","label":"GitLab security releases: GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1","url":"https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/"},{"d":"2026-10-02","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-03","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-90970","url":null}],"curated":false,"featured":false,"note":null,"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update GitLab AI Gateway to the fixed version for your release line (for example 19.2.4, 19.3.2 or 19.4.1).","also":[],"urgency":"soon","action_label":"Patch this month","live":true,"age_days":22},{"id":"2026-10-23-diagnostics","kind":"breach","title":"Quest Diagnostics warns of potential data theft after attack on lab service system","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["The Record","SecurityWeek"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"na","versions":[],"note":null,"label":""},"be":null,"first_seen":"2026-10-23","added":"2026-10-23","updated":"2026-10-23","due":null,"refs":[{"url":"https://therecord.media/quest-diagnostics-network-intrusion","label":"The Record: Quest Diagnostics warns of potential data theft after attack on lab service system","kind":"news"},{"url":"https://www.securityweek.com/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records/","label":"SecurityWeek: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’","kind":"news"}],"events":[{"d":"2026-10-23","lane":"press","label":"The Record: Quest Diagnostics warns of potential data theft after attack on lab service system","url":"https://therecord.media/quest-diagnostics-network-intrusion"},{"d":"2026-10-23","lane":"press","label":"SecurityWeek: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’","url":"https://www.securityweek.com/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records/"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.","also":[],"urgency":"soon","action_label":"Check exposure","live":true,"age_days":1},{"id":"2026-10-23-vpns","kind":"breach","title":"Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["The Hacker News"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"na","versions":[],"note":null,"label":""},"be":null,"first_seen":"2026-10-23","added":"2026-10-23","updated":"2026-10-23","due":null,"refs":[{"url":"https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html","label":"The Hacker News: Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials","kind":"news"}],"events":[{"d":"2026-10-23","lane":"press","label":"The Hacker News: Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials","url":"https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.","also":[],"urgency":"soon","action_label":"Check exposure","live":true,"age_days":1},{"id":"2026-10-23-capcom","kind":"breach","title":"11 Million Impacted by Capcom Data Breach","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["SecurityWeek","Help Net Security"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"na","versions":[],"note":null,"label":""},"be":null,"first_seen":"2026-10-23","added":"2026-10-23","updated":"2026-10-23","due":null,"refs":[{"url":"https://www.securityweek.com/11-million-impacted-by-capcom-data-breach/","label":"SecurityWeek: 11 Million Impacted by Capcom Data Breach","kind":"news"},{"url":"https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/","label":"Help Net Security: Capcom data breach exposes 11.7 million account records","kind":"news"}],"events":[{"d":"2026-10-23","lane":"press","label":"SecurityWeek: 11 Million Impacted by Capcom Data Breach","url":"https://www.securityweek.com/11-million-impacted-by-capcom-data-breach/"},{"d":"2026-10-23","lane":"press","label":"Help Net Security: Capcom data breach exposes 11.7 million account records","url":"https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.","also":[],"urgency":"soon","action_label":"Check exposure","live":true,"age_days":1},{"id":"2026-10-22-toronto","kind":"breach","title":"Toronto crime tips org freezes operations after details of data breach come to light","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["The Record"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"na","versions":[],"note":null,"label":""},"be":null,"first_seen":"2026-10-22","added":"2026-10-22","updated":"2026-10-22","due":null,"refs":[{"url":"https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach","label":"The Record: Toronto crime tips org freezes operations after details of data breach come to light","kind":"news"}],"events":[{"d":"2026-10-22","lane":"press","label":"The Record: Toronto crime tips org freezes operations after details of data breach come to light","url":"https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.","also":[],"urgency":"soon","action_label":"Check exposure","live":true,"age_days":2},{"id":"2026-10-21-confirms","kind":"breach","title":"State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["The Hacker News"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"na","versions":[],"note":null,"label":""},"be":null,"first_seen":"2026-10-21","added":"2026-10-21","updated":"2026-10-21","due":null,"refs":[{"url":"https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html","label":"The Hacker News: State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web","kind":"news"}],"events":[{"d":"2026-10-21","lane":"press","label":"The Hacker News: State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web","url":"https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.","also":[],"urgency":"soon","action_label":"Check exposure","live":true,"age_days":3},{"id":"2026-10-20-ai","kind":"breach","title":"Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites","plain":null,"summary":null,"vendor":null,"product":null,"product_display":"","keys":[],"cves":[],"severity":"unrated","cvss":null,"epss":null,"epss_pct":null,"exploited":false,"sources":["News"],"outlets":["The Hacker News"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"na","versions":[],"note":null,"label":""},"be":null,"first_seen":"2026-10-20","added":"2026-10-20","updated":"2026-10-20","due":null,"refs":[{"url":"https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html","label":"The Hacker News: Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites","kind":"news"}],"events":[{"d":"2026-10-20","lane":"press","label":"The Hacker News: Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites","url":"https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html"}],"curated":false,"featured":false,"note":null,"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.","also":[],"urgency":"soon","action_label":"Check exposure","live":true,"age_days":4},{"id":"2026-10-24-radar-cve-2026-18110","kind":"radar","title":"Concrete CMS: 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username","plain":"Attackers can reach functions they should not have access to, over the internet, without logging in.","summary":"Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the \"Preview as User\" panel and other user-selector components.","vendor":"Concrete CMS","product":"Concrete CMS","product_display":"Concrete CMS","keys":["concrete-cms","concrete-cms:concrete-cms"],"cves":[{"id":"CVE-2026-18110","name":"9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username","description":"Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which backs the \"Preview as User\" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to the selector's display options rather than to the caller's identity or permissions, and that token is issued to anonymous visitors because the selector renders without an authorization check. Because an empty query resolves to a match-all filter, an unauthenticated attacker can submit an empty search and paginate the results to enumerate every backend account, disclosing the internal user ID, username, and email address of all administrative users, including the super-administrator (user ID 1). No password hashes or session material are disclosed The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks thirtythree and YesWeHack for reporting.","cvss":8.7,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","severity":"high","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":[],"patch":"unknown","cwes":[]}],"severity":"high","cvss":8.7,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"a Nuclei scanner template","ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-24","added":"2026-10-24","updated":"2026-10-24","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18110","label":"CVE record CVE-2026-18110","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18110.yaml","label":"Nuclei template: Concrete CMS - User Enumeration","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-15","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-24","lane":"scanner","label":"Nuclei template: Concrete CMS - User Enumeration","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18110.yaml"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run Concrete CMS, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":0},{"id":"2026-10-23-radar-cve-2026-91403","kind":"radar","title":"CVE-2026-91403: public exploit code","plain":null,"summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).","vendor":"Oracle Corporation","product":"Oracle Java SE","product_display":"Oracle Java SE","keys":["oracle","oracle:oracle-java-se"],"cves":[{"id":"CVE-2026-91403","name":"CVE-2026-91403","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","cvss":9.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","severity":"critical","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":9.1,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"2 PoC repos on GitHub, talk by 7 accounts on Bluesky and Hacker News in two days","ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-23","added":"2026-10-23","updated":"2026-10-23","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91403","label":"CVE record CVE-2026-91403","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-91403","label":"Bluesky: search for CVE-2026-91403","kind":"discussion"},{"url":"https://news.ycombinator.com/item?id=50188443","label":"Hacker News: the discussion","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-21","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-21","lane":"social","label":"7 posts from 6 accounts (Bluesky 5, Hacker News 1)","url":null,"n":6},{"d":"2026-10-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-91403 (now 2 repositories)","url":null},{"d":"2026-10-22","lane":"social","label":"15 posts from 12 accounts (Bluesky 11, Hacker News 1)","url":null,"n":12},{"d":"2026-10-23","lane":"social","label":"7 posts from 7 accounts (Bluesky 7)","url":null,"n":7}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":25,"recent":7,"platforms":["Bluesky","Hacker News"],"rising":false,"partial":[],"talked":true}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run Oracle Java SE, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":1},{"id":"2026-10-22-radar-cve-2026-102785","kind":"radar","title":"Yootheme.com YOOtheme Pro extension for Joomla: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature.","vendor":"yootheme.com","product":"YOOtheme Pro extension for Joomla","product_display":"Yootheme.com YOOtheme Pro extension for Joomla","keys":["yootheme-com","yootheme-com:yootheme-pro-extension-for-joomla"],"cves":[{"id":"CVE-2026-102785","name":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52","description":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.","cvss":10.0,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y","severity":"critical","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":10.0,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"2 PoC repos on GitHub","ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-22","added":"2026-10-22","updated":"2026-10-22","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102785","label":"CVE record CVE-2026-102785","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-102785","label":"Bluesky: search for CVE-2026-102785","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-21","lane":"social","label":"3 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-22","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-102785 (now 2 repositories)","url":null},{"d":"2026-10-22","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":3,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run Yootheme.com YOOtheme Pro extension for Joomla, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":2},{"id":"2026-10-21-radar-cve-2026-18963","kind":"radar","title":"Red Hat build of Keycloak 26.4: Keycloak-services: unauthenticated account takeover via reset-credentials flow bypass","plain":null,"summary":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak.","vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","product_display":"Red Hat build of Keycloak 26.4","keys":["red-hat","red-hat:red-hat-build-of-keycloak-26-4"],"cves":[{"id":"CVE-2026-18963","name":"Keycloak-services: unauthenticated account takeover via reset-credentials flow bypass","description":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.","cvss":9.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","severity":"critical","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":["26.4.15-1","26.4-23","26.6.6-1","26.6-12"],"patch":"fixed","cwes":[]}],"severity":"critical","cvss":9.1,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"Exploit-DB, a Nuclei scanner template","ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["26.4.15-1","26.4-23","26.6.6-1","26.6-12"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-21","added":"2026-10-21","updated":"2026-10-21","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18963","label":"CVE record CVE-2026-18963","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/52699","label":"Exploit-DB 52699: Keycloak  26.7.2 - Unauthenticated Account Takeover","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml","label":"Nuclei template: Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass","kind":"exploit"},{"url":"https://news.ycombinator.com/item?id=50204334","label":"Hacker News: the discussion","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml"},{"d":"2026-08-18","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-21","lane":"code","label":"Exploit-DB 52699: Keycloak  26.7.2 - Unauthenticated Account Takeover","url":"https://www.exploit-db.com/exploits/52699"},{"d":"2026-10-23","lane":"social","label":"4 posts from 1 account (Hacker News 1)","url":null,"n":1}],"signals":{"poc":0,"exploitdb":1,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":1,"recent":1,"platforms":["Hacker News"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run Red Hat build of Keycloak 26.4, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":3},{"id":"2026-10-21-radar-cve-2024-26503","kind":"radar","title":"Open eClass 3.15 - RCE","plain":"Attackers can run their own code, over the internet, with an admin account.","summary":"Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint.","vendor":null,"product":null,"product_display":"","keys":[],"cves":[{"id":"CVE-2024-26503","name":"Open eClass 3.15 - RCE","description":"Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint.","cvss":9.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":9.1,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"Exploit-DB","ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-21","added":"2026-10-21","updated":"2026-10-21","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26503","label":"CVE record CVE-2024-26503","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/52698","label":"Exploit-DB 52698: Open eClass 3.15 - RCE","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2024-03-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-21","lane":"code","label":"Exploit-DB 52698: Open eClass 3.15 - RCE","url":"https://www.exploit-db.com/exploits/52698"}],"signals":{"poc":0,"exploitdb":1,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run the affected product, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":3},{"id":"2026-10-21-radar-cve-2026-105482","kind":"radar","title":"CVE-2026-105482: public exploit code","plain":null,"summary":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().","vendor":"nodejs","product":"node","product_display":"Nodejs node","keys":["nodejs","nodejs:node"],"cves":[{"id":"CVE-2026-105482","name":"CVE-2026-105482","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","cvss":7.4,"cvss_version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","severity":"high","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":[],"patch":"unknown","cwes":[]}],"severity":"high","cvss":7.4,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"2 PoC repos on GitHub","ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-21","added":"2026-10-21","updated":"2026-10-21","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105482","label":"CVE record CVE-2026-105482","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-105482","label":"Bluesky: search for CVE-2026-105482","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-105482 (now 2 repositories)","url":null},{"d":"2026-10-22","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-23","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":1,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run Nodejs node, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":3},{"id":"2026-10-20-radar-cve-2026-114509","kind":"radar","title":"Laravel framework: TokenGuard authentication bypass through non-string API credentials","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Laravel is a web application framework.","vendor":"laravel","product":"framework","product_display":"Laravel framework","keys":["laravel","laravel:framework"],"cves":[{"id":"CVE-2026-114509","name":"TokenGuard authentication bypass through non-string API credentials","description":"Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":9.2,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"2 PoC repos on GitHub","ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-20","added":"2026-10-20","updated":"2026-10-20","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114509","label":"CVE record CVE-2026-114509","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-20","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-114509 (now 2 repositories)","url":null},{"d":"2026-10-21","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run Laravel framework, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":4},{"id":"2026-10-18-radar-cve-2026-98260","kind":"radar","title":"Linux: exec: Cleanup POSIX timers right after de_thread()","plain":"Memory corruption that can let attackers run code, once they have access to the device.","summary":"In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers.","vendor":"Linux","product":"Linux","product_display":"Linux","keys":["linux","linux:linux"],"cves":[{"id":"CVE-2026-98260","name":"exec: Cleanup POSIX timers right after de_thread()","description":"In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When a non-leader thread exec()s, de_thread() changes which task owns that PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL, but the node is still queued on tsk, which is alive. timer_lock_sighand() takes a failed lookup to mean that the node is already dequeued, so it has nothing to undo. begin_new_exec() calls posix_cpu_timers_exit(me) right after exec_task_namespaces() and that removes the leftover node, so the state normally stays invisible. But bprm->point_of_no_return is set before de_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or exec_task_namespaces() fails, the task dies before it gets there. exit_itimers() then frees the k_itimer while its node is still queued, and reaping tsk later erases that freed node from the rbtree. In short: the non-leader thread B the parent timer_create(CLOCK_THREAD_CPUTIME_ID) timer_settime() arm_timer() // the node is queued on B execve() de_thread(B) exchange_tids(B, leader) // B's PID now belongs to the leader release_task(leader) __exit_signal(leader) posix_cpu_timers_exit(leader) // cleans leader's queue, not B's __unhash_process(leader) // that PID has no task anymore exec_mmap() mmap_read_lock_killable(old_mm) kill(B, SIGKILL) // -EINTR get_signal() do_exit() exit_itimers() posix_timer_delete() posix_cpu_timer_del() posix_timer_unhash_and_free() // freed while still queued wait4() release_task(B) posix_cpu_timers_exit(B) cleanup_timerqueue() timerqueue_del() // use-after-free Move the POSIX timer cleanup right after de_thread() before any of the later failure conditions brings the task into do_exit(). [ tglx: Move the cleanup right after de_thread() ]","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":["6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce","d9ae467e617ca29b825493a362bf0d75ad5f4ac3","75aa08b93c65766040f9ca99f41ac85ad22596b6","d602877baf36c43c788a5f472c977e0be414029f","acb03d3881818581052924a9bbbe92b8741ed448","6.6.158"],"patch":"fixed","cwes":[]}],"severity":"high","cvss":7.8,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"4 PoC repos on GitHub","ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce","d9ae467e617ca29b825493a362bf0d75ad5f4ac3","75aa08b93c65766040f9ca99f41ac85ad22596b6","d602877baf36c43c788a5f472c977e0be414029f","acb03d3881818581052924a9bbbe92b8741ed448","6.6.158"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-18","added":"2026-10-18","updated":"2026-10-18","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98260","label":"CVE record CVE-2026-98260","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-06","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-18","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-98260 (now 4 repositories)","url":null}],"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run Linux, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":6},{"id":"2026-10-13-radar-cve-2025-41450","kind":"radar","title":"Danfoss AK-SM 8xxA Series: Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2","plain":"Attackers can get past the login, over the internet, without logging in, once a user opens a file or link.","summary":"Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2","vendor":"Danfoss","product":"AK-SM 8xxA Series","product_display":"Danfoss AK-SM 8xxA Series","keys":["danfoss","danfoss:ak-sm-8xxa-series"],"cves":[{"id":"CVE-2025-41450","name":"Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2","description":"Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2","cvss":8.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H","severity":"high","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":["4.2"],"patch":"fixed","cwes":[]}],"severity":"high","cvss":8.2,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"2 PoC repos on GitHub","ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["4.2"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-10-13","added":"2026-10-13","updated":"2026-10-13","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2025-41450","label":"CVE record CVE-2025-41450","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2025-05-08","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-12","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-13","lane":"code","label":"First public proof of concept on GitHub for CVE-2025-41450 (now 2 repositories)","url":null},{"d":"2026-10-13","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-17","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run Danfoss AK-SM 8xxA Series, plan the update in your next patch round, and sooner if it faces the internet. The fix: version 4.2 or later.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":11},{"id":"2026-10-12-radar-cve-2026-102255","kind":"radar","title":"CVE-2026-102255: public exploit code","plain":"Attackers can make the server send requests on their behalf, over the internet, without logging in.","summary":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.","vendor":"SonicWall","product":"SMA1000","product_display":"SonicWall SMA1000","keys":["sonicwall","sonicwall:sma1000"],"cves":[{"id":"CVE-2026-102255","name":"CVE-2026-102255","description":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":null,"epss_pct":null,"automatable":false,"impact":null,"fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":10.0,"epss":null,"epss_pct":null,"exploited":false,"sources":["Early signals"],"outlets":[],"radar_what":"2 PoC repos on GitHub","ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-10-12","added":"2026-10-12","updated":"2026-10-12","due":null,"refs":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102255","label":"CVE record CVE-2026-102255","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-10-07","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-10","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-12","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-102255 (now 2 repositories)","url":null},{"d":"2026-10-12","lane":"social","label":"3 posts from 3 accounts (Bluesky 3)","url":null,"n":3},{"d":"2026-10-13","lane":"social","label":"2 posts from 2 accounts (Bluesky 2)","url":null,"n":2},{"d":"2026-10-14","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"No attacks confirmed yet, but exploit code is public. If you run SonicWall SMA1000, plan the update in your next patch round, and sooner if it faces the internet.","also":["Do not run proof-of-concept code from GitHub to test: fake PoCs often carry malware."],"urgency":"soon","action_label":"Watch closely","live":true,"age_days":12},{"id":"2026-09-25-wordpress-core","kind":"exploited","title":"WordPress Core: Remote File Inclusion","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","vendor":"WordPress","product":"Core","product_display":"WordPress Core","keys":["wordpress","wordpress:core"],"cves":[{"id":"CVE-2026-87902","name":"Remote File Inclusion","description":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","cvss":8.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.39979,"epss_pct":0.98629,"automatable":false,"impact":"total","fixed":["7.1.2"],"patch":"fixed","cwes":["CWE-98"]}],"severity":"high","cvss":8.1,"epss":0.39979,"epss_pct":0.98629,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["7.1.2"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-23","added":"2026-09-25","updated":"2026-09-26","due":"2026-09-28","refs":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84555","label":"ENISA EUVD EUVD-2026-84555","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87902","label":"CVE record CVE-2026-87902","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/52690","label":"Exploit-DB 52690: WordPress 7.0.2 - Path Travesal","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml","label":"Nuclei template: WordPress Core - PHP Template Path Traversal","kind":"exploit"},{"url":"https://bsky.app/search?q=CVE-2026-87902","label":"Bluesky: search for CVE-2026-87902","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: WordPress Core - PHP Template Path Traversal","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml"},{"d":"2026-09-22","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-87902 (now 25 repositories)","url":null},{"d":"2026-09-23","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84555"},{"d":"2026-09-25","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902"},{"d":"2026-10-01","lane":"code","label":"Exploit-DB 52690: WordPress 7.0.2 - Path Travesal","url":"https://www.exploit-db.com/exploits/52690"},{"d":"2026-10-13","lane":"social","label":"1 post from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-16","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1},{"d":"2026-10-23","lane":"social","label":"3 posts from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":25,"exploitdb":1,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":1,"recent":1,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update WordPress Core to 7.1.2 or later.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":31},{"id":"2026-09-22-arista-velocloud-orchestrator","kind":"exploited","title":"Arista VeloCloud Orchestrator: Improper Input Validation","plain":null,"summary":"Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","vendor":"Arista","product":"VeloCloud Orchestrator","product_display":"Arista VeloCloud Orchestrator","keys":["arista","arista:velocloud-orchestrator"],"cves":[{"id":"CVE-2026-93952","name":"Improper Input Validation","description":"Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.01062,"epss_pct":0.64332,"automatable":true,"impact":"total","fixed":[],"patch":"fixed","cwes":["CWE-20"]}],"severity":"critical","cvss":10.0,"epss":0.01062,"epss_pct":0.64332,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-22","added":"2026-09-22","updated":"2026-09-23","due":"2026-09-25","refs":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183","label":"Vendor advisory (arista.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84296","label":"ENISA EUVD EUVD-2026-84296","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93952","label":"CVE record CVE-2026-93952","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-22","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952"},{"d":"2026-09-22","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84296"},{"d":"2026-09-22","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Arista VeloCloud Orchestrator from the vendor advisory.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":32},{"id":"2026-09-22-check-point-multiple-products","kind":"exploited","title":"Check Point (multiple products): 2 flaws exploited together","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. CISA lists 1 more flaw in Check Point (multiple products) as exploited on the same day (CVE-2026-93616).","vendor":"Check Point","product":"Multiple Products","product_display":"Check Point (multiple products)","keys":["check-point","check-point:multiple-products"],"cves":[{"id":"CVE-2026-85102","name":"Improper Certificate Validation","description":"Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.5423,"epss_pct":0.9901,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-295"]},{"id":"CVE-2026-93616","name":"Path Traversal","description":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.75872,"epss_pct":0.99529,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-22"]}],"severity":"critical","cvss":9.8,"epss":0.75872,"epss_pct":0.99529,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-22","added":"2026-09-22","updated":"2026-09-23","due":"2026-09-25","refs":[{"url":"https://support.checkpoint.com/results/sk/sk1000117","label":"Vendor advisory (support.checkpoint.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75009","label":"ENISA EUVD EUVD-2026-75009","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84375","label":"ENISA EUVD EUVD-2026-84375","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85102","label":"CVE record CVE-2026-85102","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-93616.yaml","label":"Nuclei template: Check Point Security Management - Unauthenticated Directory Traversal to RCE","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Check Point Security Management - Unauthenticated Directory Traversal to RCE","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-93616.yaml"},{"d":"2026-09-09","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-22","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102"},{"d":"2026-09-22","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75009"},{"d":"2026-09-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-93616 (now 2 repositories)","url":null},{"d":"2026-10-07","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-85102","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for the affected Check Point products: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":32},{"id":"2026-09-21-zyxel-gs1900-series-switches","kind":"exploited","title":"Zyxel GS1900 Series Switches: Stack-Based Buffer Overflow","plain":"Memory corruption that can let attackers run code, from the same network, without logging in.","summary":"Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","vendor":"Zyxel","product":"GS1900 Series Switches","product_display":"Zyxel GS1900 Series Switches","keys":["zyxel","zyxel:gs1900-series-switches"],"cves":[{"id":"CVE-2026-7273","name":"Stack-Based Buffer Overflow","description":"Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.02501,"epss_pct":0.84595,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-121"]}],"severity":"high","cvss":8.8,"epss":0.02501,"epss_pct":0.84595,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-21","added":"2026-09-21","updated":"2026-09-22","due":"2026-09-24","refs":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026","label":"Vendor advisory (zyxel.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7273","label":"CVE record CVE-2026-7273","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-06-16","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-21","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Zyxel GS1900 Series Switches: install the update or apply the mitigation it lists.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":33},{"id":"2026-09-16-cisco-identity-services-engine","kind":"exploited","title":"Cisco Identity Services Engine: Incorrect Use of Privileged APIs","plain":null,"summary":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.","vendor":"Cisco","product":"Identity Services Engine","product_display":"Cisco Identity Services Engine","keys":["cisco","cisco:identity-services-engine"],"cves":[{"id":"CVE-2026-76460","name":"Incorrect Use of Privileged APIs","description":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.14026,"epss_pct":0.96555,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-648"]},{"id":"CVE-2026-76439","name":"Cisco Identity Services Engine Event Injection","description":"A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline. This vulnerability is due to insufficient authentication on an internal interface that is exposed through the guest portal. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to manipulate the posture status on the affected system.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-76444","name":"Cisco Identity Services Engine Information Disclosure","description":"A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table (PRRT) service. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to obtain sensitive configuration information from the affected device.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-76446","name":"Cisco Identity Services Engine External Entity Injection","description":"A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific&nbsp;files on the underlying operating system of an affected device. This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read specific&nbsp;files on the affected system that the underlying process has permission to access.","cvss":4.9,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","severity":"medium","fixed":[],"cwes":[]},{"id":"CVE-2026-76447","name":"Cisco Identity Services Engine Certificate Reload","description":"A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a function of the OCSP responder. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause the OCSP responder to reload certificate and key material on demand.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","severity":"medium","fixed":[],"cwes":[]}],"severity":"critical","cvss":10.0,"epss":0.14026,"epss_pct":0.96555,"exploited":true,"sources":["CISA KEV","ENISA EUVD","News"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-16","added":"2026-09-16","updated":"2026-10-07","due":"2026-09-19","refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5","label":"Vendor advisory (sec.cloudapps.cisco.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81122","label":"ENISA EUVD EUVD-2026-81122","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76460","label":"CVE record CVE-2026-76460","kind":"registry"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Authentication%20Bypass%20Vulnerabilities%26vs_k=1","label":"Cisco PSIRT: Cisco Identity Services Engine Authentication Bypass Vulnerabilities","kind":"news"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-76460.yaml","label":"Nuclei template: Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-76460.yaml"},{"d":"2026-09-16","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460"},{"d":"2026-09-16","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81122"},{"d":"2026-09-16","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-17","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-76460","url":null},{"d":"2026-09-24","lane":"cert","label":"Cisco PSIRT: Cisco Identity Services Engine Authentication Bypass Vulnerabilities","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Identity%20Services%20Engine%20Authentication%20Bypass%20Vulnerabilities%26vs_k=1"}],"outlets":["Cisco PSIRT"],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Cisco Identity Services Engine: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":38},{"id":"2026-09-16-google-pixel","kind":"exploited","title":"Google Pixel: Improper Authorization","plain":"Attackers can reach functions they should not have access to, from the same network, without logging in.","summary":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.","vendor":"Google","product":"Pixel","product_display":"Google Pixel","keys":["google","google:pixel"],"cves":[{"id":"CVE-2026-58704","name":"Improper Authorization","description":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.00591,"epss_pct":0.4757,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-693"]}],"severity":"high","cvss":8.8,"epss":0.00591,"epss_pct":0.4757,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-16","added":"2026-09-16","updated":"2026-10-07","due":"2026-09-19","refs":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01","label":"Vendor advisory (source.android.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-79004","label":"ENISA EUVD EUVD-2026-79004","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58704","label":"CVE record CVE-2026-58704","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-15","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-16","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704"},{"d":"2026-09-16","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-79004"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Google Pixel: install the update or apply the mitigation it lists.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":38},{"id":"2026-09-16-acronis-backup","kind":"exploited","title":"Acronis Backup: Incorrect Default Permissions","plain":"Attackers can gain higher privileges, once they have access to the device.","summary":"Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.","vendor":"Acronis","product":"Backup","product_display":"Acronis Backup","keys":["acronis","acronis:backup"],"cves":[{"id":"CVE-2026-87886","name":"Incorrect Default Permissions","description":"Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.","cvss":7.8,"cvss_version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.00233,"epss_pct":0.134,"automatable":false,"impact":"total","fixed":["1.9.3.1021","1.8.11.638","1.2.3.238"],"patch":"fixed","cwes":["CWE-276"]}],"severity":"high","cvss":7.8,"epss":0.00233,"epss_pct":0.134,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["1.9.3.1021","1.8.11.638","1.2.3.238"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-16","added":"2026-09-16","updated":"2026-09-18","due":"2026-09-19","refs":[{"url":"https://security-advisory.acronis.com/advisories/SEC-10986","label":"Vendor advisory (security-advisory.acronis.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82595","label":"ENISA EUVD EUVD-2026-82595","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87886","label":"CVE record CVE-2026-87886","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-16","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886"},{"d":"2026-09-16","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82595"},{"d":"2026-09-17","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Acronis Backup to the fixed version for your release line (for example 1.9.3.1021, 1.8.11.638 or 1.2.3.238).","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":38},{"id":"2026-09-14-cisco-secure-email-gateway","kind":"exploited","title":"Cisco Secure Email Gateway: SQL Injection","plain":"Attackers can read or change the database, over the internet, without logging in.","summary":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.","vendor":"Cisco","product":"Secure Email Gateway","product_display":"Cisco Secure Email Gateway","keys":["cisco","cisco:secure-email-gateway"],"cves":[{"id":"CVE-2026-76461","name":"SQL Injection","description":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.29543,"epss_pct":0.98191,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-89"]}],"severity":"critical","cvss":9.8,"epss":0.29543,"epss_pct":0.98191,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-14","added":"2026-09-14","updated":"2026-09-18","due":"2026-09-17","refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX","label":"Vendor advisory (sec.cloudapps.cisco.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-77625","label":"ENISA EUVD EUVD-2026-77625","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76461","label":"CVE record CVE-2026-76461","kind":"registry"},{"url":"https://bsky.app/search?q=CVE-2026-76461","label":"Bluesky: search for CVE-2026-76461","kind":"discussion"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-14","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461"},{"d":"2026-09-14","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-77625"},{"d":"2026-09-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-76461 (now 4 repositories)","url":null},{"d":"2026-10-19","lane":"social","label":"2 posts from 1 account (Bluesky 1)","url":null,"n":1}],"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":1,"recent":0,"platforms":["Bluesky"],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Cisco Secure Email Gateway: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":40},{"id":"2026-09-11-connectwise-screenconnect","kind":"exploited","title":"ConnectWise ScreenConnect: Improper Privilege Management and Missing Authorization","plain":"Attackers can gain higher privileges, over the internet.","summary":"ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.","vendor":"ConnectWise","product":"ScreenConnect","product_display":"ConnectWise ScreenConnect","keys":["connectwise","connectwise:screenconnect"],"cves":[{"id":"CVE-2026-84869","name":"Improper Privilege Management and Missing Authorization","description":"ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.","cvss":9.9,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.00924,"epss_pct":0.6008,"automatable":false,"impact":"total","fixed":[],"patch":"fixed","cwes":["CWE-269","CWE-862"]}],"severity":"critical","cvss":9.9,"epss":0.00924,"epss_pct":0.6008,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-11","added":"2026-09-11","updated":"2026-09-12","due":"2026-09-14","refs":[{"url":"https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin","label":"Vendor advisory (connectwise.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-74053","label":"ENISA EUVD EUVD-2026-74053","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84869","label":"CVE record CVE-2026-84869","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-08","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-11","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"},{"d":"2026-09-11","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-74053"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for ConnectWise ScreenConnect from the vendor advisory.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":43},{"id":"2026-09-11-gitlab-community-edition-and-enterprise-edition","kind":"exploited","title":"GitLab Community Edition and Enterprise Edition: Path Traversal","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.","vendor":"GitLab","product":"Community Edition and Enterprise Edition","product_display":"GitLab Community Edition and Enterprise Edition","keys":["gitlab","gitlab:community-edition-and-enterprise-edition"],"cves":[{"id":"CVE-2026-85706","name":"Path Traversal","description":"GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","severity":"critical","epss":0.91951,"epss_pct":0.99821,"automatable":true,"impact":"total","fixed":["18.11.12","19.0.9","19.1.8","19.2.6","19.3.2"],"patch":"fixed","cwes":["CWE-35"]}],"severity":"critical","cvss":10.0,"epss":0.91951,"epss_pct":0.99821,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["18.11.12","19.0.9","19.1.8","19.2.6","19.3.2"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-11","added":"2026-09-11","updated":"2026-09-23","due":"2026-09-14","refs":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/","label":"Vendor advisory (docs.gitlab.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76779","label":"ENISA EUVD EUVD-2026-76779","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85706","label":"CVE record CVE-2026-85706","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/auxiliary/gather/gitlab_file_read_cve_2026_85706/","label":"Metasploit auxiliary: GitLab Unauthenticated Arbitrary File Read","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85706.yaml","label":"Nuclei template: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85706.yaml"},{"d":"2026-09-11","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706"},{"d":"2026-09-11","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76779"},{"d":"2026-09-11","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-85706 (now 13 repositories)","url":null},{"d":"2026-09-12","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-17","lane":"code","label":"Metasploit auxiliary: GitLab Unauthenticated Arbitrary File Read","url":"https://www.rapid7.com/db/modules/auxiliary/gather/gitlab_file_read_cve_2026_85706/"}],"signals":{"poc":13,"exploitdb":0,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update GitLab Community Edition and Enterprise Edition to the fixed version for your release line (for example 18.11.12, 19.0.9 or 19.1.8).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":43},{"id":"2026-09-11-jfrog-artifactory","kind":"exploited","title":"JFrog Artifactory: 2 flaws exploited together","plain":"Attackers can get past the login, over the internet.","summary":"JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. CISA lists 1 more flaw in JFrog Artifactory as exploited on the same day (CVE-2026-42018).","vendor":"JFrog","product":"Artifactory","product_display":"JFrog Artifactory","keys":["jfrog","jfrog:artifactory"],"cves":[{"id":"CVE-2026-42016","name":"Incorrect Authorization","description":"JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.","cvss":8.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","severity":"high","epss":0.08643,"epss_pct":0.9511,"automatable":false,"impact":"total","fixed":["7.133.11"],"patch":"fixed","cwes":["CWE-863"]},{"id":"CVE-2026-42018","name":"Improper Authentication","description":"JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.","cvss":7.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","severity":"high","epss":0.09805,"epss_pct":0.95546,"automatable":true,"impact":"partial","fixed":["7.111.20","7.117.27","7.125.19","7.133.28","7.146.8"],"patch":"fixed","cwes":["CWE-287"]}],"severity":"high","cvss":8.1,"epss":0.09805,"epss_pct":0.95546,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["7.133.11","7.111.20","7.117.27","7.125.19","7.133.28","7.146.8"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-11","added":"2026-09-11","updated":"2026-10-01","due":"2026-09-25","refs":[{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","label":"Vendor advisory (docs.jfrog.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49566","label":"ENISA EUVD EUVD-2026-49566","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57388","label":"ENISA EUVD EUVD-2026-57388","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42016","label":"CVE record CVE-2026-42016","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42018.yaml","label":"Nuclei template: JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42018.yaml"},{"d":"2026-07-27","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-11","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016"},{"d":"2026-09-11","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49566"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update JFrog Artifactory to the fixed version for your release line (for example 7.133.11, 7.111.20 or 7.117.27).","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":43},{"id":"2026-09-09-citrix-netscaler","kind":"exploited","title":"Citrix NetScaler: Authentication Bypass Using an Alternate Path or Channel","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.","vendor":"Citrix","product":"NetScaler","product_display":"Citrix NetScaler","keys":["citrix","citrix:netscaler"],"cves":[{"id":"CVE-2026-19490","name":"Authentication Bypass Using an Alternate Path or Channel","description":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.","cvss":9.3,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","severity":"critical","epss":0.23158,"epss_pct":0.97767,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-288"]}],"severity":"critical","cvss":9.3,"epss":0.23158,"epss_pct":0.97767,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-09","added":"2026-09-09","updated":"2026-10-07","due":"2026-09-12","refs":[{"url":"https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html","label":"Vendor advisory (support.citrix.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62395","label":"ENISA EUVD EUVD-2026-62395","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19490","label":"CVE record CVE-2026-19490","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-19","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-02","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-19490 (now 3 repositories)","url":null},{"d":"2026-09-09","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490"},{"d":"2026-09-09","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62395"}],"signals":{"poc":3,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Citrix NetScaler: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":45},{"id":"2026-09-09-cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-fire","kind":"exploited","title":"Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Firewall Management Center Authentication Bypass Using an Alternate Path or Channel","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.","vendor":"Cisco","product":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","product_display":"Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","keys":["cisco","cisco:secure-firewall-management-center-fmc-and-security-cloud-control-scc-firewall-management"],"cves":[{"id":"CVE-2026-20079","name":"Firewall Management Center Authentication Bypass Using an Alternate Path or Channel","description":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.88472,"epss_pct":0.99774,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-288"]}],"severity":"critical","cvss":10.0,"epss":0.88472,"epss_pct":0.99774,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-09","added":"2026-09-09","updated":"2026-09-16","due":"2026-09-12","refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2","label":"Vendor advisory (sec.cloudapps.cisco.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20079","label":"CVE record CVE-2026-20079","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/linux/http/cisco_fmc_auth_bypass_rce/","label":"Metasploit exploit: Cisco Secure Firewall Management Center Authentication Bypass RCE","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20079.yaml","label":"Nuclei template: Cisco Secure Firewall Management Center - Authentication Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Cisco Secure Firewall Management Center - Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20079.yaml"},{"d":"2026-03-04","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-03-28","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-20079 (now 3 repositories)","url":null},{"d":"2026-09-08","lane":"code","label":"Metasploit exploit: Cisco Secure Firewall Management Center Authentication Bypass RCE","url":"https://www.rapid7.com/db/modules/exploit/linux/http/cisco_fmc_auth_bypass_rce/"},{"d":"2026-09-09","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079"}],"signals":{"poc":3,"exploitdb":0,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":45},{"id":"2026-09-09-fortinet-multiple-products","kind":"exploited","title":"Fortinet (multiple products): Heap-based Buffer Overflow","plain":"Memory corruption that can let attackers run code, over the internet, without logging in.","summary":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.","vendor":"Fortinet","product":"Multiple Products","product_display":"Fortinet (multiple products)","keys":["fortinet","fortinet:multiple-products"],"cves":[{"id":"CVE-2025-25249","name":"Heap-based Buffer Overflow","description":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.","cvss":7.4,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C","severity":"high","epss":0.03802,"epss_pct":0.8997,"automatable":false,"impact":"total","fixed":[],"patch":"fixed","cwes":["CWE-122","CWE-787"]}],"severity":"high","cvss":7.4,"epss":0.03802,"epss_pct":0.8997,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-09","added":"2026-09-09","updated":"2026-10-15","due":"2026-09-12","refs":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-084","label":"Vendor advisory (fortiguard.fortinet.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-25249","label":"CVE record CVE-2025-25249","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-01-13","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-09","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for the affected Fortinet products from the vendor advisory.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":45},{"id":"2026-09-09-google-chromium-v8","kind":"exploited","title":"Google Chromium V8: Out of Bounds Write","plain":"Memory corruption that can let attackers run code, over the internet, without logging in, once a user opens a file or link.","summary":"Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","vendor":"Google","product":"Chromium V8","product_display":"Google Chromium V8","keys":["google","google:chromium-v8"],"cves":[{"id":"CVE-2026-87491","name":"Out of Bounds Write","description":"Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","severity":"high","epss":0.03142,"epss_pct":0.87834,"automatable":false,"impact":"total","fixed":["153.0.8010.36"],"patch":"fixed","cwes":["CWE-787"]}],"severity":"high","cvss":8.8,"epss":0.03142,"epss_pct":0.87834,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["153.0.8010.36"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-09","added":"2026-09-09","updated":"2026-09-21","due":"2026-09-23","refs":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"Vendor advisory (chromereleases.googleblog.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-74529","label":"ENISA EUVD EUVD-2026-74529","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87491","label":"CVE record CVE-2026-87491","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-09","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491"},{"d":"2026-09-09","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-74529"},{"d":"2026-09-09","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-10","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-87491","url":null},{"d":"2026-09-12","lane":"cert","label":"Microsoft advisory: Chromium CVE-2026-87491: Out of bounds write in V8","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87491"}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[{"vendor":"Microsoft","title":"Chromium CVE-2026-87491: Out of bounds write in V8","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87491","date":"2026-09-12","key":"microsoft"}],"advisory_keys":["microsoft"],"action":"Update Google Chromium V8 to 153.0.8010.36 or later.","also":[],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":45},{"id":"2026-09-08-adobe-commerce-and-magento","kind":"exploited","title":"Adobe Commerce and Magento: Improper Neutralization of Special Elements Used in a Template Engine","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.","vendor":"Adobe","product":"Commerce and Magento","product_display":"Adobe Commerce and Magento","keys":["adobe","adobe:commerce-and-magento"],"cves":[{"id":"CVE-2026-75650","name":"Improper Neutralization of Special Elements Used in a Template Engine","description":"Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.03949,"epss_pct":0.90376,"automatable":true,"impact":"total","fixed":["Hotfix for CVE-2026-7565"],"patch":"fixed","cwes":["CWE-1336"]}],"severity":"critical","cvss":10.0,"epss":0.03949,"epss_pct":0.90376,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["Hotfix for CVE-2026-7565"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-08","added":"2026-09-08","updated":"2026-09-09","due":"2026-09-11","refs":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-146.html","label":"Vendor advisory (helpx.adobe.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72530","label":"ENISA EUVD EUVD-2026-72530","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75650","label":"CVE record CVE-2026-75650","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-07","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-07","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-75650 (now 6 repositories)","url":null},{"d":"2026-09-08","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650"},{"d":"2026-09-08","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72530"}],"signals":{"poc":6,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Adobe Commerce and Magento to Hotfix for CVE-2026-7565 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":46},{"id":"2026-09-08-n-able-n-central","kind":"exploited","title":"N-able N-central: Static Code Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.","vendor":"N-able","product":"N-central","product_display":"N-able N-central","keys":["n-able","n-able:n-central"],"cves":[{"id":"CVE-2026-86218","name":"Static Code Injection","description":"N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.","cvss":10.0,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","severity":"critical","epss":0.13349,"epss_pct":0.96409,"automatable":true,"impact":"total","fixed":["2026.3.1.14"],"patch":"fixed","cwes":["CWE-96"]}],"severity":"critical","cvss":10.0,"epss":0.13349,"epss_pct":0.96409,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["2026.3.1.14"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-08","added":"2026-09-08","updated":"2026-09-09","due":"2026-09-11","refs":[{"url":"https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/","label":"Vendor advisory (status.n-able.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72041","label":"ENISA EUVD EUVD-2026-72041","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86218","label":"CVE record CVE-2026-86218","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/linux/http/nable_ncentral_unauth_rce_cve_2026_86218/","label":"Metasploit exploit: N-able N-central Struts BeanUtils Unauthenticated RCE","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86218.yaml","label":"Nuclei template: N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86218.yaml"},{"d":"2026-09-06","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-07","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-86218 (now 3 repositories)","url":null},{"d":"2026-09-08","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218"},{"d":"2026-09-08","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72041"},{"d":"2026-09-18","lane":"code","label":"Metasploit exploit: N-able N-central Struts BeanUtils Unauthenticated RCE","url":"https://www.rapid7.com/db/modules/exploit/linux/http/nable_ncentral_unauth_rce_cve_2026_86218/"}],"signals":{"poc":3,"exploitdb":0,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update N-able N-central to 2026.3.1.14 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":46},{"id":"2026-09-08-microsoft-windows","kind":"exploited","title":"Microsoft Windows: 2 flaws exploited together","plain":"Memory corruption that can let attackers run code, once they have access to the device.","summary":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CISA lists 1 more flaw in Microsoft Windows as exploited on the same day (CVE-2026-85880).","vendor":"Microsoft","product":"Windows","product_display":"Microsoft Windows","keys":["microsoft","microsoft:windows"],"cves":[{"id":"CVE-2026-81963","name":"Link Following","description":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","severity":"high","epss":0.00393,"epss_pct":0.32362,"automatable":false,"impact":"total","fixed":["10.0.22631.7582","10.0.26100.9445","10.0.26200.9445","10.0.28000.2954","10.0.26100.33438"],"patch":"fixed","cwes":["CWE-59","CWE-284"]},{"id":"CVE-2026-85880","name":"Heap-Based Buffer Overflow","description":"Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","severity":"high","epss":0.03616,"epss_pct":0.89459,"automatable":false,"impact":"total","fixed":["10.0.14393.9512","10.0.17763.9245","10.0.19044.7725","10.0.19045.7725","6.2.9200.26349","6.3.9600.23398"],"patch":"fixed","cwes":["CWE-122","CWE-908"]}],"severity":"high","cvss":7.8,"epss":0.03616,"epss_pct":0.89459,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["10.0.22631.7582","10.0.26100.9445","10.0.26200.9445","10.0.28000.2954","10.0.26100.33438","10.0.14393.9512"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-08","added":"2026-09-08","updated":"2026-10-14","due":"2026-09-22","refs":[{"url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73889","label":"ENISA EUVD EUVD-2026-73889","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73365","label":"ENISA EUVD EUVD-2026-73365","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81963","label":"CVE record CVE-2026-81963","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-08","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963"},{"d":"2026-09-08","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73889"},{"d":"2026-09-08","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-19","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-81963","url":null}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft Windows to the fixed version for your release line (for example 10.0.22631.7582, 10.0.26100.9445 or 10.0.26200.9445).","also":[],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":46},{"id":"2026-09-10-mikrotik-routeros","kind":"exploited","title":"MikroTik RouterOS: 2 flaws exploited together","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. CISA lists 1 more flaw in MikroTik RouterOS as exploited on the same day (CVE-2026-67277).","vendor":"MikroTik","product":"RouterOS","product_display":"MikroTik RouterOS","keys":["mikrotik","mikrotik:routeros"],"cves":[{"id":"CVE-2026-67277","name":"Missing Authentication for Critical Function","description":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.","cvss":8.8,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","severity":"high","epss":0.0156,"epss_pct":0.75058,"automatable":true,"impact":"partial","fixed":["7.24.2","7.23.4","6.49.21"],"patch":"fixed","cwes":["CWE-306"]},{"id":"CVE-2026-86060","name":"Improper Neutralization of Argument Delimiters in a Command","description":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","epss":0.06392,"epss_pct":0.93656,"automatable":true,"impact":"total","fixed":["7.24.2","7.23.4","6.49.21"],"patch":"fixed","cwes":["CWE-88"]}],"severity":"critical","cvss":9.2,"epss":0.06392,"epss_pct":0.93656,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["7.24.2","7.23.4","6.49.21"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-05","added":"2026-09-10","updated":"2026-09-11","due":"2026-09-13","refs":[{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","label":"Vendor advisory (mikrotik.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72025","label":"ENISA EUVD EUVD-2026-72025","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72029","label":"ENISA EUVD EUVD-2026-72029","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86060","label":"CVE record CVE-2026-86060","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/52683","label":"Exploit-DB 52683: MikroTrick_ 7.24_ 7.24.2_ 7.0.0_ 7.23.4_ 6.0.0_ 6.49.21 - RCE","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-05","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72025"},{"d":"2026-09-05","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-10","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060"},{"d":"2026-09-10","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-86060 (now 3 repositories)","url":null},{"d":"2026-09-24","lane":"code","label":"Exploit-DB 52683: MikroTrick_ 7.24_ 7.24.2_ 7.0.0_ 7.23.4_ 6.0.0_ 6.49.21 - RCE","url":"https://www.exploit-db.com/exploits/52683"}],"signals":{"poc":3,"exploitdb":1,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update MikroTik RouterOS to the fixed version for your release line (for example 7.24.2, 7.23.4 or 6.49.21).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":49},{"id":"2026-09-05-mikrotik-cve-2026-67276","kind":"exploited","title":"Mikrotik RouterOS: SSH user impersonation possible in Mikrotik RouterOS","plain":"Attackers can impersonate something trusted, over the internet, without logging in.","summary":"RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent.","vendor":"Mikrotik","product":"RouterOS","product_display":"Mikrotik RouterOS","keys":["mikrotik","mikrotik:routeros"],"cves":[{"id":"CVE-2026-67276","name":"SSH user impersonation possible in Mikrotik RouterOS","description":"RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)","cvss":9.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","epss":0.06451,"epss_pct":0.93717,"automatable":false,"impact":"total","fixed":["7.24.2","7.23.4"],"patch":"fixed","cwes":[]}],"severity":"critical","cvss":9.2,"epss":0.06451,"epss_pct":0.93717,"exploited":true,"sources":["ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["7.24.2","7.23.4"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-05","added":"2026-09-05","updated":"2026-09-09","due":null,"refs":[{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","label":"Vendor advisory (mikrotik.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72024","label":"ENISA EUVD EUVD-2026-72024","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67276","label":"CVE record CVE-2026-67276","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-05","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72024"},{"d":"2026-09-05","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-06","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-67276 (now 4 repositories)","url":null},{"d":"2026-10-15","lane":"social","label":"1 post from 1 account (Hacker News 1)","url":null,"n":1}],"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Mikrotik RouterOS to 7.24.2 or 7.23.4 or later.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":49},{"id":"2026-09-04-google-chromium-v8","kind":"exploited","title":"Google Chromium V8: Type Confusion","plain":"Memory corruption that can let attackers run code, over the internet, without logging in, once a user opens a file or link.","summary":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","vendor":"Google","product":"Chromium V8","product_display":"Google Chromium V8","keys":["google","google:chromium-v8"],"cves":[{"id":"CVE-2026-85046","name":"Type Confusion","description":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","severity":"high","epss":0.48881,"epss_pct":0.98877,"automatable":false,"impact":"total","fixed":["152.0.7977.82"],"patch":"fixed","cwes":["CWE-843"]}],"severity":"high","cvss":8.8,"epss":0.48881,"epss_pct":0.98877,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["152.0.7977.82"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-04","added":"2026-09-04","updated":"2026-09-21","due":"2026-09-18","refs":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html","label":"Vendor advisory (chromereleases.googleblog.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70702","label":"ENISA EUVD EUVD-2026-70702","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85046","label":"CVE record CVE-2026-85046","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-03","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-04","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046"},{"d":"2026-09-04","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70702"},{"d":"2026-09-04","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-85046 (now 7 repositories)","url":null},{"d":"2026-09-09","lane":"cert","label":"Microsoft advisory: Chromium: CVE-2026-85046 Type confusion in V8","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85046"}],"signals":{"poc":7,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[{"vendor":"Microsoft","title":"Chromium: CVE-2026-85046 Type confusion in V8","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85046","date":"2026-09-09","key":"microsoft"}],"advisory_keys":["microsoft"],"action":"Update Google Chromium V8 to 152.0.7977.82 or later.","also":[],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":50},{"id":"2026-09-02-kestra-kestra-oss","kind":"exploited","title":"Kestra OSS: OS Command Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.","vendor":"Kestra","product":"Kestra OSS","product_display":"Kestra OSS","keys":["kestra","kestra:kestra-oss"],"cves":[{"id":"CVE-2026-49869","name":"OS Command Injection","description":"Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.02095,"epss_pct":0.81526,"automatable":true,"impact":"total","fixed":["1.0.45","1.3.21"],"patch":"fixed","cwes":["CWE-78","CWE-184","CWE-287","CWE-918"]}],"severity":"critical","cvss":10.0,"epss":0.02095,"epss_pct":0.81526,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["1.0.45","1.3.21"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-02","added":"2026-09-02","updated":"2026-09-03","due":"2026-09-05","refs":[{"url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39922","label":"ENISA EUVD EUVD-2026-39922","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49869","label":"CVE record CVE-2026-49869","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-06-26","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-06-30","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-49869 (now 2 repositories)","url":null},{"d":"2026-09-02","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869"},{"d":"2026-09-02","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39922"}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Kestra OSS to 1.0.45 or 1.3.21 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":52},{"id":"2026-09-02-jfrog-artifactory","kind":"exploited","title":"JFrog Artifactory: Improper Authentication","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.","vendor":"JFrog","product":"Artifactory","product_display":"JFrog Artifactory","keys":["jfrog","jfrog:artifactory"],"cves":[{"id":"CVE-2026-82329","name":"Improper Authentication","description":"JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.14372,"epss_pct":0.96617,"automatable":true,"impact":"total","fixed":["7.111.21","7.117.28","7.125.20","7.133.29","7.146.38","7.161.20"],"patch":"fixed","cwes":["CWE-287"]}],"severity":"critical","cvss":9.8,"epss":0.14372,"epss_pct":0.96617,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["7.111.21","7.117.28","7.125.20","7.133.29","7.146.38","7.161.20"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-02","added":"2026-09-02","updated":"2026-09-03","due":"2026-09-05","refs":[{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","label":"Vendor advisory (docs.jfrog.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67861","label":"ENISA EUVD EUVD-2026-67861","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82329","label":"CVE record CVE-2026-82329","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82329.yaml","label":"Nuclei template: JFrog Artifactory Access Blank Join Key Authentication Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: JFrog Artifactory Access Blank Join Key Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82329.yaml"},{"d":"2026-08-28","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-01","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-82329 (now 8 repositories)","url":null},{"d":"2026-09-02","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329"},{"d":"2026-09-02","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67861"}],"signals":{"poc":8,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update JFrog Artifactory to the fixed version for your release line (for example 7.111.21, 7.117.28 or 7.125.20).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":52},{"id":"2026-09-02-sangoma-switchvox","kind":"exploited","title":"Sangoma Switchvox: SQL Injection","plain":"Attackers can read or change the database, over the internet, without logging in.","summary":"Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.","vendor":"Sangoma","product":"Switchvox","product_display":"Sangoma Switchvox","keys":["sangoma","sangoma:switchvox"],"cves":[{"id":"CVE-2026-9586","name":"SQL Injection","description":"Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.","cvss":9.3,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","epss":0.18979,"epss_pct":0.973,"automatable":true,"impact":"total","fixed":["8.4.0.2"],"patch":"fixed","cwes":["CWE-89"]}],"severity":"critical","cvss":9.3,"epss":0.18979,"epss_pct":0.973,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["8.4.0.2"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-02","added":"2026-09-02","updated":"2026-09-03","due":"2026-09-05","refs":[{"url":"https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026","label":"Vendor advisory (sangomakb.atlassian.net)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45205","label":"ENISA EUVD EUVD-2026-45205","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9586","label":"CVE record CVE-2026-9586","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9586.yaml","label":"Nuclei template: Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9586.yaml"},{"d":"2026-07-17","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-02","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586"},{"d":"2026-09-02","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45205"},{"d":"2026-09-02","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-9586 (now 2 repositories)","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Sangoma Switchvox to 8.4.0.2 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":52},{"id":"2026-09-02-sonicwall-sma1000-appliances","kind":"exploited","title":"SonicWall SMA1000 Appliances: 2 flaws exploited together","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA lists 1 more flaw in SonicWall SMA1000 Appliances as exploited on the same day (CVE-2026-83549).","vendor":"SonicWall","product":"SMA1000 Appliances","product_display":"SonicWall SMA1000 Appliances","keys":["sonicwall","sonicwall:sma1000-appliances"],"cves":[{"id":"CVE-2026-83548","name":"Server-Side Request Forgery","description":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.08043,"epss_pct":0.94784,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-918","CWE-441"]},{"id":"CVE-2026-83549","name":"OS Command Injection","description":"SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.09889,"epss_pct":0.95573,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-78"]}],"severity":"critical","cvss":10.0,"epss":0.09889,"epss_pct":0.95573,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-02","added":"2026-09-02","updated":"2026-09-21","due":"2026-09-05","refs":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016","label":"Vendor advisory (psirt.global.sonicwall.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-69704","label":"ENISA EUVD EUVD-2026-69704","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-69707","label":"ENISA EUVD EUVD-2026-69707","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-83548","label":"CVE record CVE-2026-83548","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/linux/http/sonicwall_sma1000_couchdb_rce/","label":"Metasploit exploit: SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-83548.yaml","label":"Nuclei template: SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-83548.yaml"},{"d":"2026-09-01","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-02","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548"},{"d":"2026-09-02","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-69704"},{"d":"2026-09-03","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-83548 (now 3 repositories)","url":null},{"d":"2026-09-09","lane":"code","label":"Metasploit exploit: SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution","url":"https://www.rapid7.com/db/modules/exploit/linux/http/sonicwall_sma1000_couchdb_rce/"}],"signals":{"poc":3,"exploitdb":0,"metasploit":2,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for SonicWall SMA1000 Appliances: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":52},{"id":"2026-09-02-geonetwork-cve-2026-58400","kind":"exploited","title":"Geonetwork core-geonetwork: vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter","plain":"Attackers can run their own code, over the internet, with an admin account.","summary":"GeoNetwork is a catalog application to manage spatially referenced resources.","vendor":"geonetwork","product":"core-geonetwork","product_display":"Geonetwork core-geonetwork","keys":["geonetwork","geonetwork:core-geonetwork"],"cves":[{"id":"CVE-2026-58400","name":"vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter","description":"GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.","cvss":9.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.01187,"epss_pct":0.67669,"automatable":false,"impact":"total","fixed":["4.4.12","4.2.17"],"patch":"fixed","cwes":[]}],"severity":"critical","cvss":9.1,"epss":0.01187,"epss_pct":0.67669,"exploited":true,"sources":["ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["4.4.12","4.2.17"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-02","added":"2026-09-02","updated":"2026-09-04","due":null,"refs":[{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70645","label":"ENISA EUVD EUVD-2026-70645","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58400","label":"CVE record CVE-2026-58400","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-02","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70645"},{"d":"2026-09-03","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Geonetwork core-geonetwork to 4.4.12 or 4.2.17 or later.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":52},{"id":"2026-09-02-berriai-litellm","kind":"exploited","title":"BerriAI LiteLLM: Improper Authentication","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.","vendor":"BerriAI","product":"LiteLLM","product_display":"BerriAI LiteLLM","keys":["berriai","berriai:litellm"],"cves":[{"id":"CVE-2026-59822","name":"Improper Authentication","description":"BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.","cvss":8.8,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","severity":"high","epss":0.00836,"epss_pct":0.57323,"automatable":true,"impact":"partial","fixed":["1.84.0"],"patch":"fixed","cwes":["CWE-287","CWE-306"]}],"severity":"high","cvss":8.8,"epss":0.00836,"epss_pct":0.57323,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["1.84.0"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-02","added":"2026-09-02","updated":"2026-09-03","due":"2026-09-16","refs":[{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42359","label":"ENISA EUVD EUVD-2026-42359","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59822","label":"CVE record CVE-2026-59822","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-08","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-02","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822"},{"d":"2026-09-02","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42359"},{"d":"2026-09-03","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-59822","url":null}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update BerriAI LiteLLM to 1.84.0 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":52},{"id":"2026-09-02-geonetwork-cve-2026-63219","kind":"exploited","title":"Geonetwork core-geonetwork: Unauthenticated file upload via missing authorization on formatter upload endpoint","plain":"Attackers can plant malicious files, over the internet, without logging in.","summary":"GeoNetwork is a catalog application to manage spatially referenced resources.","vendor":"geonetwork","product":"core-geonetwork","product_display":"Geonetwork core-geonetwork","keys":["geonetwork","geonetwork:core-geonetwork"],"cves":[{"id":"CVE-2026-63219","name":"Unauthenticated file upload via missing authorization on formatter upload endpoint","description":"GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.","cvss":8.6,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","severity":"high","epss":0.00466,"epss_pct":0.39355,"automatable":true,"impact":"partial","fixed":["4.4.12","4.2.17"],"patch":"fixed","cwes":[]}],"severity":"high","cvss":8.6,"epss":0.00466,"epss_pct":0.39355,"exploited":true,"sources":["ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["4.4.12","4.2.17"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-09-02","added":"2026-09-02","updated":"2026-09-03","due":null,"refs":[{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70647","label":"ENISA EUVD EUVD-2026-70647","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63219","label":"CVE record CVE-2026-63219","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-09-02","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70647"},{"d":"2026-09-03","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Geonetwork core-geonetwork to 4.4.12 or 4.2.17 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":52},{"id":"2026-09-02-kludex-starlette","kind":"exploited","title":"Kludex Starlette: HTTP Request/Response Smuggling","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.","vendor":"Kludex","product":"Starlette","product_display":"Kludex Starlette","keys":["kludex","kludex:starlette"],"cves":[{"id":"CVE-2026-48710","name":"HTTP Request/Response Smuggling","description":"Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.","cvss":6.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","severity":"medium","epss":0.07056,"epss_pct":0.94194,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":["CWE-444"]}],"severity":"medium","cvss":6.5,"epss":0.07056,"epss_pct":0.94194,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-09-02","added":"2026-09-02","updated":"2026-10-01","due":"2026-09-16","refs":[{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48710","label":"CVE record CVE-2026-48710","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48710.yaml","label":"Nuclei template: Starlette - Improper Validation of Unsafe Equivalence in Input","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Starlette - Improper Validation of Unsafe Equivalence in Input","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48710.yaml"},{"d":"2026-04-01","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-48710 (now 5 repositories)","url":null},{"d":"2026-05-26","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-09-02","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710"}],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Kludex Starlette: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":52},{"id":"2026-08-31-papercut-ng-mf","kind":"exploited","title":"PaperCut NG/MF: 2 flaws exploited together","plain":"Attackers can get past the login, over the internet, with an admin account.","summary":"PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.","vendor":"PaperCut","product":"NG/MF","product_display":"PaperCut NG/MF","keys":["papercut","papercut:ng-mf"],"cves":[{"id":"CVE-2026-81578","name":"Missing Authentication for Critical Function","description":"PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.","cvss":8.8,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","severity":"high","epss":0.85581,"epss_pct":0.99726,"automatable":true,"impact":"partial","fixed":["24.1.10","25.0.13","26.0.5"],"patch":"fixed","cwes":["CWE-306"]},{"id":"CVE-2026-82078","name":"Unsafe Reflection","description":"PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.","cvss":9.4,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","severity":"critical","epss":0.63532,"epss_pct":0.99214,"automatable":false,"impact":"total","fixed":["24.1.10","25.0.13","26.0.5"],"patch":"fixed","cwes":["CWE-470"]}],"severity":"critical","cvss":9.4,"epss":0.85581,"epss_pct":0.99726,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["24.1.10","25.0.13","26.0.5"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-27","added":"2026-08-31","updated":"2026-09-13","due":"2026-09-14","refs":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","label":"Vendor advisory (papercut.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67713","label":"ENISA EUVD EUVD-2026-67713","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67714","label":"ENISA EUVD EUVD-2026-67714","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82078","label":"CVE record CVE-2026-82078","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/multi/http/papercut_ng_external_user_lookup_rce/","label":"Metasploit exploit: PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-81578.yaml","label":"Nuclei template: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-81578.yaml"},{"d":"2026-08-27","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67713"},{"d":"2026-08-28","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-29","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-81578 (now 2 repositories)","url":null},{"d":"2026-08-31","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078"},{"d":"2026-09-02","lane":"code","label":"Metasploit exploit: PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)","url":"https://www.rapid7.com/db/modules/exploit/multi/http/papercut_ng_external_user_lookup_rce/"}],"signals":{"poc":2,"exploitdb":0,"metasploit":2,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update PaperCut NG/MF to the fixed version for your release line (for example 24.1.10, 25.0.13 or 26.0.5).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":58},{"id":"2026-08-27-owncloud-owncloud","kind":"exploited","title":"ownCloud: Improper Authentication","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.","vendor":"ownCloud","product":"ownCloud","product_display":"ownCloud","keys":["owncloud","owncloud:owncloud"],"cves":[{"id":"CVE-2023-49105","name":"Improper Authentication","description":"ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N","severity":"critical","epss":0.4319,"epss_pct":0.98725,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-287"]}],"severity":"critical","cvss":9.8,"epss":0.4319,"epss_pct":0.98725,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-27","added":"2026-08-27","updated":"2026-08-28","due":"2026-08-30","refs":[{"url":"https://owncloud.org/security","label":"Vendor advisory (owncloud.org)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49105","label":"CVE record CVE-2023-49105","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2023-11-21","lane":"disclosure","label":"CVE published","url":null},{"d":"2023-12-05","lane":"code","label":"First public proof of concept on GitHub for CVE-2023-49105","url":null},{"d":"2026-08-27","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105"}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for ownCloud: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":58},{"id":"2026-08-27-zbtlink-cve-2026-74232","kind":"exploited","title":"Zbtlink (multiple products): MQWrt yunmgrd Cloud C2 Implant","plain":null,"summary":"Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor…","vendor":"Zbtlink","product":"multiple products","product_display":"Zbtlink (multiple products)","keys":["zbtlink","zbtlink:l3-v2-8","zbtlink:we826-t2","zbtlink:zbt-7628","zbtlink:zbt-zbt7621","zbtlink:mqac-7620","zbtlink:mqac-7620a","zbtlink:mqap-7620","zbtlink:mqap-7620a"],"cves":[{"id":"CVE-2026-74232","name":"MQWrt yunmgrd Cloud C2 Implant","description":"Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00814,"epss_pct":0.56625,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":9.8,"epss":0.00814,"epss_pct":0.56625,"exploited":true,"sources":["ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-27","added":"2026-08-27","updated":"2026-08-27","due":null,"refs":[{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66999","label":"ENISA EUVD EUVD-2026-66999","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74232","label":"CVE record CVE-2026-74232","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-27","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66999"},{"d":"2026-08-27","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for the affected Zbtlink products: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":58},{"id":"2026-08-27-zbtlink-cve-2026-74233","kind":"exploited","title":"Zbtlink (multiple products): MQWrt infosrvd Command Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992).","vendor":"Zbtlink","product":"multiple products","product_display":"Zbtlink (multiple products)","keys":["zbtlink","zbtlink:we1326","zbtlink:we2426-c","zbtlink:we357","zbtlink:we5926","zbtlink:we5926-ec-qp","zbtlink:we5926-wd","zbtlink:we826-q","zbtlink:we826-t2"],"cves":[{"id":"CVE-2026-74233","name":"MQWrt infosrvd Command Injection","description":"Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.0337,"epss_pct":0.88698,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":[]}],"severity":"critical","cvss":9.8,"epss":0.0337,"epss_pct":0.88698,"exploited":true,"sources":["ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-27","added":"2026-08-27","updated":"2026-08-27","due":null,"refs":[{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67000","label":"ENISA EUVD EUVD-2026-67000","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74233","label":"CVE record CVE-2026-74233","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-27","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67000"},{"d":"2026-08-27","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for the affected Zbtlink products: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":58},{"id":"2026-08-27-linux-kernel","kind":"exploited","title":"Linux Kernel: Unspecified","plain":"Attackers can gain higher privileges, once they have access to the device.","summary":"Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.","vendor":"Linux","product":"Kernel","product_display":"Linux Kernel","keys":["linux","linux:kernel"],"cves":[{"id":"CVE-2026-53362","name":"Unspecified","description":"Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.00709,"epss_pct":0.52994,"automatable":false,"impact":"total","fixed":["14200d435af9a9eeb444f529fc2f689a236b7962","65fb14cbebb0cd0eff903a22d33537ddc8b95769","46f201f8b4c39633a1fa3dc12459f506d470993d","6374fb9edf72c67a118a2c214a0dddd04c921e0a","e9eacf19281ea2498b36291b56c9606118c2d74e","736b380e28d0480c7bc3e022f1950f31fe53a7c5"],"patch":"fixed","cwes":[]}],"severity":"high","cvss":7.8,"epss":0.00709,"epss_pct":0.52994,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["14200d435af9a9eeb444f529fc2f689a236b7962","65fb14cbebb0cd0eff903a22d33537ddc8b95769","46f201f8b4c39633a1fa3dc12459f506d470993d","6374fb9edf72c67a118a2c214a0dddd04c921e0a","e9eacf19281ea2498b36291b56c9606118c2d74e","736b380e28d0480c7bc3e022f1950f31fe53a7c5"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-27","added":"2026-08-27","updated":"2026-10-15","due":"2026-08-30","refs":[{"url":"https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962","label":"Vendor advisory (git.kernel.org)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41669","label":"ENISA EUVD EUVD-2026-41669","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53362","label":"CVE record CVE-2026-53362","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-03","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-53362","url":null},{"d":"2026-07-04","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-27","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362"},{"d":"2026-08-27","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41669"}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Linux Kernel to the fixed version for your release line (for example 14200d435af9a9eeb444f529fc2f689a236b7962, 65fb14cbebb0cd0eff903a22d33537ddc8b95769 or 46f201f8b4c39633a1fa3dc12459f506d470993d).","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":58},{"id":"2026-08-27-jfrog-artifactory","kind":"exploited","title":"JFrog Artifactory: Improper Limitation of a Pathname to a Restricted Directory","plain":null,"summary":"JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.","vendor":"JFrog","product":"Artifactory","product_display":"JFrog Artifactory","keys":["jfrog","jfrog:artifactory"],"cves":[{"id":"CVE-2026-66384","name":"Improper Limitation of a Pathname to a Restricted Directory","description":"JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","severity":"medium","epss":0.00665,"epss_pct":0.5121,"automatable":false,"impact":"partial","fixed":["7.146.35","7.161.16"],"patch":"fixed","cwes":["CWE-22"]}],"severity":"medium","cvss":5.3,"epss":0.00665,"epss_pct":0.5121,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["7.146.35","7.161.16"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-27","added":"2026-08-27","updated":"2026-08-28","due":"2026-09-10","refs":[{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","label":"Vendor advisory (docs.jfrog.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57256","label":"ENISA EUVD EUVD-2026-57256","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66384","label":"CVE record CVE-2026-66384","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-12","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-27","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384"},{"d":"2026-08-27","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57256"},{"d":"2026-08-28","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-66384","url":null}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update JFrog Artifactory to 7.146.35 or 7.161.16 or later.","also":[],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":58},{"id":"2026-08-26-red-hat-libuser","kind":"exploited","title":"Red Hat Libuser: Race Condition","plain":"Attackers can gain higher privileges, once they have access to the device, without logging in.","summary":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.","vendor":"Red Hat","product":"Libuser","product_display":"Red Hat Libuser","keys":["red-hat","red-hat:libuser"],"cves":[{"id":"CVE-2015-3246","name":"Race Condition","description":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.","cvss":7.4,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.08503,"epss_pct":0.95035,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":[]}],"severity":"high","cvss":7.4,"epss":0.08503,"epss_pct":0.95035,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-26","added":"2026-08-26","updated":"2026-10-01","due":"2026-09-09","refs":[{"url":"https://access.redhat.com/articles/1537873","label":"Vendor advisory (access.redhat.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3246","label":"CVE record CVE-2015-3246","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/37706","label":"Exploit-DB 37706: Libuser Library - Multiple Vulnerabilities","kind":"exploit"},{"url":"https://www.exploit-db.com/exploits/44633","label":"Exploit-DB 44633: Libuser - 'roothelper' Local Privilege Escalation (Metasploit)","kind":"exploit"},{"url":"https://www.rapid7.com/db/modules/exploit/linux/local/libuser_roothelper_priv_esc/","label":"Metasploit exploit: Libuser roothelper Privilege Escalation","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2015-07-27","lane":"code","label":"Exploit-DB 37706: Libuser Library - Multiple Vulnerabilities","url":"https://www.exploit-db.com/exploits/37706"},{"d":"2015-08-11","lane":"disclosure","label":"CVE published","url":null},{"d":"2018-05-16","lane":"code","label":"Exploit-DB 44633: Libuser - 'roothelper' Local Privilege Escalation (Metasploit)","url":"https://www.exploit-db.com/exploits/44633"},{"d":"2026-04-22","lane":"code","label":"Metasploit exploit: Libuser roothelper Privilege Escalation","url":"https://www.rapid7.com/db/modules/exploit/linux/local/libuser_roothelper_priv_esc/"},{"d":"2026-08-26","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246"},{"d":"2026-08-27","lane":"code","label":"First public proof of concept on GitHub for CVE-2015-3246","url":null}],"signals":{"poc":1,"exploitdb":3,"metasploit":1,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Red Hat Libuser: install the update or apply the mitigation it lists.","also":[],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":59},{"id":"2026-08-26-linux-kernel","kind":"exploited","title":"Linux Kernel: Out-of-Bounds Write","plain":"Memory corruption that can let attackers run code, once they have access to the device.","summary":"Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.","vendor":"Linux","product":"Kernel","product_display":"Linux Kernel","keys":["linux","linux:kernel"],"cves":[{"id":"CVE-2022-0995","name":"Out-of-Bounds Write","description":"Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.08859,"epss_pct":0.95208,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-787"]}],"severity":"high","cvss":7.8,"epss":0.08859,"epss_pct":0.95208,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":false,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-26","added":"2026-08-26","updated":"2026-08-27","due":"2026-08-29","refs":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb","label":"Vendor advisory (git.kernel.org)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0995","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0995","label":"CVE record CVE-2022-0995","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/linux/local/cve_2022_0995_watch_queue/","label":"Metasploit exploit: Watch Queue Out of Bounds Write","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2022-03-25","lane":"disclosure","label":"CVE published","url":null},{"d":"2022-03-26","lane":"code","label":"First public proof of concept on GitHub for CVE-2022-0995 (now 4 repositories)","url":null},{"d":"2026-04-22","lane":"code","label":"Metasploit exploit: Watch Queue Out of Bounds Write","url":"https://www.rapid7.com/db/modules/exploit/linux/local/cve_2022_0995_watch_queue/"},{"d":"2026-08-26","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0995"}],"signals":{"poc":4,"exploitdb":0,"metasploit":1,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Linux Kernel: install the update or apply the mitigation it lists.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":59},{"id":"2026-08-26-citrix-netscaler-adc-and-netscaler-gateway","kind":"exploited","title":"Citrix NetScaler ADC and NetScaler Gateway: Improper Restriction of Operations within the Bounds of a Memory Buffer","plain":"Attackers can crash or block the service, over the internet, without logging in.","summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.","vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","product_display":"Citrix NetScaler ADC and NetScaler Gateway","keys":["citrix","citrix:netscaler-adc-and-netscaler-gateway"],"cves":[{"id":"CVE-2026-8452","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.","cvss":8.8,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L","severity":"high","epss":0.01011,"epss_pct":0.6287,"automatable":true,"impact":"partial","fixed":["72.61","63.18","37.272"],"patch":"fixed","cwes":["CWE-119"]}],"severity":"high","cvss":8.8,"epss":0.01011,"epss_pct":0.6287,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["72.61","63.18","37.272"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-26","added":"2026-08-26","updated":"2026-08-27","due":"2026-08-29","refs":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604","label":"Vendor advisory (support.citrix.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40307","label":"ENISA EUVD EUVD-2026-40307","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8452","label":"CVE record CVE-2026-8452","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2023-07-20","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-8452 (now 5 repositories)","url":null},{"d":"2026-06-30","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-26","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452"},{"d":"2026-08-26","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40307"}],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Citrix NetScaler ADC and NetScaler Gateway to the fixed version for your release line (for example 72.61, 63.18 or 37.272).","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":59},{"id":"2026-08-26-microsoft-sql-server","kind":"exploited","title":"Microsoft SQL Server: Remote Code Execution","plain":"Attackers can run their own code, over the internet.","summary":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.","vendor":"Microsoft","product":"SQL Server","product_display":"Microsoft SQL Server","keys":["microsoft","microsoft:sql-server"],"cves":[{"id":"CVE-2019-1068","name":"Remote Code Execution","description":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.57273,"epss_pct":0.99076,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":[]}],"severity":"high","cvss":8.8,"epss":0.57273,"epss_pct":0.99076,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-26","added":"2026-08-26","updated":"2026-08-27","due":"2026-08-29","refs":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068","label":"Vendor advisory (portal.msrc.microsoft.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1068","label":"CVE record CVE-2019-1068","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2019-07-15","lane":"disclosure","label":"CVE published","url":null},{"d":"2021-02-04","lane":"code","label":"First public proof of concept on GitHub for CVE-2019-1068","url":null},{"d":"2026-08-26","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068"}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Microsoft SQL Server: install the update or apply the mitigation it lists.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":59},{"id":"2026-08-25-gitea-gitea","kind":"exploited","title":"Gitea: Code Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.","vendor":"Gitea","product":"Gitea","product_display":"Gitea","keys":["gitea","gitea:gitea"],"cves":[{"id":"CVE-2026-60004","name":"Code Injection","description":"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.23988,"epss_pct":0.97841,"automatable":true,"impact":"total","fixed":["1.27.1"],"patch":"fixed","cwes":["CWE-94"]}],"severity":"critical","cvss":9.8,"epss":0.23988,"epss_pct":0.97841,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["1.27.1"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-25","added":"2026-08-25","updated":"2026-09-08","due":"2026-08-28","refs":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66708","label":"ENISA EUVD EUVD-2026-66708","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-60004","label":"CVE record CVE-2026-60004","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60004.yaml","label":"Nuclei template: Gitea <= 1.27.0 - Pre-Auth Remote Code Execution","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Gitea <= 1.27.0 - Pre-Auth Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60004.yaml"},{"d":"2026-07-29","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-60004 (now 11 repositories)","url":null},{"d":"2026-08-25","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004"},{"d":"2026-08-25","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66708"},{"d":"2026-08-26","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":11,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Gitea to 1.27.1 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":true,"age_days":60},{"id":"2026-08-24-oracle-http-server-and-oracle-weblogic-server-proxy-plug-in","kind":"exploited","title":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Improper Access Control","plain":"Attackers can reach functions they should not have access to, over the internet, without logging in.","summary":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.","vendor":"Oracle","product":"HTTP Server and Oracle Weblogic Server Proxy Plug-in","product_display":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in","keys":["oracle","oracle:http-server-and-oracle-weblogic-server-proxy-plug-in"],"cves":[{"id":"CVE-2026-21962","name":"Improper Access Control","description":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","severity":"critical","epss":0.73192,"epss_pct":0.9946,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-284"]}],"severity":"critical","cvss":10.0,"epss":0.73192,"epss_pct":0.9946,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-24","added":"2026-08-24","updated":"2026-08-25","due":"2026-08-27","refs":[{"url":"https://www.oracle.com/security-alerts/cpujan2026.html","label":"Vendor advisory (oracle.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21962","label":"CVE record CVE-2026-21962","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-01-20","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-01-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-21962 (now 10 repositories)","url":null},{"d":"2026-08-24","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962"}],"signals":{"poc":10,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":61},{"id":"2026-08-21-microsoft-cve-2026-69836","kind":"exploited","title":"Microsoft Entra: ID Remote Code Execution","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.","vendor":"Microsoft","product":"Microsoft Entra","product_display":"Microsoft Entra","keys":["microsoft","microsoft:microsoft-entra"],"cves":[{"id":"CVE-2026-69836","name":"ID Remote Code Execution","description":"Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C","severity":"critical","epss":0.01532,"epss_pct":0.74605,"automatable":true,"impact":"total","fixed":[],"patch":"fixed","cwes":[]}],"severity":"critical","cvss":10.0,"epss":0.01532,"epss_pct":0.74605,"exploited":true,"sources":["ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-21","added":"2026-08-21","updated":"2026-10-21","due":null,"refs":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63693","label":"ENISA EUVD EUVD-2026-63693","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69836","label":"CVE record CVE-2026-69836","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-20","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-21","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63693"},{"d":"2026-08-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-69836 (now 2 repositories)","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Microsoft Entra from the vendor advisory.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":64},{"id":"2026-08-20-trueconf-server","kind":"exploited","title":"TrueConf Server: 2 flaws exploited together","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script. CISA lists 1 more flaw in TrueConf Server as exploited on the same day (CVE-2026-72530).","vendor":"TrueConf","product":"Server","product_display":"TrueConf Server","keys":["trueconf","trueconf:server"],"cves":[{"id":"CVE-2026-72529","name":"Missing Authentication for Critical Function","description":"TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.01464,"epss_pct":0.73459,"automatable":true,"impact":"total","fixed":["5.3","5.3.9","5.4.9","5.5.5"],"patch":"fixed","cwes":["CWE-306"]},{"id":"CVE-2026-72530","name":"Code Injection","description":"TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.","cvss":9.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.01686,"epss_pct":0.76856,"automatable":false,"impact":"total","fixed":["5.3","5.3.9","5.4.9","5.5.5"],"patch":"fixed","cwes":["CWE-94"]}],"severity":"critical","cvss":9.8,"epss":0.01686,"epss_pct":0.76856,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["5.3","5.3.9","5.4.9","5.5.5"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-20","added":"2026-08-20","updated":"2026-08-21","due":"2026-08-23","refs":[{"url":"https://trueconf.com/blog/news/security-fixes-updates-and-advisories","label":"Vendor advisory (trueconf.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62587","label":"ENISA EUVD EUVD-2026-62587","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62588","label":"ENISA EUVD EUVD-2026-62588","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72529","label":"CVE record CVE-2026-72529","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-19","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-20","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529"},{"d":"2026-08-20","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62587"},{"d":"2026-08-25","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-72530","url":null}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update TrueConf Server to the fixed version for your release line (for example 5.3, 5.3.9 or 5.4.9).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":65},{"id":"2026-08-19-mlflow-mlflow","kind":"exploited","title":"MLflow: Server-Side Request Forgery","plain":"Attackers can make the server send requests on their behalf, over the internet, without logging in.","summary":"MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.","vendor":"MLflow","product":"MLflow","product_display":"MLflow","keys":["mlflow","mlflow:mlflow"],"cves":[{"id":"CVE-2026-64849","name":"Server-Side Request Forgery","description":"MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.","cvss":9.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","severity":"critical","epss":0.10017,"epss_pct":0.95614,"automatable":true,"impact":"partial","fixed":["3.15.0"],"patch":"fixed","cwes":["CWE-918"]}],"severity":"critical","cvss":9.3,"epss":0.10017,"epss_pct":0.95614,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["3.15.0"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-19","added":"2026-08-19","updated":"2026-10-02","due":"2026-09-02","refs":[{"url":"https://github.com/mlflow/mlflow/pull/24258","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60473","label":"ENISA EUVD EUVD-2026-60473","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64849","label":"CVE record CVE-2026-64849","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64849.yaml","label":"Nuclei template: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64849.yaml"},{"d":"2026-08-17","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-18","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-64849 (now 4 repositories)","url":null},{"d":"2026-08-19","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849"},{"d":"2026-08-19","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60473"}],"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update MLflow to 3.15.0 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":66},{"id":"2026-08-18-microsoft-internet-key-exchange-ike-service-extensions","kind":"exploited","title":"Microsoft Internet Key Exchange (IKE) Service Extensions: Double Free","plain":"Memory corruption that can let attackers run code, over the internet, without logging in.","summary":"Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.","vendor":"Microsoft","product":"Internet Key Exchange (IKE) Service Extensions","product_display":"Microsoft Internet Key Exchange (IKE) Service Extensions","keys":["microsoft","microsoft:internet-key-exchange-ike-service-extensions"],"cves":[{"id":"CVE-2026-33824","name":"Double Free","description":"Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","severity":"critical","epss":0.01619,"epss_pct":0.75891,"automatable":true,"impact":"total","fixed":["10.0.14393.9060","10.0.17763.8644","10.0.19044.7184","10.0.19045.7184","10.0.22631.6936","10.0.26100.8246"],"patch":"fixed","cwes":["CWE-415"]}],"severity":"critical","cvss":9.8,"epss":0.01619,"epss_pct":0.75891,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["10.0.14393.9060","10.0.17763.8644","10.0.19044.7184","10.0.19045.7184","10.0.22631.6936","10.0.26100.8246"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-18","added":"2026-08-18","updated":"2026-10-15","due":"2026-08-21","refs":[{"url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33824","label":"CVE record CVE-2026-33824","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-04-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-04-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-33824 (now 2 repositories)","url":null},{"d":"2026-08-18","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824"}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft Internet Key Exchange (IKE) Service Extensions to the fixed version for your release line (for example 10.0.14393.9060, 10.0.17763.8644 or 10.0.19044.7184).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":67},{"id":"2026-08-18-microsoft-sharepoint","kind":"exploited","title":"Microsoft SharePoint: Weak Authentication","plain":null,"summary":"Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.","vendor":"Microsoft","product":"SharePoint","product_display":"Microsoft SharePoint","keys":["microsoft","microsoft:sharepoint"],"cves":[{"id":"CVE-2026-55040","name":"Weak Authentication","description":"Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.","cvss":9.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C","severity":"critical","epss":0.69536,"epss_pct":0.99366,"automatable":true,"impact":"total","fixed":["16.0.5561.1001","16.0.10417.20175","16.0.19725.20434"],"patch":"fixed","cwes":["CWE-1390"]}],"severity":"critical","cvss":9.1,"epss":0.69536,"epss_pct":0.99366,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["16.0.5561.1001","16.0.10417.20175","16.0.19725.20434"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-18","added":"2026-08-18","updated":"2026-10-08","due":"2026-08-21","refs":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44211","label":"ENISA EUVD EUVD-2026-44211","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55040","label":"CVE record CVE-2026-55040","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-55040.yaml","label":"Nuclei template: Microsoft SharePoint Server - JWT Authentication Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Microsoft SharePoint Server - JWT Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-55040.yaml"},{"d":"2026-07-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-28","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-55040 (now 5 repositories)","url":null},{"d":"2026-08-18","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040"},{"d":"2026-08-18","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44211"}],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft SharePoint to the fixed version for your release line (for example 16.0.5561.1001, 16.0.10417.20175 or 16.0.19725.20434).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":67},{"id":"2026-08-18-apple-macos","kind":"exploited","title":"Apple macOS: Improper Authentication","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.","vendor":"Apple","product":"macOS","product_display":"Apple macOS","keys":["apple","apple:macos"],"cves":[{"id":"CVE-2026-65400","name":"Improper Authentication","description":"Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.01723,"epss_pct":0.77346,"automatable":true,"impact":"total","fixed":["14.8.9","15.7.9","26.6.1","26.7","27"],"patch":"fixed","cwes":["CWE-287"]}],"severity":"critical","cvss":9.8,"epss":0.01723,"epss_pct":0.77346,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["14.8.9","15.7.9","26.6.1","26.7","27"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-18","added":"2026-08-18","updated":"2026-09-14","due":"2026-08-21","refs":[{"url":"https://support.apple.com/en-us/148170","label":"Vendor advisory (support.apple.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54216","label":"ENISA EUVD EUVD-2026-54216","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65400","label":"CVE record CVE-2026-65400","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-06","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-18","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400"},{"d":"2026-08-18","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54216"},{"d":"2026-08-18","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-65400 (now 3 repositories)","url":null}],"signals":{"poc":3,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Apple macOS to the fixed version for your release line (for example 14.8.9, 15.7.9 or 26.6.1).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":67},{"id":"2026-08-21-synacor-zimbra-collaboration-suite-zcs","kind":"exploited","title":"Synacor Zimbra Collaboration Suite (ZCS): OS Command Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","product_display":"Synacor Zimbra Collaboration Suite (ZCS)","keys":["synacor","synacor:zimbra-collaboration-suite-zcs"],"cves":[{"id":"CVE-2026-73570","name":"OS Command Injection","description":"Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.","cvss":8.9,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","severity":"high","epss":0.71663,"epss_pct":0.99422,"automatable":false,"impact":"total","fixed":["10.1.20"],"patch":"fixed","cwes":["CWE-78"]}],"severity":"high","cvss":8.9,"epss":0.71663,"epss_pct":0.99422,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["10.1.20"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-18","added":"2026-08-21","updated":"2026-08-24","due":"2026-08-24","refs":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","label":"Vendor advisory (wiki.zimbra.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58069","label":"ENISA EUVD EUVD-2026-58069","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73570","label":"CVE record CVE-2026-73570","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-73570.yaml","label":"Nuclei template: Zimbra Collaboration Suite < 10.1.20 - OS Command Injection","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Zimbra Collaboration Suite < 10.1.20 - OS Command Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2026/CVE-2026-73570.yaml"},{"d":"2026-08-13","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-18","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58069"},{"d":"2026-08-21","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570"},{"d":"2026-08-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-73570 (now 9 repositories)","url":null}],"signals":{"poc":9,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Synacor Zimbra Collaboration Suite (ZCS) to 10.1.20 or later.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":67},{"id":"2026-08-17-ray-project-ray","kind":"exploited","title":"Ray-Project Ray: Code Injection","plain":"Attackers can run their own code, over the internet, without logging in, once a user opens a file or link.","summary":"Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.","vendor":"Ray-Project","product":"Ray","product_display":"Ray-Project Ray","keys":["ray-project","ray-project:ray"],"cves":[{"id":"CVE-2025-62593","name":"Code Injection","description":"Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.","cvss":9.4,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","severity":"critical","epss":0.62459,"epss_pct":0.99189,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-94","CWE-352"]}],"severity":"critical","cvss":9.4,"epss":0.62459,"epss_pct":0.99189,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-17","added":"2026-08-17","updated":"2026-10-01","due":"2026-08-20","refs":[{"url":"https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-62593","label":"CVE record CVE-2025-62593","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62593.yaml","label":"Nuclei template: Ray < 2.52.0 - Remote Code Execution","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Ray < 2.52.0 - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62593.yaml"},{"d":"2025-11-26","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-17","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593"},{"d":"2026-08-18","lane":"code","label":"First public proof of concept on GitHub for CVE-2025-62593 (now 2 repositories)","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Ray-Project Ray: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":68},{"id":"2026-08-11-metabase-metabase","kind":"exploited","title":"Metabase: SQL Injection","plain":"Attackers can read or change the database, over the internet, without logging in.","summary":"Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.","vendor":"Metabase","product":"Metabase","product_display":"Metabase","keys":["metabase","metabase:metabase"],"cves":[{"id":"CVE-2026-72898","name":"SQL Injection","description":"Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.9744,"epss_pct":0.99902,"automatable":true,"impact":"total","fixed":["x.58.24","x.59.21","x.60.17","x.61.11","x.62.9","x.63.5"],"patch":"fixed","cwes":["CWE-89"]}],"severity":"critical","cvss":10.0,"epss":0.9744,"epss_pct":0.99902,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["x.58.24","x.59.21","x.60.17","x.61.11","x.62.9","x.63.5"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-11","added":"2026-08-11","updated":"2026-08-12","due":"2026-08-14","refs":[{"url":"https://www.metabase.com/blog/security-update","label":"Vendor advisory (metabase.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55690","label":"ENISA EUVD EUVD-2026-55690","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72898","label":"CVE record CVE-2026-72898","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-72898.yaml","label":"Nuclei template: Metabase - Unauthenticated SQL Injection","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Metabase - Unauthenticated SQL Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-72898.yaml"},{"d":"2026-08-10","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-11","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898"},{"d":"2026-08-11","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55690"},{"d":"2026-08-12","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-72898 (now 12 repositories)","url":null}],"signals":{"poc":12,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Metabase to the fixed version for your release line (for example x.58.24, x.59.21 or x.60.17).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":74},{"id":"2026-08-11-cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threa","kind":"exploited","title":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD): Heap Inspection","plain":"Attackers can crash or block the service, over the internet, without logging in.","summary":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.","vendor":"Cisco","product":"Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ","product_display":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)","keys":["cisco","cisco:secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat-defense-ftd"],"cves":[{"id":"CVE-2026-20349","name":"Heap Inspection","description":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.","cvss":8.6,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","severity":"high","epss":0.0101,"epss_pct":0.62836,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":["CWE-244"]}],"severity":"high","cvss":8.6,"epss":0.0101,"epss_pct":0.62836,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-11","added":"2026-08-11","updated":"2026-09-16","due":"2026-08-14","refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF","label":"Vendor advisory (sec.cloudapps.cisco.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56643","label":"ENISA EUVD EUVD-2026-56643","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20349","label":"CVE record CVE-2026-20349","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-11","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349"},{"d":"2026-08-11","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56643"},{"d":"2026-08-11","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-10-18","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-20349","url":null}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD): install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":74},{"id":"2026-08-11-microsoft-windows-ancillary-function-driver-for-winsock","kind":"exploited","title":"Microsoft Windows Ancillary Function Driver for WinSock: Use-After-Free","plain":"Memory corruption that can let attackers run code, once they have access to the device.","summary":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","vendor":"Microsoft","product":"Windows Ancillary Function Driver for WinSock ","product_display":"Microsoft Windows Ancillary Function Driver for WinSock","keys":["microsoft","microsoft:windows-ancillary-function-driver-for-winsock"],"cves":[{"id":"CVE-2026-68820","name":"Use-After-Free","description":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","cvss":7.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","severity":"high","epss":0.00332,"epss_pct":0.25183,"automatable":false,"impact":"total","fixed":["10.0.14393.9418","10.0.17763.9121","10.0.19044.7663","10.0.19045.7663","10.0.22631.7517","10.0.26100.9168"],"patch":"fixed","cwes":["CWE-416"]}],"severity":"high","cvss":7.0,"epss":0.00332,"epss_pct":0.25183,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["10.0.14393.9418","10.0.17763.9121","10.0.19044.7663","10.0.19045.7663","10.0.22631.7517","10.0.26100.9168"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-11","added":"2026-08-11","updated":"2026-10-21","due":"2026-08-25","refs":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68820","label":"Vendor advisory (portal.msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56468","label":"ENISA EUVD EUVD-2026-56468","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68820","label":"CVE record CVE-2026-68820","kind":"registry"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820","label":"Microsoft advisory: CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulner","kind":"advisory"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-11","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820"},{"d":"2026-08-11","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56468"},{"d":"2026-08-11","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-13","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-68820 (now 4 repositories)","url":null}],"signals":{"poc":4,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft Windows Ancillary Function Driver for WinSock to the fixed version for your release line (for example 10.0.14393.9418, 10.0.17763.9121 or 10.0.19044.7663).","also":[],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":74},{"id":"2026-08-18-broadcom-vmware-vcenter","kind":"exploited","title":"Broadcom VMware vCenter: Path Traversal","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.","vendor":"Broadcom","product":"VMware vCenter","product_display":"Broadcom VMware vCenter","keys":["broadcom","broadcom:vmware-vcenter"],"cves":[{"id":"CVE-2026-59310","name":"Path Traversal","description":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.02565,"epss_pct":0.85015,"automatable":true,"impact":"total","fixed":["9.1.0.0300","9.0.2.0100","8.0 U3k"],"patch":"fixed","cwes":["CWE-22"]}],"severity":"critical","cvss":9.8,"epss":0.02565,"epss_pct":0.85015,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":true,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["9.1.0.0300","9.0.2.0100","8.0 U3k"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-10","added":"2026-08-18","updated":"2026-09-12","due":"2026-08-21","refs":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","label":"Vendor advisory (support.broadcom.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51097","label":"ENISA EUVD EUVD-2026-51097","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59310","label":"CVE record CVE-2026-59310","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-30","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-10","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51097"},{"d":"2026-08-17","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-59310 (now 5 repositories)","url":null},{"d":"2026-08-18","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310"}],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Broadcom VMware vCenter to the fixed version for your release line (for example 9.1.0.0300, 9.0.2.0100 or 8.0 U3k).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Ransomware groups are known to use this.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":75},{"id":"2026-08-07-progress-loadmaster","kind":"exploited","title":"Progress LoadMaster: Command Injection","plain":"Attackers can run their own code, from the same network, without logging in.","summary":"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.","vendor":"Progress","product":"LoadMaster","product_display":"Progress LoadMaster","keys":["progress","progress:loadmaster"],"cves":[{"id":"CVE-2026-8037","name":"Command Injection","description":"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.","cvss":9.6,"cvss_version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.77362,"epss_pct":0.99559,"automatable":false,"impact":"total","fixed":["V7.2.63.2","V7.2.54.18"],"patch":"fixed","cwes":["CWE-77"]}],"severity":"critical","cvss":9.6,"epss":0.77362,"epss_pct":0.99559,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["V7.2.63.2","V7.2.54.18"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-07","added":"2026-08-07","updated":"2026-10-15","due":"2026-08-10","refs":[{"url":"https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691","label":"Vendor advisory (community.progress.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8037","label":"CVE record CVE-2026-8037","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8037.yaml","label":"Nuclei template: Progress ADC LoadMaster - Command Injection","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Progress ADC LoadMaster - Command Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8037.yaml"},{"d":"2026-06-04","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-06-30","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-8037 (now 2 repositories)","url":null},{"d":"2026-08-07","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037"}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Progress LoadMaster to V7.2.63.2 or V7.2.54.18 or later.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":78},{"id":"2026-08-05-jetbrains-teamcity","kind":"exploited","title":"JetBrains TeamCity: Deserialization of Untrusted Data","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.","vendor":"JetBrains","product":"TeamCity","product_display":"JetBrains TeamCity","keys":["jetbrains","jetbrains:teamcity"],"cves":[{"id":"CVE-2026-63077","name":"Deserialization of Untrusted Data","description":"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.8957,"epss_pct":0.9979,"automatable":true,"impact":"total","fixed":["2026.1.3, 2025.11.7"],"patch":"fixed","cwes":["CWE-502"]}],"severity":"critical","cvss":9.8,"epss":0.8957,"epss_pct":0.9979,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":true,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["2026.1.3, 2025.11.7"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-05","added":"2026-08-05","updated":"2026-09-23","due":"2026-08-08","refs":[{"url":"https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/","label":"Vendor advisory (blog.jetbrains.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49369","label":"ENISA EUVD EUVD-2026-49369","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63077","label":"CVE record CVE-2026-63077","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077/","label":"Metasploit exploit: JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63077.yaml","label":"Nuclei template: JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63077.yaml"},{"d":"2026-07-27","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-30","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-63077 (now 7 repositories)","url":null},{"d":"2026-08-05","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077"},{"d":"2026-08-05","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49369"},{"d":"2026-08-27","lane":"code","label":"Metasploit exploit: JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution","url":"https://www.rapid7.com/db/modules/exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077/"}],"signals":{"poc":7,"exploitdb":0,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update JetBrains TeamCity to 2026.1.3, 2025.11.7 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Ransomware groups are known to use this.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":80},{"id":"2026-08-04-ibm-langflow","kind":"exploited","title":"IBM Langflow: Code Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.","vendor":"IBM","product":"Langflow","product_display":"IBM Langflow","keys":["ibm","ibm:langflow"],"cves":[{"id":"CVE-2026-9198","name":"Code Injection","description":"Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.28658,"epss_pct":0.98141,"automatable":true,"impact":"total","fixed":[],"patch":"fixed","cwes":["CWE-94"]}],"severity":"critical","cvss":9.8,"epss":0.28658,"epss_pct":0.98141,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-04","added":"2026-08-04","updated":"2026-08-17","due":"2026-08-07","refs":[{"url":"https://www.ibm.com/support/pages/node/7278927","label":"Vendor advisory (ibm.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45236","label":"ENISA EUVD EUVD-2026-45236","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9198","label":"CVE record CVE-2026-9198","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/52675","label":"Exploit-DB 52675: Langflow 1.10.0 - RCE","kind":"exploit"},{"url":"https://www.rapid7.com/db/modules/exploit/multi/http/langflow_unauth_rce_cve_2026_9198/","label":"Metasploit exploit: Langflow AI auto_login RCE","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9198.yaml","label":"Nuclei template: IBM Langflow - Remote Code Execution","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: IBM Langflow - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9198.yaml"},{"d":"2026-07-17","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-21","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-9198 (now 9 repositories)","url":null},{"d":"2026-08-04","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198"},{"d":"2026-08-04","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45236"},{"d":"2026-08-21","lane":"code","label":"Metasploit exploit: Langflow AI auto_login RCE","url":"https://www.rapid7.com/db/modules/exploit/multi/http/langflow_unauth_rce_cve_2026_9198/"},{"d":"2026-09-02","lane":"code","label":"Exploit-DB 52675: Langflow 1.10.0 - RCE","url":"https://www.exploit-db.com/exploits/52675"}],"signals":{"poc":9,"exploitdb":1,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for IBM Langflow from the vendor advisory.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":81},{"id":"2026-08-04-n-able-n-central","kind":"exploited","title":"N-able N-central: Authentication Bypass Using an Alternate Path or Channel","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.","vendor":"N-able","product":"N-central","product_display":"N-able N-central","keys":["n-able","n-able:n-central"],"cves":[{"id":"CVE-2026-18556","name":"Authentication Bypass Using an Alternate Path or Channel","description":"N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.","cvss":8.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","severity":"high","epss":0.07882,"epss_pct":0.94705,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-288"]}],"severity":"high","cvss":8.2,"epss":0.07882,"epss_pct":0.94705,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-04","added":"2026-08-04","updated":"2026-08-05","due":"2026-08-07","refs":[{"url":"https://uptime.n-able.com/","label":"Vendor advisory (uptime.n-able.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51918","label":"ENISA EUVD EUVD-2026-51918","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18556","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18556","label":"CVE record CVE-2026-18556","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-08-01","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-04","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18556"},{"d":"2026-08-04","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51918"},{"d":"2026-08-06","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-18556","url":null}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for N-able N-central: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":81},{"id":"2026-08-04-apache-tomcat","kind":"exploited","title":"Apache Tomcat: Missing Encryption of Sensitive Data","plain":null,"summary":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.","vendor":"Apache","product":"Tomcat","product_display":"Apache Tomcat","keys":["apache","apache:tomcat"],"cves":[{"id":"CVE-2026-34486","name":"Missing Encryption of Sensitive Data","description":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.","cvss":7.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","severity":"high","epss":0.06561,"epss_pct":0.93804,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":["CWE-311"]}],"severity":"high","cvss":7.5,"epss":0.06561,"epss_pct":0.93804,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-08-04","added":"2026-08-04","updated":"2026-09-21","due":"2026-08-07","refs":[{"url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","label":"Vendor advisory (lists.apache.org)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34486","label":"CVE record CVE-2026-34486","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34486.yaml","label":"Nuclei template: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34486.yaml"},{"d":"2026-04-09","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-04-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-34486 (now 5 repositories)","url":null},{"d":"2026-08-04","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486"}],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Apache Tomcat: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":81},{"id":"2026-08-03-n-able-n-central","kind":"exploited","title":"N-able N-central: Authentication Bypass Using an Alternate Path or Channel","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.","vendor":"N-able","product":"N-central","product_display":"N-able N-central","keys":["n-able","n-able:n-central"],"cves":[{"id":"CVE-2026-18577","name":"Authentication Bypass Using an Alternate Path or Channel","description":"N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.","cvss":8.2,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A","severity":"high","epss":0.14622,"epss_pct":0.96656,"automatable":true,"impact":"total","fixed":["2026.3.1.7"],"patch":"fixed","cwes":["CWE-288"]}],"severity":"high","cvss":8.2,"epss":0.14622,"epss_pct":0.96656,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["2026.3.1.7"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-08-03","added":"2026-08-03","updated":"2026-08-04","due":"2026-08-06","refs":[{"url":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm","label":"Vendor advisory (documentation.n-able.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52010","label":"ENISA EUVD EUVD-2026-52010","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18577","label":"CVE record CVE-2026-18577","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18577.yaml","label":"Nuclei template: N-able N-central < 2026.3.1.10 - Authentication Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: N-able N-central < 2026.3.1.10 - Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18577.yaml"},{"d":"2026-08-02","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-08-03","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577"},{"d":"2026-08-03","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52010"},{"d":"2026-08-04","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-18577","url":null}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update N-able N-central to 2026.3.1.7 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":82},{"id":"2026-07-29-cisco-secure-firewall-management-center-fmc","kind":"exploited","title":"Cisco Secure Firewall Management Center (FMC): Secure Firewall Management Center Use of Hard-coded Password","plain":"Built-in credentials let attackers log in, over the internet, without logging in.","summary":"Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.","vendor":"Cisco","product":"Secure Firewall Management Center (FMC)","product_display":"Cisco Secure Firewall Management Center (FMC)","keys":["cisco","cisco:secure-firewall-management-center-fmc"],"cves":[{"id":"CVE-2026-20316","name":"Secure Firewall Management Center Use of Hard-coded Password","description":"Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","severity":"medium","epss":0.35096,"epss_pct":0.9844,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":["CWE-259"]}],"severity":"medium","cvss":5.3,"epss":0.35096,"epss_pct":0.9844,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":true,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-29","added":"2026-07-29","updated":"2026-09-16","due":"2026-08-01","refs":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh","label":"Vendor advisory (sec.cloudapps.cisco.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50404","label":"ENISA EUVD EUVD-2026-50404","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20316","label":"CVE record CVE-2026-20316","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-29","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316"},{"d":"2026-07-29","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50404"},{"d":"2026-07-29","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Cisco Secure Firewall Management Center (FMC): install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Ransomware groups are known to use this."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":87},{"id":"2026-07-27-arista-velocloud-orchestrator","kind":"exploited","title":"Arista VeloCloud Orchestrator: On-Prem OS Command Injection","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","vendor":"Arista","product":"VeloCloud Orchestrator","product_display":"Arista VeloCloud Orchestrator","keys":["arista","arista:velocloud-orchestrator"],"cves":[{"id":"CVE-2026-16812","name":"On-Prem OS Command Injection","description":"Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.01001,"epss_pct":0.62514,"automatable":true,"impact":"total","fixed":["5.2.3.14","6.1.3.4","6.4.2.4","7.0.0.1"],"patch":"fixed","cwes":["CWE-78"]}],"severity":"critical","cvss":10.0,"epss":0.01001,"epss_pct":0.62514,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["5.2.3.14","6.1.3.4","6.4.2.4","7.0.0.1"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-27","added":"2026-07-27","updated":"2026-07-28","due":"2026-07-30","refs":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144","label":"Vendor advisory (arista.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49334","label":"ENISA EUVD EUVD-2026-49334","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16812","label":"CVE record CVE-2026-16812","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-27","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812"},{"d":"2026-07-27","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49334"},{"d":"2026-07-27","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Arista VeloCloud Orchestrator to the fixed version for your release line (for example 5.2.3.14, 6.1.3.4 or 6.4.2.4).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":89},{"id":"2026-07-27-fortinet-fortios","kind":"exploited","title":"Fortinet FortiOS: Exposure of Sensitive Information to an Unauthorized Actor","plain":"Attackers can read sensitive data, over the internet, without logging in.","summary":"Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.","vendor":"Fortinet","product":"FortiOS","product_display":"Fortinet FortiOS","keys":["fortinet","fortinet:fortios"],"cves":[{"id":"CVE-2025-68686","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C","severity":"medium","epss":0.29499,"epss_pct":0.98188,"automatable":false,"impact":"partial","fixed":[],"patch":"fixed","cwes":["CWE-200"]}],"severity":"medium","cvss":5.3,"epss":0.29499,"epss_pct":0.98188,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-27","added":"2026-07-27","updated":"2026-07-28","due":"2026-08-10","refs":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-934","label":"Vendor advisory (fortiguard.fortinet.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68686","label":"CVE record CVE-2025-68686","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-02-10","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-27","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Fortinet FortiOS from the vendor advisory.","also":[],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":89},{"id":"2026-07-22-check-point-smartconsole","kind":"exploited","title":"Check Point SmartConsole: Improper Authentication","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.","vendor":"Check Point","product":"SmartConsole","product_display":"Check Point SmartConsole","keys":["check-point","check-point:smartconsole"],"cves":[{"id":"CVE-2026-16232","name":"Improper Authentication","description":"Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.","cvss":9.3,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","severity":"critical","epss":0.77972,"epss_pct":0.99575,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-287"]}],"severity":"critical","cvss":9.3,"epss":0.77972,"epss_pct":0.99575,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-22","added":"2026-07-22","updated":"2026-08-10","due":"2026-07-25","refs":[{"url":"https://support.checkpoint.com/results/sk/sk185169/","label":"Vendor advisory (support.checkpoint.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47700","label":"ENISA EUVD EUVD-2026-47700","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16232","label":"CVE record CVE-2026-16232","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce/","label":"Metasploit exploit: Check Point SmartConsole Authentication Bypass Run Script RCE","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-16232.yaml","label":"Nuclei template: Check Point Security Management Server - SmartConsole Authentication Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Check Point Security Management Server - SmartConsole Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-16232.yaml"},{"d":"2026-07-22","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232"},{"d":"2026-07-22","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47700"},{"d":"2026-07-22","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-16232 (now 3 repositories)","url":null},{"d":"2026-08-25","lane":"code","label":"Metasploit exploit: Check Point SmartConsole Authentication Bypass Run Script RCE","url":"https://www.rapid7.com/db/modules/exploit/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce/"}],"signals":{"poc":3,"exploitdb":0,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Check Point SmartConsole: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":94},{"id":"2026-07-22-microsoft-sharepoint","kind":"exploited","title":"Microsoft SharePoint: Deserialization of Untrusted Data","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.","vendor":"Microsoft","product":"SharePoint","product_display":"Microsoft SharePoint","keys":["microsoft","microsoft:sharepoint"],"cves":[{"id":"CVE-2026-50522","name":"Deserialization of Untrusted Data","description":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","severity":"critical","epss":0.03042,"epss_pct":0.8744,"automatable":true,"impact":"total","fixed":["16.0.5561.1001","16.0.10417.20175","16.0.19725.20434"],"patch":"fixed","cwes":["CWE-502"]}],"severity":"critical","cvss":9.8,"epss":0.03042,"epss_pct":0.8744,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["16.0.5561.1001","16.0.10417.20175","16.0.19725.20434"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-22","added":"2026-07-22","updated":"2026-10-08","due":"2026-07-25","refs":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43767","label":"ENISA EUVD EUVD-2026-43767","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50522","label":"CVE record CVE-2026-50522","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-22","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522"},{"d":"2026-07-22","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43767"},{"d":"2026-07-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-50522 (now 5 repositories)","url":null}],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft SharePoint to the fixed version for your release line (for example 16.0.5561.1001, 16.0.10417.20175 or 16.0.19725.20434).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":94},{"id":"2026-07-21-wordpress-core","kind":"exploited","title":"WordPress Core: 2 flaws exploited together","plain":"Attackers can read or change the database, over the internet, without logging in.","summary":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","vendor":"WordPress","product":"Core","product_display":"WordPress Core","keys":["wordpress","wordpress:core"],"cves":[{"id":"CVE-2026-60137","name":"SQL Injection","description":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","cvss":5.9,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","severity":"medium","epss":0.05323,"epss_pct":0.92587,"automatable":false,"impact":"total","fixed":["6.8.6","6.9.5","7.0.2"],"patch":"fixed","cwes":["CWE-89"]},{"id":"CVE-2026-63030","name":"Interpretation Conflict","description":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.10649,"epss_pct":0.95798,"automatable":true,"impact":"total","fixed":["6.9.5","7.0.2"],"patch":"fixed","cwes":["CWE-436"]}],"severity":"critical","cvss":9.8,"epss":0.10649,"epss_pct":0.95798,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["6.8.6","6.9.5","7.0.2"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-21","added":"2026-07-21","updated":"2026-10-07","due":"2026-07-24","refs":[{"url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","label":"Vendor advisory (wordpress.org)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45279","label":"ENISA EUVD EUVD-2026-45279","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45280","label":"ENISA EUVD EUVD-2026-45280","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63030","label":"CVE record CVE-2026-63030","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli/","label":"Metasploit auxiliary: WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion","kind":"exploit"},{"url":"https://www.rapid7.com/db/modules/exploit/multi/http/wp_batch_desync_rce/","label":"Metasploit exploit: WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml","label":"Nuclei template: WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml"},{"d":"2026-07-17","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-17","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-63030 (now 81 repositories)","url":null},{"d":"2026-07-18","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-60137 (now 11 repositories)","url":null},{"d":"2026-07-21","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030"},{"d":"2026-07-21","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45279"},{"d":"2026-08-06","lane":"code","label":"Metasploit exploit: WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE","url":"https://www.rapid7.com/db/modules/exploit/multi/http/wp_batch_desync_rce/"},{"d":"2026-08-16","lane":"code","label":"Metasploit auxiliary: WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion","url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli/"}],"signals":{"poc":81,"exploitdb":0,"metasploit":4,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update WordPress Core to the fixed version for your release line (for example 6.8.6, 6.9.5 or 7.0.2).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":95},{"id":"2026-07-21-langflow-langflow","kind":"exploited","title":"Langflow: Inclusion of Functionality from Untrusted Control Sphere","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.","vendor":"Langflow","product":"Langflow","product_display":"Langflow","keys":["langflow","langflow:langflow"],"cves":[{"id":"CVE-2026-0770","name":"Inclusion of Functionality from Untrusted Control Sphere","description":"Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.","cvss":9.8,"cvss_version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.62562,"epss_pct":0.99191,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-829"]}],"severity":"critical","cvss":9.8,"epss":0.62562,"epss_pct":0.99191,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-21","added":"2026-07-21","updated":"2026-07-22","due":"2026-07-24","refs":[{"url":"https://github.com/langflow-ai/langflow/releases/tag/v1.9.0","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0770","label":"CVE record CVE-2026-0770","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/52597","label":"Exploit-DB 52597: Langflow 1.3.0 - Remote Code Execution","kind":"exploit"},{"url":"https://www.rapid7.com/db/modules/exploit/multi/http/langflow_rce_cve_2026_0770/","label":"Metasploit exploit: Langflow Unauthenticated RCE (validate endpoint)","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0770.yaml","label":"Nuclei template: Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0770.yaml"},{"d":"2026-01-23","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-02-07","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-0770 (now 7 repositories)","url":null},{"d":"2026-05-29","lane":"code","label":"Exploit-DB 52597: Langflow 1.3.0 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/52597"},{"d":"2026-07-21","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770"},{"d":"2026-09-07","lane":"code","label":"Metasploit exploit: Langflow Unauthenticated RCE (validate endpoint)","url":"https://www.rapid7.com/db/modules/exploit/multi/http/langflow_rce_cve_2026_0770/"}],"signals":{"poc":7,"exploitdb":1,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Langflow: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":95},{"id":"2026-07-21-dd-wrt-dd-wrt","kind":"exploited","title":"DD-WRT: Stack-Based Buffer Overflow","plain":"Memory corruption that can let attackers run code, over the internet, without logging in.","summary":"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.","vendor":"DD-WRT","product":"DD-WRT","product_display":"DD-WRT","keys":["dd-wrt","dd-wrt:dd-wrt"],"cves":[{"id":"CVE-2021-27137","name":"Stack-Based Buffer Overflow","description":"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.","cvss":8.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.03995,"epss_pct":0.90481,"automatable":false,"impact":"total","fixed":["45724"],"patch":"fixed","cwes":["CWE-121"]}],"severity":"high","cvss":8.1,"epss":0.03995,"epss_pct":0.90481,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["45724"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-21","added":"2026-07-21","updated":"2026-07-22","due":"2026-07-24","refs":[{"url":"https://svn.dd-wrt.com/changeset/45724","label":"Vendor advisory (svn.dd-wrt.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34854","label":"ENISA EUVD EUVD-2021-34854","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27137","label":"CVE record CVE-2021-27137","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-16","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-21","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137"},{"d":"2026-07-21","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34854"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update DD-WRT to 45724 or later.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":95},{"id":"2026-07-16-microsoft-sharepoint","kind":"exploited","title":"Microsoft SharePoint: Deserialization of Untrusted Data","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","vendor":"Microsoft","product":"SharePoint","product_display":"Microsoft SharePoint","keys":["microsoft","microsoft:sharepoint"],"cves":[{"id":"CVE-2026-58644","name":"Deserialization of Untrusted Data","description":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","severity":"critical","epss":0.15873,"epss_pct":0.96884,"automatable":true,"impact":"total","fixed":["16.0.5556.1005","16.0.10417.20153","16.0.19725.20384"],"patch":"fixed","cwes":["CWE-502"]}],"severity":"critical","cvss":9.8,"epss":0.15873,"epss_pct":0.96884,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["16.0.5556.1005","16.0.10417.20153","16.0.19725.20384"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-16","added":"2026-07-16","updated":"2026-10-08","due":"2026-07-19","refs":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43779","label":"ENISA EUVD EUVD-2026-43779","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58644","label":"CVE record CVE-2026-58644","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58644.yaml","label":"Nuclei template: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58644.yaml"},{"d":"2026-07-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-16","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644"},{"d":"2026-07-16","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43779"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft SharePoint to the fixed version for your release line (for example 16.0.5556.1005, 16.0.10417.20153 or 16.0.19725.20384).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":100},{"id":"2026-07-16-fortinet-fortisandbox","kind":"exploited","title":"Fortinet FortiSandbox: 2 OS Command Injection flaws exploited","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. CISA lists 1 more flaw in Fortinet FortiSandbox as exploited on the same day (CVE-2026-39808).","vendor":"Fortinet","product":"FortiSandbox","product_display":"Fortinet FortiSandbox","keys":["fortinet","fortinet:fortisandbox"],"cves":[{"id":"CVE-2026-25089","name":"OS Command Injection","description":"Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.","cvss":9.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","severity":"critical","epss":0.76112,"epss_pct":0.99534,"automatable":true,"impact":"total","fixed":[],"patch":"fixed","cwes":["CWE-78"]},{"id":"CVE-2026-39808","name":"OS Command Injection","description":"Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.","cvss":9.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","severity":"critical","epss":0.47362,"epss_pct":0.9884,"automatable":true,"impact":"total","fixed":[],"patch":"fixed","cwes":["CWE-78"]}],"severity":"critical","cvss":9.1,"epss":0.76112,"epss_pct":0.99534,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":[],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-16","added":"2026-07-16","updated":"2026-07-17","due":"2026-07-19","refs":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-141","label":"Vendor advisory (fortiguard.fortinet.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25089","label":"CVE record CVE-2026-25089","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39808.yaml","label":"Nuclei template: Fortinet FortiSandbox - Command Injection","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Fortinet FortiSandbox - Command Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39808.yaml"},{"d":"2026-04-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-04-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-39808 (now 6 repositories)","url":null},{"d":"2026-06-10","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-25089 (now 2 repositories)","url":null},{"d":"2026-07-16","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"}],"signals":{"poc":6,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Install the security update for Fortinet FortiSandbox from the vendor advisory.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":100},{"id":"2026-07-15-oracle-e-business-suite","kind":"exploited","title":"Oracle E-Business Suite: Improper Privilege Management","plain":"Attackers can gain higher privileges, over the internet, without logging in.","summary":"Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.","vendor":"Oracle","product":"E-Business Suite","product_display":"Oracle E-Business Suite","keys":["oracle","oracle:e-business-suite"],"cves":[{"id":"CVE-2026-46817","name":"Improper Privilege Management","description":"Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.","cvss":9.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","epss":0.00814,"epss_pct":0.5662,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-269","CWE-287","CWE-306"]}],"severity":"critical","cvss":9.8,"epss":0.00814,"epss_pct":0.5662,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-15","added":"2026-07-15","updated":"2026-07-16","due":"2026-07-18","refs":[{"url":"https://www.oracle.com/security-alerts/cspumay2026.html","label":"Vendor advisory (oracle.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46817","label":"CVE record CVE-2026-46817","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-05-28","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-06-29","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-46817 (now 2 repositories)","url":null},{"d":"2026-07-15","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817"}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Oracle E-Business Suite: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":101},{"id":"2026-07-15-knx-association-knx-protocol-connection-authorization-option-1","kind":"exploited","title":"KNX Protocol Connection Authorization Option 1: Overly Restrictive Account Lockout Mechanism","plain":null,"summary":"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.","vendor":"KNX Association","product":"KNX Protocol Connection Authorization Option 1","product_display":"KNX Protocol Connection Authorization Option 1","keys":["knx-association","knx-association:knx-protocol-connection-authorization-option-1"],"cves":[{"id":"CVE-2023-4346","name":"Overly Restrictive Account Lockout Mechanism","description":"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.","cvss":7.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","severity":"high","epss":0.01294,"epss_pct":0.70107,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":["CWE-645"]}],"severity":"high","cvss":7.5,"epss":0.01294,"epss_pct":0.70107,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-15","added":"2026-07-15","updated":"2026-07-16","due":"2026-07-29","refs":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4346","label":"CVE record CVE-2023-4346","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2023-08-29","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-15","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346"}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for KNX Protocol Connection Authorization Option 1: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":101},{"id":"2026-07-14-sonicwall-sma1000-appliances","kind":"exploited","title":"SonicWall SMA1000 Appliances: 2 flaws exploited together","plain":"Attackers can run their own code, over the internet, without logging in.","summary":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. CISA lists 1 more flaw in SonicWall SMA1000 Appliances as exploited on the same day (CVE-2026-15410).","vendor":"SonicWall","product":"SMA1000 Appliances","product_display":"SonicWall SMA1000 Appliances","keys":["sonicwall","sonicwall:sma1000-appliances"],"cves":[{"id":"CVE-2026-15409","name":"Server-Side Request Forgery","description":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.06795,"epss_pct":0.9399,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-918"]},{"id":"CVE-2026-15410","name":"Code Injection","description":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.","cvss":7.2,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","severity":"high","epss":0.11791,"epss_pct":0.96082,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-94"]}],"severity":"critical","cvss":10.0,"epss":0.11791,"epss_pct":0.96082,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":true,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-14","added":"2026-07-14","updated":"2026-08-04","due":"2026-07-17","refs":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","label":"Vendor advisory (psirt.global.sonicwall.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44404","label":"ENISA EUVD EUVD-2026-44404","kind":"registry"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44410","label":"ENISA EUVD EUVD-2026-44410","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15409","label":"CVE record CVE-2026-15409","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/linux/http/sonicwall_sma1000_wsproxy_rce/","label":"Metasploit exploit: SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-15409.yaml","label":"Nuclei template: SonicWall SMA1000 - Server-Side Request Forgery","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: SonicWall SMA1000 - Server-Side Request Forgery","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-15409.yaml"},{"d":"2026-07-14","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"},{"d":"2026-07-14","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44404"},{"d":"2026-07-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-15409 (now 6 repositories)","url":null},{"d":"2026-07-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-15410","url":null},{"d":"2026-07-29","lane":"code","label":"Metasploit exploit: SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution","url":"https://www.rapid7.com/db/modules/exploit/linux/http/sonicwall_sma1000_wsproxy_rce/"}],"signals":{"poc":6,"exploitdb":0,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for SonicWall SMA1000 Appliances: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Ransomware groups are known to use this.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":102},{"id":"2026-07-14-microsoft-active-directory-federation-services","kind":"exploited","title":"Microsoft Active Directory Federation Services: Insufficient Granularity of Access Control","plain":null,"summary":"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.","vendor":"Microsoft","product":"Active Directory Federation Services","product_display":"Microsoft Active Directory Federation Services","keys":["microsoft","microsoft:active-directory-federation-services"],"cves":[{"id":"CVE-2026-56155","name":"Insufficient Granularity of Access Control","description":"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.","cvss":7.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","severity":"high","epss":0.00346,"epss_pct":0.26986,"automatable":false,"impact":"total","fixed":["10.0.14393.9339","10.0.17763.9020","6.2.9200.26226","6.3.9600.23291","10.0.20348.5386","10.0.26100.33158"],"patch":"fixed","cwes":["CWE-1220"]}],"severity":"high","cvss":7.8,"epss":0.00346,"epss_pct":0.26986,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":false,"internet":false,"patch":{"status":"fixed","versions":["10.0.14393.9339","10.0.17763.9020","6.2.9200.26226","6.3.9600.23291","10.0.20348.5386","10.0.26100.33158"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-14","added":"2026-07-14","updated":"2026-10-08","due":"2026-07-28","refs":[{"url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44042","label":"ENISA EUVD EUVD-2026-44042","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56155","label":"CVE record CVE-2026-56155","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-14","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155"},{"d":"2026-07-14","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44042"},{"d":"2026-07-14","lane":"disclosure","label":"CVE published","url":null}],"signals":{"poc":0,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":false,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft Active Directory Federation Services to the fixed version for your release line (for example 10.0.14393.9339, 10.0.17763.9020 or 6.2.9200.26226).","also":[],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":102},{"id":"2026-07-14-microsoft-sharepoint-server","kind":"exploited","title":"Microsoft SharePoint Server: Missing Authentication for Critical Function","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.","vendor":"Microsoft","product":"SharePoint Server","product_display":"Microsoft SharePoint Server","keys":["microsoft","microsoft:sharepoint-server"],"cves":[{"id":"CVE-2026-56164","name":"Missing Authentication for Critical Function","description":"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.","cvss":5.3,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C","severity":"medium","epss":0.01011,"epss_pct":0.62865,"automatable":true,"impact":"partial","fixed":["16.0.5561.1001","16.0.10417.20175","16.0.19725.20434"],"patch":"fixed","cwes":["CWE-306"]}],"severity":"medium","cvss":5.3,"epss":0.01011,"epss_pct":0.62865,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["16.0.5561.1001","16.0.10417.20175","16.0.19725.20434"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-14","added":"2026-07-14","updated":"2026-10-08","due":"2026-07-17","refs":[{"url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44043","label":"ENISA EUVD EUVD-2026-44043","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56164","label":"CVE record CVE-2026-56164","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-07-14","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164"},{"d":"2026-07-14","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44043"},{"d":"2026-07-14","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-15","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-56164 (now 2 repositories)","url":null}],"signals":{"poc":2,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft SharePoint Server to the fixed version for your release line (for example 16.0.5561.1001, 16.0.10417.20175 or 16.0.19725.20434).","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":102},{"id":"2026-07-13-cisco-ios","kind":"exploited","title":"Cisco IOS: Cross-Site Request Forgery","plain":"Attackers can make logged-in users perform actions, over the internet, without logging in, once a user opens a file or link.","summary":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.","vendor":"Cisco","product":"IOS","product_display":"Cisco IOS","keys":["cisco","cisco:ios"],"cves":[{"id":"CVE-2008-4128","name":"Cross-Site Request Forgery","description":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.","cvss":8.1,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","severity":"high","epss":0.33871,"epss_pct":0.98394,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-352"]}],"severity":"high","cvss":8.1,"epss":0.33871,"epss_pct":0.98394,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-13","added":"2026-07-13","updated":"2026-09-24","due":"2026-07-16","refs":[{"url":"https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html","label":"Vendor advisory (cisco.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4128","label":"CVE record CVE-2008-4128","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/6476","label":"Exploit-DB 6476: Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1)","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2008-09-17","lane":"code","label":"Exploit-DB 6476: Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1)","url":"https://www.exploit-db.com/exploits/6476"},{"d":"2008-09-18","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-13","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128"}],"signals":{"poc":0,"exploitdb":1,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Cisco IOS: install the update or apply the mitigation it lists.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":103},{"id":"2026-07-10-balbooa-forms","kind":"exploited","title":"Balbooa Forms: Unrestricted Upload of File with Dangerous Type","plain":"Attackers can plant malicious files, over the internet, without logging in.","summary":"Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.","vendor":"Balbooa","product":"Forms","product_display":"Balbooa Forms","keys":["balbooa","balbooa:forms"],"cves":[{"id":"CVE-2026-56291","name":"Unrestricted Upload of File with Dangerous Type","description":"Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.","cvss":10.0,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","severity":"critical","epss":0.14854,"epss_pct":0.96696,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-434"]}],"severity":"critical","cvss":10.0,"epss":0.14854,"epss_pct":0.96696,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-10","added":"2026-07-10","updated":"2026-08-12","due":"2026-07-13","refs":[{"url":"https://www.balbooa.com/joomla-forms","label":"Vendor advisory (balbooa.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42573","label":"ENISA EUVD EUVD-2026-42573","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56291","label":"CVE record CVE-2026-56291","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56291.yaml","label":"Nuclei template: Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56291.yaml"},{"d":"2026-07-09","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-10","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291"},{"d":"2026-07-10","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42573"},{"d":"2026-07-11","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-56291 (now 5 repositories)","url":null}],"signals":{"poc":5,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Balbooa Forms: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":106},{"id":"2026-07-10-icagenda-icagenda","kind":"exploited","title":"iCagenda: Unrestricted Upload of File with Dangerous Type","plain":"Attackers can plant malicious files, over the internet, without logging in.","summary":"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.","vendor":"iCagenda","product":"iCagenda","product_display":"iCagenda","keys":["icagenda","icagenda:icagenda"],"cves":[{"id":"CVE-2026-48939","name":"Unrestricted Upload of File with Dangerous Type","description":"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.","cvss":10.0,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","severity":"critical","epss":0.20069,"epss_pct":0.97446,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-434"]}],"severity":"critical","cvss":10.0,"epss":0.20069,"epss_pct":0.97446,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-10","added":"2026-07-10","updated":"2026-08-12","due":"2026-07-13","refs":[{"url":"https://www.icagenda.com/#download","label":"Vendor advisory (icagenda.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48939","label":"CVE record CVE-2026-48939","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48939.yaml","label":"Nuclei template: Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48939.yaml"},{"d":"2026-06-20","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-06-29","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-48939 (now 3 repositories)","url":null},{"d":"2026-07-10","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939"}],"signals":{"poc":3,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for iCagenda: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":106},{"id":"2026-07-10-joomshaper-com-cve-2026-49049","kind":"exploited","title":"Joomshaper.com Helix3 extension for Joomla: Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler","plain":null,"summary":"The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.","vendor":"joomshaper.com","product":"Helix3 extension for Joomla","product_display":"Joomshaper.com Helix3 extension for Joomla","keys":["joomshaper-com","joomshaper-com:helix3-extension-for-joomla"],"cves":[{"id":"CVE-2026-49049","name":"Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler","description":"The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.","cvss":7.5,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","severity":"high","epss":0.00992,"epss_pct":0.62238,"automatable":true,"impact":"partial","fixed":[],"patch":"unknown","cwes":[]}],"severity":"high","cvss":7.5,"epss":0.00992,"epss_pct":0.62238,"exploited":true,"sources":["ENISA EUVD"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-10","added":"2026-07-10","updated":"2026-08-12","due":null,"refs":[{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40122","label":"ENISA EUVD EUVD-2026-40122","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49049","label":"CVE record CVE-2026-49049","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49049.yaml","label":"Nuclei template: JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49049.yaml"},{"d":"2026-06-29","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-04","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-49049 (now 8 repositories)","url":null},{"d":"2026-07-10","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40122"}],"signals":{"poc":8,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Joomshaper.com Helix3 extension for Joomla: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":106},{"id":"2026-07-07-joomshaper-sp-page-builder","kind":"exploited","title":"JoomShaper SP Page Builder: Unrestricted Upload of File with Dangerous Type","plain":"Attackers can plant malicious files, over the internet, without logging in.","summary":"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.","vendor":"JoomShaper","product":"SP Page Builder","product_display":"JoomShaper SP Page Builder","keys":["joomshaper","joomshaper:sp-page-builder"],"cves":[{"id":"CVE-2026-48908","name":"Unrestricted Upload of File with Dangerous Type","description":"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.","cvss":10.0,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","severity":"critical","epss":0.88512,"epss_pct":0.99775,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-434"]}],"severity":"critical","cvss":10.0,"epss":0.88512,"epss_pct":0.99775,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-07","added":"2026-07-07","updated":"2026-10-08","due":"2026-07-10","refs":[{"url":"https://extensions.joomla.org/extension/sp-page-builder/","label":"Vendor advisory (extensions.joomla.org)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48908","label":"CVE record CVE-2026-48908","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-48908.yaml","label":"Nuclei template: Joomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCE","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Joomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCE","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-48908.yaml"},{"d":"2026-06-20","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-06-22","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-48908 (now 11 repositories)","url":null},{"d":"2026-07-07","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908"}],"signals":{"poc":11,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for JoomShaper SP Page Builder: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":109},{"id":"2026-07-07-joomlack-page-builder","kind":"exploited","title":"Joomlack Page Builder: Improper Access Control","plain":"Attackers can reach functions they should not have access to, over the internet, without logging in.","summary":"Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.","vendor":"Joomlack","product":"Page Builder","product_display":"Joomlack Page Builder","keys":["joomlack","joomlack:page-builder"],"cves":[{"id":"CVE-2026-56290","name":"Improper Access Control","description":"Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.","cvss":10.0,"cvss_version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red","severity":"critical","epss":0.30866,"epss_pct":0.98255,"automatable":true,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-284"]}],"severity":"critical","cvss":10.0,"epss":0.30866,"epss_pct":0.98255,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-07","added":"2026-07-07","updated":"2026-10-08","due":"2026-07-10","refs":[{"url":"https://www.joomlack.fr/en/joomla-extensions/page-builder-ck","label":"Vendor advisory (joomlack.fr)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40121","label":"ENISA EUVD EUVD-2026-40121","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56290","label":"CVE record CVE-2026-56290","kind":"registry"},{"url":"https://www.exploit-db.com/exploits/52626","label":"Exploit-DB 52626: Joomla Page Builder CK  3.5.10 -  Arbitrary File Upload","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56290.yaml","label":"Nuclei template: Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56290.yaml"},{"d":"2026-06-29","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-03","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-56290 (now 5 repositories)","url":null},{"d":"2026-07-07","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290"},{"d":"2026-07-07","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40121"},{"d":"2026-07-08","lane":"code","label":"Exploit-DB 52626: Joomla Page Builder CK  3.5.10 -  Arbitrary File Upload","url":"https://www.exploit-db.com/exploits/52626"}],"signals":{"poc":5,"exploitdb":1,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Joomlack Page Builder: install the update or apply the mitigation it lists.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":109},{"id":"2026-07-07-adobe-coldfusion","kind":"exploited","title":"Adobe ColdFusion: Path Traversal","plain":"Attackers can read or write files they should not reach, over the internet, without logging in.","summary":"Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.","vendor":"Adobe","product":"ColdFusion","product_display":"Adobe ColdFusion","keys":["adobe","adobe:coldfusion"],"cves":[{"id":"CVE-2026-48282","name":"Path Traversal","description":"Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.42388,"epss_pct":0.98703,"automatable":true,"impact":"total","fixed":["10","21"],"patch":"fixed","cwes":["CWE-22"]}],"severity":"critical","cvss":10.0,"epss":0.42388,"epss_pct":0.98703,"exploited":true,"sources":["CISA KEV","ENISA EUVD"],"ransomware":false,"forensic":true,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["10","21"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-07","added":"2026-07-07","updated":"2026-10-07","due":"2026-07-10","refs":[{"url":"https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html","label":"Vendor advisory (helpx.adobe.com)","kind":"advisory"},{"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40339","label":"ENISA EUVD EUVD-2026-40339","kind":"registry"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48282","label":"CVE record CVE-2026-48282","kind":"registry"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48282.yaml","label":"Nuclei template: Adobe ColdFusion - RDS Arbitrary File Write","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: Adobe ColdFusion - RDS Arbitrary File Write","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48282.yaml"},{"d":"2026-06-30","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-07-06","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-48282 (now 3 repositories)","url":null},{"d":"2026-07-07","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282"},{"d":"2026-07-07","lane":"official","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40339"}],"signals":{"poc":3,"exploitdb":0,"metasploit":0,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Adobe ColdFusion to 10 or 21 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":109},{"id":"2026-07-07-langflow-langflow","kind":"exploited","title":"Langflow: Authorization Bypass Through User-Controlled Key","plain":null,"summary":"Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.","vendor":"Langflow","product":"Langflow","product_display":"Langflow","keys":["langflow","langflow:langflow"],"cves":[{"id":"CVE-2026-55255","name":"Authorization Bypass Through User-Controlled Key","description":"Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.","cvss":8.4,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","severity":"high","epss":0.00887,"epss_pct":0.58914,"automatable":false,"impact":"total","fixed":[],"patch":"unknown","cwes":["CWE-639"]}],"severity":"high","cvss":8.4,"epss":0.00887,"epss_pct":0.58914,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"unknown","versions":[],"note":null,"label":"Check vendor"},"be":null,"first_seen":"2026-07-07","added":"2026-07-07","updated":"2026-10-07","due":"2026-07-10","refs":[{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2","label":"Vendor advisory (github.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55255","label":"CVE record CVE-2026-55255","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-06-23","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-06-30","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-55255","url":null},{"d":"2026-07-07","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255"}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Follow the vendor advisory for Langflow: install the update or apply the mitigation it lists.","also":["Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":109},{"id":"2026-07-01-microsoft-sharepoint-server","kind":"exploited","title":"Microsoft SharePoint Server: Deserialization of Untrusted Data","plain":"Attackers can run their own code, over the internet.","summary":"Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.","vendor":"Microsoft","product":"SharePoint Server","product_display":"Microsoft SharePoint Server","keys":["microsoft","microsoft:sharepoint-server"],"cves":[{"id":"CVE-2026-45659","name":"Deserialization of Untrusted Data","description":"Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.","cvss":8.8,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","severity":"high","epss":0.02704,"epss_pct":0.85853,"automatable":false,"impact":"total","fixed":["16.0.5552.1002","16.0.10417.20128","16.0.19725.20280"],"patch":"fixed","cwes":["CWE-502"]}],"severity":"high","cvss":8.8,"epss":0.02704,"epss_pct":0.85853,"exploited":true,"sources":["CISA KEV"],"ransomware":true,"forensic":true,"automatable":false,"internet":true,"patch":{"status":"fixed","versions":["16.0.5552.1002","16.0.10417.20128","16.0.19725.20280"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-07-01","added":"2026-07-01","updated":"2026-08-11","due":"2026-07-04","refs":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659","label":"Vendor advisory (msrc.microsoft.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45659","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45659","label":"CVE record CVE-2026-45659","kind":"registry"}],"curated":false,"featured":false,"note":null,"events":[{"d":"2026-05-22","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-05-27","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-45659","url":null},{"d":"2026-07-01","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45659"}],"signals":{"poc":1,"exploitdb":0,"metasploit":0,"nuclei":false,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update Microsoft SharePoint Server to the fixed version for your release line (for example 16.0.5552.1002, 16.0.10417.20128 or 16.0.19725.20280).","also":["Ransomware groups are known to use this.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":115},{"id":"2026-06-29-simplehelp-simplehelp","kind":"exploited","title":"SimpleHelp: Authentication Bypass","plain":"Attackers can get past the login, over the internet, without logging in.","summary":"SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.","vendor":"SimpleHelp ","product":"SimpleHelp","product_display":"SimpleHelp","keys":["simplehelp","simplehelp:simplehelp"],"cves":[{"id":"CVE-2026-48558","name":"Authentication Bypass","description":"SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.","cvss":10.0,"cvss_version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","epss":0.05719,"epss_pct":0.93013,"automatable":true,"impact":"total","fixed":["5.5.16","6.0 RC2"],"patch":"fixed","cwes":["CWE-347"]}],"severity":"critical","cvss":10.0,"epss":0.05719,"epss_pct":0.93013,"exploited":true,"sources":["CISA KEV"],"ransomware":false,"forensic":false,"automatable":true,"internet":true,"patch":{"status":"fixed","versions":["5.5.16","6.0 RC2"],"note":null,"label":"Fix available"},"be":null,"first_seen":"2026-06-29","added":"2026-06-29","updated":"2026-10-07","due":"2026-07-02","refs":[{"url":"https://simple-help.com/security/simplehelp-security-update-2026-05","label":"Vendor advisory (simple-help.com)","kind":"advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558","label":"CISA KEV","kind":"registry"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48558","label":"CVE record CVE-2026-48558","kind":"registry"},{"url":"https://www.rapid7.com/db/modules/exploit/multi/http/simplehelp_oidc_auth_bypass_rce/","label":"Metasploit exploit: SimpleHelp OIDC Authentication Bypass Remote Code Execution","kind":"exploit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48558.yaml","label":"Nuclei template: SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass","kind":"exploit"}],"curated":false,"featured":false,"note":null,"events":[{"d":null,"lane":"scanner","label":"Nuclei template: SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48558.yaml"},{"d":"2026-06-12","lane":"disclosure","label":"CVE published","url":null},{"d":"2026-06-29","lane":"official","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558"},{"d":"2026-07-02","lane":"code","label":"First public proof of concept on GitHub for CVE-2026-48558","url":null},{"d":"2026-09-01","lane":"code","label":"Metasploit exploit: SimpleHelp OIDC Authentication Bypass Remote Code Execution","url":"https://www.rapid7.com/db/modules/exploit/multi/http/simplehelp_oidc_auth_bypass_rce/"}],"signals":{"poc":1,"exploitdb":0,"metasploit":1,"nuclei":true,"lists":0,"code":true,"measured":null,"social":{"week":0,"recent":0,"platforms":[],"rising":false,"partial":[],"talked":false}},"vendor_advisories":[],"advisory_keys":[],"action":"Update SimpleHelp to 5.5.16 or 6.0 RC2 or later.","also":["Start with systems that face the internet: this can be exploited automatically, at scale.","Patching does not remove an attacker who got in before. Check for signs of compromise."],"urgency":"watch","action_label":"Keep patched","live":false,"age_days":117}]}