VIRY.CZ RADAR je monitor bezpečnostních hrozeb: advisories, zranitelnosti a threat intel z veřejných zdrojů, česky a na jednom místě.
Jsem „protkán“ AI. Snažím se pochopit zdrojové texty a bez vymýšlení je zestručnit a převést do českého jazyka, případně s využitím AI seskupit. Patřičně jsem pak hrdý na týdenní reporty, kde s pomocí AI zpracovávám stovky článků a hledám v nich souvislosti. Používám ale i čistou matematiku, takže pokud například více zdrojů mluví o shodné CVE chybě, seskupím to do jednoho příspěvku. Doporučuji se přihlásit k jejich odběru. Pokud se Vám líbím, nebráním se finanční podpoře :-)
Původní „Igiho stránka o virech“ se odstěhovala sem.
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...]
EPSS 0.01 CVSS 9.9 CVE-2026-90970 GitLab FI CA US
Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. [...]
CVSS 10.0 CVE-2026-54472 CVE-2026-61411 CVE-2026-61421 CVE-2026-63688 CVE-2026-63689 CVE-2026-63690 CVE-2026-63691 CVE-2026-63692 CVE-2026-67269 CVE-2026-67270 CVE-2026-67273 CVE-2026-70411 CVE-2026-76105 Dell FI US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.4, CVEs: CVE-2026-86325, CVE-2026-86326, Summary: CVE-2026-86325 CVSS 4.0: 9.4 - AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as…
EPSS 0.00 CVSS 9.4 CVE-2026-86325 CVE-2026-86326 Moxa FI CA FR
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.0: 9.8, CVEs: CVE-2026-104286, Summary: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. This has been reported to be exploited in the wild, customers are urged to apply…
KEV ✓ EPSS 0.02 CVSS 9.8 CVE-2026-104286 Fortinet FI CA SE RO NL IT FR US
The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team.
Microsoft vodárenství telekomunikace veřejná správa školství US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. The following versions of MikroTik RouterOS are affected: RouterOS <7.24 (CVE-2026-84411) CVSS Vendor Equipment Vulnerabilities v3 9.8 MikroTik MikroTik RouterOS Integer Underflow (Wrap or Wraparound) Background Critical Infrastructure Sectors: Communications, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters…
EPSS 0.01 CVSS 9.8 CVE-2026-84411 MikroTik telekomunikace CA IT US
Serial number: AV26-990 Date: October 2, 2026 As of October 1, 2026, WatchGuard is affected by a vulnerability in the following product: Endpoint Security Prior to 8.00.26.0012 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CVE-2026-13043 — WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access WatchGuard Security Advisories
EPSS 0.00 CVSS 9.3 CVE-2026-13043 WatchGuard CA IT FI
Er zijn twee zeroday-kwetsbaarheden aangetroffen in Zammad. De eerste kwetsbaarheid heeft het kenmerk CVE-2026-102489 toegekend gekregen. De kwetsbaarheid stelt een ongeauthenticeerde kwaadwillende op afstand in staat om willekeurige code uit te voeren. De kwetsbaarheid is aanwezig in Zammad versies 6.3.0 tot en met 6.5.4. De tweede kwetsbaarheid heeft het kenmerk CVE-2026-102490 toegekend gekregen. Deze kwetsbaarheid stelt een kwaadwillende die over lage rechten beschikt in staat om…
KEV ✓ EPSS 0.01 CVE-2026-102489 CVE-2026-102490 Zammad Zammad GmbH IT US NL
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.4, CVEs: CVE-2026-93495, CVE-2026-14157, CVE-2026-13313, Summary: CVE-2026-93495 (CVSS: 7.0): ASUS has released a BIOS update for the affected motherboard models listed below and strongly recommends updating to the latest version to ensure optimal protection. This update addresses a security vulnerability related to improper initialization in certain ASUS motherboards. If exploited, the issue could…
EPSS 0.01 CVSS 9.4 CVE-2026-13313 CVE-2026-14157 CVE-2026-93495 ASUS FI IT
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.5, CVEs: CVE-2026-103245, CVE-2026-103246, CVE-2026-103247, CVE-2026-103248, CVE-2026-103249, CVE-2026-103250, CVE-2026-103251, CVE-2026-103252, CVE-2026-103253, CVE-2026-103254, CVE-2026-103255, CVE-2026-103256, CVE-2026-103257, CVE-2026-103258, CVE-2026-103259, CVE-2026-103260, Summary: CVE-2026-103245 (CVSS: 6.9): n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1…
EPSS 0.00 CVSS 8.5 CVE-2026-103245 CVE-2026-103246 CVE-2026-103247 CVE-2026-103248 CVE-2026-103249 CVE-2026-103250 CVE-2026-103251 CVE-2026-103252 CVE-2026-103253 CVE-2026-103254 CVE-2026-103255 CVE-2026-103256 CVE-2026-103257 CVE-2026-103258 CVE-2026-103259 CVE-2026-103260 n8n FI CA IT
Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. [...]
Kiteworks CA US GB
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. The following versions of Armatura LLC Armatura One are affected: Armatura One <4.7.2 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) Armatura One (USA) <4.6.1 (CVE-2023-46604, CVE-2026-94591, CVE-2026…
KEV ✓ · ransomware EPSS 1.00 CVSS 9.8 CVE-2023-46604 CVE-2026-94591 CVE-2026-94592 CVE-2026-94593 CVE-2026-94594 Armatura LLC Apache telekomunikace výroba a průmysl energetika doprava US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-76504, Summary: A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to…
KEV ✓ EPSS 0.92 CVSS 9.8 CVE-2026-20127 CVE-2026-20182 CVE-2026-76504 Cisco CA HU FI FR US NL IT
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. [...]
Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
KEV ✓ EPSS 0.01 CVE-2026-86950 Apple NL CA US IT FR
Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]
KEV ✓ EPSS 0.46 CVSS 9.2 CVE-2026-87902 CVE-2026-93485 WordPress HU US RO FI CA NL IT FR
Aggiornamenti di sicurezza risolvono 2 vulnerabilità, di cui 1 con gravità "critica" e 1 con gravità "alta", in CPython, implementazione di riferimento open source del linguaggio di programmazione Python. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato remoto non autenticato di eludere i meccanismi di sicurezza o di compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.00 CVSS 9.2 CVE-2026-19445 CVE-2026-19553 Python CPython IT FI FR
In this article Star Blizzard TTPs observed in 2026Defending against Star Blizzard and RedFlick-related activityMicrosoft Defender detectionsHunting queriesIndicators of compromise Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that Microsoft tracks as “RedFlick”. These changes represent a…
A spokesperson for the court system told Recorded Future News that the incident did not involve ransomware and the hackers have not issued ransom demands for the stolen data as of Monday.
In this article Attack chain overviewMitigation and protection guidanceReferencesLearn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled, without requiring…
KEV ✓ EPSS 0.12 CVE-2026-73570 Zimbra Synacor veřejná správa US HU IT
Artifex Software ha rilasciato aggiornamenti di sicurezza che sanano una vulnerabilità con gravità "alta" in Ghostscript, software per l'elaborazione di documenti PostScript e PDF, nella versione per Windows. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato di elevare i propri privilegi sui sistemi interessati.
EPSS 0.00 CVE-2026-19547 Artifex Software Ghostscript IT PL
Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software. [...]
EPSS 0.00 CVSS 8.8 CVE-2026-19743 CVE-2026-92368 CVE-2026-92369 CVE-2026-92370 CVE-2026-92371 TeamViewer US IT FI CA
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-76721, CVE-2026-76722, CVE-2026-76723, CVE-2026-76724, CVE-2026-76725, CVE-2026-76726, CVE-2026-76727, CVE-2026-76728, CVE-2026-76729, CVE-2026-76730, CVE-2026-76731, CVE-2026-76732, CVE-2026-76733, CVE-2026-76734, CVE-2026-76735, CVE-2026-76736, CVE-2026-76737, CVE-2026-76738, Summary: Multiple Vulnerabilities in HPE Networking Instant On APs
EPSS 0.01 CVSS 9.8 a dalších 1 CVE-2026-76722 CVE-2026-76723 CVE-2026-76724 CVE-2026-76725 CVE-2026-76726 CVE-2026-76727 CVE-2026-76728 CVE-2026-76729 CVE-2026-76730 CVE-2026-76731 CVE-2026-76732 CVE-2026-76733 CVE-2026-76734 CVE-2026-76735 CVE-2026-76736 CVE-2026-76737 CVE-2026-76738 HPE FI FR
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1, CVEs: CVE-2026-8065, CVE-2026-8066, CVE-2026-8067, CVE-2010-2965, CVE-2014-9195, CVE-2023-46143, Summary: Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware versions that were developed according to the cybersecurity…
EPSS 0.81 CVSS 9.1 CVE-2010-2965 CVE-2014-9195 CVE-2023-46143 CVE-2026-8065 CVE-2026-8066 CVE-2026-8067 Hitachi Energy energetika FI CA
De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité. Gitlab indique que la vulnérabilité CVE-2026-85706 est activement exploitée.
KEV ✓ EPSS 0.93 CVE-2026-85706 GitLab veřejná správa FR CZ NL CA US
Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. [...]
Two unpatched Citrix NetScaler zero-day vulnerabilities are reportedly being exploited in attacks, with cybersecurity agencies, security researchers, and IT providers privately warning organizations about the flaws ahead of patches expected next week. [...]
KEV ✓ EPSS 0.23 CVSS 9.5 CVE-2026-19489 CVE-2026-19490 CVE-2026-88771 CVE-2026-88772 CVE-2026-887729 CVE-2026-88773 CVE-2026-887739 CVE-2026-88774 CVE-2026-88775 CVE-2026-88776 CVE-2026-88777 CVE-2026-88778 Citrix NetScaler veřejná správa finance školství US CA GB HU RO FI FR IT EU NL SE AT
Rilevate 6 vulnerabilità con gravità “alta” in diversi moduli di FreePBX, piattaforma open source per la configurazione e la gestione grafica di centralini telefonici basati su Asterisk.
EPSS 0.01 CVE-2026-45562 CVE-2026-54674 CVE-2026-54675 CVE-2026-54708 CVE-2026-54710 CVE-2026-75600 FreePBX Asterisk telekomunikace CA IT
Serial number: AV26-972Date: September 29, 2026 As of September 28, 2026, WatchGuard is affected by vulnerabilities in the following product: WatchGuard AP Prior to 3.4.8 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CVE-2026-101891 — WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access CVE-2026-86102 — WatchGuard AP Command Injection in Internal Management API Allows…
EPSS 0.02 CVE-2026-101891 CVE-2026-86102 CVE-2026-87969 WatchGuard CA IT
A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access. [...]
KEV ✓ EPSS 0.14 CVE-2026-69104 CVE-2026-70548 CVE-2026-70550 CVE-2026-70551 CVE-2026-82329 JFrog IT US CA FR
There are reportedly two unpatched zero-day Citrix NetScaler vulnerabilities capable of enabling remote code execution that have been actively exploited in the wild, with no patches available at this time.Key takeawaysReports indicate that there are two critical zero-day vulnerabilities in Citrix NetScaler.The reports originate from a pre-notification sent out ahead of public disclosure, so there are currently no specific details about these flaws and no patches available.This post will be…
KEV ✓ EPSS 0.58 CVE-2023-6549 CVE-2025-6543 CVE-2026-19489 CVE-2026-19490 Citrix US