ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.
Výsledky hledání
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks.
BeyondTrust US
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
CVE-2023-46805 * CVE-2023-4966 * CVE-2024-12356 * CVE-2024-12686 * CVE-2024-21887 * CVE-2025-0282 * CVE-2026-102764 * CVE-2026-1731 * BeyondTrust US
· zachyceno
Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624)
CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog. Affected product: Fortinet Multiple Products. Remediation due date: 2026-10-19.
KEV ✓ EPSS 0.01 CVE-2025-61624 Fortinet US
2026-017: Critical Vulnerability in Cisco Secure Email Gateway
On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an unauthenticated, remote attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. The Cisco PSIRT is aware of active exploitation of this vulnerability. CERT-EU strongly recommends updating the Content Scanner Tools package or…
Cisco EU
SPOJENO PŘES CVE Kritische Sicherheitslücke in Cisco Secure Email Gateway - aktiv ausgenutzt - Updates verfügbar - CVE-2026-76519
15. Oktober 2026 Beschreibung In der Funktion Advanced Malware Protection (AMP) von Cisco Secure Email Gateway existiert eine kritische Sicherheitslücke. Die Schwachstelle beruht auf einer fehlerhaften Verarbeitung von E-Mail-Anhängen, wenn der File-Reputation-Dienst aktiviert ist. Laut Cisco wird die Sicherheitslücke bereits aktiv ausgenutzt. CVE-Nummer(n): CVE-2026-76519 CVSS Base Score: 9.8 Auswirkungen Nicht authentifizierte Angreifer:innen können aus der Ferne durch das Versenden einer E…
KEV ✓ EPSS 0.02 CVSS 9.8 CVE-2026-76519 Cisco AT IT FI FR CA US
SPOJENO PŘES CVE Palo Alto Networks: rilevato sfruttamento in rete della CVE-2026-0322 relativa a PAN-OS
Palo Alto Networks ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità, di cui una con gravità “alta” relativa a PAN-OS per la quale è stato rilevato lo sfruttamento attivo in rete.
KEV ✓ EPSS 0.02 CVSS 8.6 CVE-2026-0322 Palo Alto Networks IT FI US CA
· zachyceno
SPOJENO PŘES CVE Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589)
CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog. Affected product: Atlassian Multiple Products. Remediation due date: 2026-10-18.
KEV ✓ EPSS 0.99 CVSS 9.3 CVE-2026-21589 Atlassian US FI CA IT
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.
KEV ✓ EPSS 0.95 CVE-2024-47575 Fortinet US
NCSC-2026-0429 [1.00] [H/H] Kwetsbaarheid verholpen in Cisco Secure Email Gateway
Cisco heeft een kwetsbaarheid verholpen in Cisco Secure Email Gateway, specifiek in de Advanced Malware Protection feature. De kwetsbaarheid bevindt zich in de wijze waarop de Advanced Malware Protection feature e-mailbijlagen verwerkt wanneer de file reputation service is ingeschakeld. Een niet-geauthenticeerde externe aanvaller kan hierdoor willekeurige bestanden schrijven naar het onderliggende besturingssysteem. Misbruik van deze kwetsbaarheid kan leiden tot het uitvoeren van commando's met…
Cisco NL
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]
CVE-2024-20401 * CVE-2025-20393 * CVE-2026-76461 * CVE-2026-76519 * Cisco US
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
This research was conducted jointly with Julian-Ferdinand Vögele of Recorded Future’s Insikt Group. Details of the joint research and presentation are available here. Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the…
KEV ✓ · ransomware EPSS 1.00 CVE-2025-25257 CVE-2025-8088 WinRAR Fortinet veřejná správa energetika vodárenství US
SPOJENO PŘES CVE NCSC-2026-0427 [1.00] [M/H] Kwetsbaarheden verholpen in Ahsay AhsayCBS
Ahsay heeft kwetsbaarheden verholpen in AhsayCBS tot en met versie 10.3.2. De kwetsbaarheid met kenmerk CVE-2026-105133 heeft een CVSS-score van 7,3 en betreft onvoldoende authenticatie in de functie checkSysPwd van de AhsayCBS API. Een niet-geauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken om de authenticatie te omzeilen. De kwetsbaarheid met kenmerk CVE-2026-105134 heeft een CVSS-score van 10,0 en betreft OS-command-injectie in de Replication Receiver via /rps/api/json…
KEV ✓ EPSS 0.82 CVE-2026-105133 CVE-2026-105134 Ahsay NL US
SPOJENO PŘES CVE CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]
CVE-2023-46805 * CVE-2024-21887 * CVE-2024-21893 * CVE-2025-0282 * CVE-2025-22457 * CVE-2026-104935 * Ivanti US
Update Windows: Record Patch Tuesday fixes flaw already under attack
Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws. Just when you thought a previous record would stand for a while, Microsoft comes out again with the largest monthly Patch Tuesday release. Microsoft has said its growing use of AI to find and fix security vulnerabilities means users should expect more fixes in its monthly updates. How to apply patches and…
Microsoft US
· zachyceno
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Classification: Critical, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv3.1: 9.8, CVEs: CVE-2026-70098, CVE-2026-102855, CVE-2026-102238, CVE-2026-102235, CVE-2026-102234, CVE-2026-97844, CVE-2026-97843, CVE-2026-97842, CVE-2026-97841, CVE-2026-97840, CVE-2026-97839, CVE-2026-97838, CVE-2026-97837, CVE-2026-97836, CVE-2026-97835, CVE-2026-97834, CVE-2026-97833, CVE-2026-97832, CVE-2026-97831, CVE-2026-97830 (+1364 other associated CVEs), Summary: Today is Microsoft's October 2026…
CVSS 9.8 Microsoft FI
· zachyceno
Ahsay AhsayCBS Improper Authentication Vulnerability (CVE-2026-105133)
CISA added CVE-2026-105133 to the Known Exploited Vulnerabilities catalog. Affected product: Ahsay AhsayCBS. Remediation due date: 2026-10-17.
KEV ✓ EPSS 0.79 CVE-2026-105133 Ahsay US
· zachyceno
Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134)
CISA added CVE-2026-105134 to the Known Exploited Vulnerabilities catalog. Affected product: Ahsay AhsayCBS. Remediation due date: 2026-10-17.
KEV ✓ EPSS 0.82 CVE-2026-105134 Ahsay US
· zachyceno
SPOJENO PŘES CVE Multiples vulnérabilités dans Microsoft Windows (14 octobre 2026)
De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance. Microsoft indique que la vulnérabilité CVE-2026-96951...
KEV ✓ EPSS 0.10 CVE-2026-96951 Microsoft FR US CA
Patch Tuesday - October 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday, including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well…
Microsoft US
Microsoft Patch Tuesday, October 2026 Security Update Review
Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches promptly remains critical to reducing exposure and strengthening security posture. This month’s updates highlight the importance of identifying affected assets, prioritizing remediation, and staying ahead of emerging risks. This Patch Tuesday is Microsoft’s largest…
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-96951 is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability…
Microsoft US
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]
Microsoft US
The October 2026 Security Update Review
Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted…
Ivanti security advisory (AV26-1035)
Serial number: AV26-1035 Date: October 13, 2026 As of October 13, 2026, Ivanti is affected by vulnerabilities in the following products: Ivanti Connect Secure Version 25.1.1.1 and prior Version 25.2.2 and prior Version 22.8R2.4 and prior Ivanti Neurons Patch for Intune Versions prior to September 16, 2026 Ivanti Xtraction Version 2026.2.1 and prior On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-CVE-2026-104935 to their Known Exploited Vulnerabilities…
KEV ✓ EPSS 0.87 CVE-2026-104935 CVE-2026-109412 Ivanti CA
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited. CVE-2026-96951: An already exploited Windows Shell Security Feature Bypass Vulnerability. This vulnerabliity allows bypassing the "Mark of the Web" making it easier to exeucte code by sending a malicious message to a user via e-mail or…
Microsoft US
NCSC-2026-0422 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Office
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer. Voor succesvol misbruik moet de…
Microsoft NL
NCSC-2026-0416 [1.00] [H/H] ZeroDay kwetsbaarheid verholpen in Ivanti Connect Secure
Ivanti heeft een kwetsbaarheid verholpen in Connect Secure. Een kwaadwillende kan de kwetsbaarheid misbruiken om zonder voorafgaande authenticatie willekeurige commando's uit te voeren op het kwetsbare systeem. Ivanti meldt op de hoogte te zijn van rapporten dat de kwetsbaarheid als ZeroDay kwetsbaarheid is misbruikt. Er is (nog) geen publieke Proof-of-Concept (PoC) beschikbaar, maar het NCSC verwacht dat publieke PoC of exploitcode op korte termijn beschikbaar komt, wat de kans op grootschalig…
Ivanti NL
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. [...]
EPSS 0.01 CVE-2026-102255 SonicWall US
SPOJENO PŘES CVE FBI disrupts Chinese hacking tools used to breach critical infrastructure
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]
KEV ✓ · ransomware EPSS 1.00 CVE-2014-6278 CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2019-11510 CVE-2021-22205 CVE-2021-3199 CVE-2023-22894 Microsoft veřejná správa výroba a průmysl zdravotnictví školství US
SPOJENO PŘES CVE Making sure the checks get printed
Welcome to this week’s edition of the Threat Source newsletter. My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and compliance, disaster recovery, and investigations. I spent about 15 years as a consultant working across many well-known consultancy firms and…
KEV ✓ EPSS 0.11 CVSS 8.7 CVE-2026-88779 Cisco Citrix Google US CA FI GB FR IT
· zachyceno
ProFTPD Improper Access Control Vulnerability (CVE-2015-3306)
CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog. Affected product: ProFTPD ProFTPD. Remediation due date: 2026-10-11.
KEV ✓ EPSS 0.99 CVE-2015-3306 ProFTPD US
· zachyceno
ONLYOFFICE Docs Server Path Traversal Vulnerability (CVE-2021-3199)
CISA added CVE-2021-3199 to the Known Exploited Vulnerabilities catalog. Affected product: ONLYOFFICE Docs. Remediation due date: 2026-10-11.
KEV ✓ EPSS 0.30 CVE-2021-3199 ONLYOFFICE US
· zachyceno
Strapi Cleartext Storage of Sensitive Information Vulnerability (CVE-2023-22894)
CISA added CVE-2023-22894 to the Known Exploited Vulnerabilities catalog. Affected product: Strapi Strapi. Remediation due date: 2026-10-11.
KEV ✓ EPSS 0.04 CVE-2023-22894 Strapi US
· zachyceno
Apache Struts Command Injection Vulnerability (CVE-2016-3081)
CISA added CVE-2016-3081 to the Known Exploited Vulnerabilities catalog. Affected product: Apache Struts. Remediation due date: 2026-10-11.
KEV ✓ EPSS 0.97 CVE-2016-3081 Apache US
· zachyceno
ISC BIND Data Processing Errors Vulnerability (CVE-2015-5477)
CISA added CVE-2015-5477 to the Known Exploited Vulnerabilities catalog. Affected product: ISC BIND. Remediation due date: 2026-10-11.
KEV ✓ EPSS 1.00 CVE-2015-5477 ISC US
· zachyceno
Spike in Attacks Targeting Digital Video Recorders in Ukraine
For months, GreyNoise recorded almost no Hikvision camera exploit attempts against Ukraine. On Sept 21 activity surged for nine days during Russian strikes, almost all from four IPs, then stopped. We can't say if the two are linked.
Hikvision US
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
The FBI is warning that FortiBleed attacks are still ongoing, targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways and locking out legitimate administrators. [...]
Fortinet US
Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]
CVE-2026-93836 * CVE-2026-94504 * WordPress Ninja Forms WPC Product Bundles for WooCommerce US
Rejetto HFS servers now actively scanned for critical RCE flaw
Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). [...]
EPSS 0.02 CVE-2026-61500 Rejetto US
· zachyceno
SPOJENO PŘES CVE Fortinet FortiMail Improper limitation of a pathname to a restricted directory
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.0: 9.8, CVEs: CVE-2026-104286, Summary: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. This has been reported to be exploited in the wild, customers are urged to apply…
KEV ✓ EPSS 0.05 CVSS 9.8 CVE-2026-104286 Fortinet FI CA SE NL IT FR US
Frontline Education breach exposes school district employee data
Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. [...]
Warlock ransomware breach SharePoint in water, telecom operator attacks
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]
CVE-2025-1055 * CVE-2025-49704 * CVE-2025-49706 * CVE-2025-53770 * CVE-2025-53771 * vodárenství telekomunikace veřejná správa školství US
'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team.
Microsoft US
SPOJENO PŘES CVE Zammad: rilevato sfruttamento in rete delle CVE-2026-102489 e CVE-2026-102490
Rilevato lo sfruttamento attivo in rete delle vulnerabilità CVE-2026-102489 e CVE-2026-102490 - già sanate dal vendor - relative a Zammad, soluzione open source di help desk, ticketing e customer support. Qualora le due vulnerabilità fossero sfruttate in sequenza nell'ambito di una catena di attacco, un attore malevolo potrebbe dapprima ottenere l'esecuzione di codice come utente "zammad" e successivamente elevare i propri privilegi fino a "root" sul sistema interessato.
KEV ✓ EPSS 0.22 CVE-2026-102489 CVE-2026-102490 Zammad IT US NL
· zachyceno
Zammad GmbH Zammad Session Fixation Vulnerability (CVE-2026-102489)
CISA added CVE-2026-102489 to the Known Exploited Vulnerabilities catalog. Affected product: Zammad GmbH Zammad. Remediation due date: 2026-10-05.
KEV ✓ EPSS 0.22 CVE-2026-102489 Zammad GmbH US
· zachyceno
Zammad GmbH Zammad Improper Privilege Management Vulnerability (CVE-2026-102490)
CISA added CVE-2026-102490 to the Known Exploited Vulnerabilities catalog. Affected product: Zammad GmbH Zammad. Remediation due date: 2026-10-05.
KEV ✓ EPSS 0.11 CVE-2026-102490 Zammad GmbH US
SPOJENO PŘES CVE Cisco security advisory (AV26-978)
Serial Number: AV26-978 Date: October 1, 2026 As of September 30, 2026, Cisco is affected by a vulnerability in the following product: Cisco Catalyst SD-WAN Manager Versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 et 26.2.1 On September 30, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76504 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply…
KEV ✓ EPSS 0.39 CVSS 9.8 CVE-2026-76504 Cisco CA HU FI FR US IT
NCSC-2026-0397 [1.00] [M/H] Kwetsbaarheid verholpen in Apple CoreGraphics
Apple heeft een kwetsbaarheid verholpen in CoreGraphics op iOS, iPadOS en macOS. De kwetsbaarheid betreft een out-of-bounds write in de CoreGraphics component. Een aanvaller kan deze kwetsbaarheid misbruiken door speciaal vervaardigde bestanden te verwerken, wat kan leiden tot het uitvoeren van willekeurige code. Deze kwetsbaarheid is gebruikt in gerichte aanvallen op iOS-versies vóór iOS 27. De kwetsbaarheid komt voor in meerdere Apple besturingssystemen.
Apple NL
SPOJENO PŘES CVE Riasztás a WordPress Core-t érintő sérülékenységről
A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézete riasztást ad ki a széles körben használt WordPress tartalomkezelő rendszer (Core) aktívan kihasznált sérülékenysége miatt. A CISA 2026. szeptember 25-én vette fel a KEV-katalógusába. A hiba hitelesítés nélkül kihasználható, és bizonyos feltételek teljesülése esetén távoli kódfuttatáshoz vezethet. A CVE-2026-87902 azonosítón nyomon követett, magas súlyosságú sérülékenység önmagában helyi fájl beágyazását […]
KEV ✓ EPSS 0.96 CVSS 9.2 CVE-2026-87902 WordPress HU US FI CA NL FR
· zachyceno
Improper limitation of a pathname to a restricted directory
CVSSv3 Score: 9.8 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.This has been reported to be exploited in the wild, customers are urged to apply the workaround below. Revised on 2026-10-01 00:00:00
CVSS 9.8 US
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding (CWE-177). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.According to…
KEV ✓ EPSS 0.92 CVSS 9.8 CVE-2026-20127 CVE-2026-20182 CVE-2026-76504 Cisco US
Bitget hacked via zero-day in third-party security products
Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products. [...]
finance US
Dolibarr: rilevato sfruttamento in rete della CVE-2026-89013
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-89013 - già sanata dal vendor - relativa a Dolibarr, soluzione open source per la gestione di documenti e processi aziendali. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente non autenticato di leggere file arbitrari sui sistemi interessati.
EPSS 0.02 CVE-2026-89013 Dolibarr IT
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Huntress SOC found a threat actor exploiting a file upload flaw in recreation management to breach 3 municipal servers and steal payment data.
· zachyceno
SPOJENO PŘES CVE Multiples vulnérabilités dans GitLab (30 septembre 2026)
De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité. Gitlab indique que la vulnérabilité CVE-2026-85706 est activement exploitée.
KEV ✓ EPSS 0.97 CVE-2026-85706 GitLab veřejná správa FR CZ NL CA US
SPOJENO PŘES CVE Hackers exploit Citrix NetScaler zero-day to deploy web shells
Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]
KEV ✓ EPSS 0.78 CVE-2026-88772 Citrix US
SPOJENO PŘES CVE JFrog: rilevato sfruttamento in rete della CVE-2026-82329 relativa ad Artifactory
Rilevato lo sfruttamento attivo in rete della CVE-2026-82329 con gravità "critica", relativa al prodotto JFrog Artifactory. Tale vulnerabilità potrebbe consentire a un utente malintenzionato remoto non autenticato di eludere i controlli di accesso e ottenere privilegi amministrativi sui sistemi interessati.
KEV ✓ EPSS 0.14 CVE-2026-82329 JFrog IT US CA
Fake iPhone Duo preorder scam triggers DarkSword attack
Apple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it. Most of what we found around the launch of the iPhone Duo and iPhone 18 Pro was familiar fraud. But one fake preorder page was different. The fake Apple-style page offers a $500 voucher and a ticking preorder deadline. Behind its Apple-style design and $500 voucher, the page uses the leaked DarkSword exploit chain to try to break into vulnerable iPhones. If it succeeds,…
Apple US
Apple patches CoreGraphics zero-day flaw exploited in attacks
Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
CVE-2025-14174 * CVE-2025-20701 * CVE-2025-24085 * CVE-2025-24200 * CVE-2025-24201 * CVE-2025-31200 * CVE-2025-31201 * CVE-2025-43529 * CVE-2026-20700 * Apple US