Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
EPSS < 0.01 CVE-2026-96183 US
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-102867 Microsoft US
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102866 Microsoft US
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-102865 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS < 0.01 CVE-2026-102864 Microsoft US
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102863 Microsoft US
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102862 Microsoft US
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102861 Microsoft US
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-102860 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS < 0.01 CVE-2026-102859 Microsoft US
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102858 Microsoft US
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102857 Microsoft US
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102856 Microsoft US
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102855 Microsoft US
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-96956 US
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-70098 US
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102238 US
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102235 US
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-102234 US
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
EPSS < 0.01 CVE-2026-102233 US
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
EPSS < 0.01 CVE-2026-102232 US
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
EPSS < 0.01 CVE-2026-102231 US
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-102229 US
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
EPSS < 0.01 CVE-2026-102227 US
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-108468 US
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-108457 Microsoft US
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-108400 Microsoft US
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-105728 US
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-105727 Microsoft US
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-105725 US
Starting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the [Resilient File System (ReFS)](https://learn.microsoft.com/windows-server/storage/refs/refs-overview). This change is not enable by default until 2027. Please see [Hardening changes for ReFS volumes on removable media](https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/10/hardening-changes-for-refs-volumes-on-removable-media) for more information.
Microsoft US
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-103572 US
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102850 Microsoft US
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-102849 Microsoft US
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [...]
CVE-2026-44756 * CVE-2026-58231 * CVE-2026-89108 * CVE-2026-89110 * CVE-2026-89111 * SAP US
Serial number: AV26-1032 Date: October 13, 2026 As of October 9, 2026, JetBrains is affected by a vulnerability in the following product: Exposed Prior to 1.5.1 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. JetBrains Fixed security issues
JetBrains CA
Serial number: AV26-1031 Date: October 13, 2026 As of October 12, 2026, Progress is affected by vulnerabilities in the following product: MarkLogic Server Prior to 11.3.7 Prior to 12.1.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Progress Customer Community Progress Trust Center
Progress CA
Serial number: AV26-1030 Date: October 13, 2026 As of October 13, 2026, SAP_SE is affected by vulnerabilities in the following products: SAP Cloud SDK Prior to 0.45.2 SAP Commerce Cloud (OOTB Code) Version COM_CLOUD 2211-JDK21 SAP Manufacturing Integration and Intelligence (Configuration Service) Version 15.5 Version XMII 15.4 SAP NetWeaver Visual Composer Version VC70RUNTIME 7.50 SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) Versions HDB 2.00, KRNL64UC 7.53, WEBDISP 7…
SAP CA
Serial number: AV26-1029 Date: October 13, 2026 As of October 12, 2026, MikroTik is affected by a vulnerability in the following product: RouterOS Prior to 7.24.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. MikroTik Downloads MikroTik Community Forum
MikroTik CA
Rilasciati aggiornamenti di sicurezza per sanare 31 vulnerabilità, di cui 5 con gravità "critica" e 24 con gravità "alta", in Progress MarkLogic Server, nota piattaforma di database NoSQL progettata per archiviare, integrare, gestire e ricercare grandi volumi di dati eterogenei all'interno di un unico sistema.
EPSS 0.01 a dalších 12 CVE-2026-85959 CVE-2026-85960 CVE-2026-85961 CVE-2026-85962 CVE-2026-85963 CVE-2026-85964 CVE-2026-85965 CVE-2026-85966 CVE-2026-85968 CVE-2026-85969 CVE-2026-85970 CVE-2026-85971 CVE-2026-85972 CVE-2026-85973 CVE-2026-85974 CVE-2026-85975 CVE-2026-9191 Progress Software IT
Aggiornamenti di sicurezza sanano alcune vulnerabilità, di cui 2 con gravità “alta”, in Craft CMS, piattaforma open source per lo sviluppo e l’amministrazione di siti web e applicazioni digitali. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eludere i meccanismi di sicurezza e di eseguire codice arbitrario sui sistemi interessati.
EPSS < 0.01 CVE-2026-109305 CVE-2026-109308 Craft CMS IT
Risolte due vulnerabilità, di cui una con gravità "critica" e una con gravità "alta", presenti nella libreria Neo4j GraphQL. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eludere dei meccanismi di sicurezza, accedere ad informazioni sensibili e manipolare i dati presenti sui sistemi interessati.
EPSS < 0.01 CVE-2026-92681 CVE-2026-92682 Neo4j IT
Serial number: AV26-1028 Date: October 13, 2026 As of October 12, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Prior to 19.2.8 Prior to 19.3.5 Prior to 19.4.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 GitLab release notes | GitLab Docs
GitLab CA
Serial number: AV26-1027 Date: October 13, 2026 As of October 6, 2026, Dell is affected by vulnerabilities in the following products: Command | Configure (DCC) Prior to 5.2.3.35 Dell Container Storage Modules (CSM) Prior to 1.18.0 Dell OpenManage Integration with Microsoft Windows Admin Center (OMIMSWAC) Prior to 3.7.0 Dell Policy Manager for Secure Connect Gateway - Appliance Prior to 5.36.00.16 Dell System Update (DSU) Prior to 2.3.0.0 The Cyber Centre encourages users and administrators to…
Dell CA
[VDE-2026-109] Bender is publishing this advisory to inform customers about a security vulnerability in the Customer&Partner platform. The issue allows any account to view the roles of other users. Bender has analyzed the weakness and determined that user information and user credentials are not affected. Bender considers the weakness to be of medium risk which should be patched.
EPSS < 0.01 CVE-2026-94410 Bender DE
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SWIFI-SE2KIC firmware <=2.0.22 (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) CVSS Vendor Equipment v3 6.2 Swann Communications SWIFI-SE2KIC firmware 1 Vulnerability Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Commercial Facilities…
EPSS < 0.01 CVE-2026-107605 CVE-2026-107606 CVE-2026-107607 Swann Communications US
Siemens ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità nei propri prodotti, di cui 4 con gravità “critica” e 14 con gravità “alta”.
EPSS < 0.01 a dalších 1 CVE-2026-102074 CVE-2026-102075 CVE-2026-102076 CVE-2026-44415 CVE-2026-59241 CVE-2026-63350 CVE-2026-63353 CVE-2026-63354 CVE-2026-72895 CVE-2026-78556 CVE-2026-78557 CVE-2026-85114 CVE-2026-89196 CVE-2026-89197 CVE-2026-89198 CVE-2026-89199 CVE-2026-89201 Siemens IT
SQL Injection vulnerability (CVE-2026-63316) has been found in Payload CMS software.
EPSS < 0.01 CVE-2026-63316 Payload CMS PL
Rilevate due nuove vulnerabilità con gravità “alta” in alcuni prodotti Schneider Electric.
EPSS < 0.01 CVE-2026-102250 CVE-2026-96434 Schneider Electric IT
GitLab har publicerat säkerhetsuppdateringar för flera sårbarheter i GitLab Community Edition (CE) och Enterprise Edition (EE). [1]
GitLab SE
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS. De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Manipulatie van gegevens - Omzeilen van een beveiligingsmaatregel - (Remote) code execution (root/admin rechten) - Toegang tot systeemgegevens - Toegang tot gevoelige gegevens - Verhogen van rechten De…
Siemens NL
Nell’ambito del Security Patch Day di ottobre, SAP rilascia aggiornamenti di sicurezza per risolvere molteplici nuove vulnerabilità, di cui 4 con gravità "critica" e 3 con gravità "alta".
EPSS < 0.01 CVE-2026-58249 CVE-2026-89107 CVE-2026-89108 CVE-2026-89110 CVE-2026-89111 CVE-2026-89113 CVE-2026-89120 SAP IT
Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-109390 - già sanata dal vendor - presente in AnyDesk per sistemi Linux, nota soluzione per l’accesso, il supporto e il controllo remoto dei dispositivi tramite connessioni di rete. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un attaccante remoto non autenticato di eseguire codice arbitrario con privilegi elevati sui sistemi interessati.
EPSS 0.02 CVE-2026-109390 AnyDesk IT
Cross-Site Scripting in the YouMind web application Tue, 10/13/2026 - 09:48 Aviso Affected Resources YouMind web application. Description INCIBE has coordinated the publication of a medium severity vulnerability affecting the YouMind web application, an AI-powered creative workspace and study environment. The vulnerability was discovered by Miguel Jiménez Cámara. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type: CVE-2026-96535…
EPSS < 0.01 CVSS 5.1 CVE-2026-96535 YouMind ES
CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key. Revised on 2026-10-13 00:00:00
CVSS 5.3 Fortinet US
CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSS 7.7 Fortinet US
CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSS 4.8 Fortinet US
CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on 2026-10-13 00:00:00
CVSS 7.9 Fortinet US
CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00
CVSS 9.6 Fortinet US
CVSSv3 Score: 4.9 An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via the Identify Provider name field. Revised on 2026-10-13 00:00:00
CVSS 4.9 Fortinet US