Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118619.
EPSS 0.01 CVSS 8.8 CVE-2026-118619 Ultralytics US
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-118601.
EPSS 0.00 CVSS 6.3 CVE-2026-118601 Alpine US
This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118602.
EPSS 0.00 CVSS 7.8 CVE-2026-118602 Alpine US
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-118603.
EPSS 0.00 CVSS 8.0 CVE-2026-118603 Alpine US
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118604.
EPSS 0.00 CVSS 6.8 CVE-2026-118604 Alpine US
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-118605.
EPSS 0.00 CVSS 8.0 CVE-2026-118605 Alpine US
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118606.
EPSS 0.00 CVSS 8.8 CVE-2026-118606 Alpine US
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118607.
EPSS 0.01 CVSS 6.8 CVE-2026-118607 Alpine US
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.5. The following CVEs are assigned: CVE-2026-118608.
EPSS 0.00 CVSS 3.5 CVE-2026-118608 Alpine US
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118609.
EPSS 0.00 CVSS 6.8 CVE-2026-118609 Alpine US
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118610.
EPSS 0.00 CVSS 8.8 CVE-2026-118610 Alpine US
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118611.
EPSS 0.00 CVSS 6.8 CVE-2026-118611 Alpine US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1, CVEs: CVE-2023-4863, CVE-2026-16436, CVE-2026-16437, CVE-2026-16438, Summary: Out-of-bounds Write, Weak Password Recovery Mechanism for Forgotten Password, Incorrect Privilege Assignment Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026…
KEV ✓ EPSS 1.00 CVSS 9.1 CVE-2023-4863 CVE-2026-16436 CVE-2026-16437 CVE-2026-16438 Mitsubishi Electric výroba a průmysl FI US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598, Summary: Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions of EPICS Base are affected: EPICS Base release
EPSS 0.01 CVSS 9.8 CVE-2026-114595 CVE-2026-114596 CVE-2026-114597 CVE-2026-114598 EPICS výroba a průmysl FI US
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.7, CVEs: CVE-2026-111459, CVE-2026-111460, CVE-2026-111461, Summary: This security advisory addresses one vulnerability identified in Moxa Remote Connect Suite (MRC Client) and two vulnerabilities identified in the OnCell G3150A-LTE Series. CVE-2026-111459 - Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client) An improper certificate validation vulnerability…
EPSS 0.01 CVSS 7.7 CVE-2026-111459 CVE-2026-111460 CVE-2026-111461 Moxa FI CA
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: , Summary: The following updates are published: - iOS 27.2 and iPadOS 27.2 - iOS 26.7.2 and iPadOS 26.7.2 - iOS 18.7.11 and iPadOS 18.7.11 - macOS Golden Gate 27.2 - macOS Tahoe 26.7.2 - macOS Sequoia 15.8.2 - tvOS 27.2 - watchOS 27.2 - visionOS 27.2 - Safari 27.2 - tvOS 26.6.1 (no published CVE entries)
CVSS 8.8 Apple FI
CISA added CVE-2026-46300 to the Known Exploited Vulnerabilities catalog. Affected product: Linux Kernel. Remediation due date: 2026-10-31.
KEV ✓ EPSS 0.16 CVE-2026-46300 Linux US IT
Une vulnérabilité a été découverte dans Axis Camera Station Pro. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
EPSS 0.00 CVE-2026-63286 Axis FR
Une vulnérabilité a été découverte dans les produits Belden. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Belden FR
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Mozilla FR
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
EPSS 0.01 CVE-2026-20942 CVE-2026-62765 CVE-2026-88078 CVE-2026-96196 Microsoft FR
De multiples vulnérabilités ont été découvertes dans Mitel OpenScape Endpoint Management. Elles permettent à un attaquant de provoquer une élévation de privilèges et un contournement de la politique de sécurité.
Mitel FR
De multiples vulnérabilités ont été découvertes dans Metabase. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Metabase FR
De multiples vulnérabilités ont été découvertes dans Docker Desktop. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
EPSS 0.01 CVE-2026-114409 CVE-2026-99999 Docker FR
Une vulnérabilité a été découverte dans Samba. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
EPSS 0.01 CVE-2026-109411 Samba FR
De multiples vulnérabilités ont été découvertes dans les produits Veeam. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
EPSS 0.00 CVE-2025-64394 CVE-2026-105477 CVE-2026-106076 CVE-2026-106077 CVE-2026-106078 CVE-2026-107671 CVE-2026-108140 CVE-2026-108141 CVE-2026-108142 Veeam FR
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Google FR
Une vulnérabilité a été découverte dans CPython. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
EPSS 0.00 CVE-2026-103995 CPython FR
Serial number: AV26–697 Date: July 14, 2026 Updated: October 27, 2026 On July 14, 2026, Adobe published security advisories to address critical vulnerabilities in the following products: Adobe After Effects - version 25.6.5 and prior Adobe After Effects - version 26.2.1 and prior Adobe Animate 2023 - version 23.0.15 and prior Adobe Animate 2024 - version 24.0.13 and prior Adobe Audition - version 25.6.4 and prior Adobe Audition - version 26.0 and prior Adobe Bridge - version 15.1.5 (LTS) and…
KEV ✓ EPSS 0.45 CVE-2026-48356 Adobe Magento CA US
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]
Serial Number: AV26-1091 Date: October 27, 2026 As of October 27, 2026, Hitachi is affected by vulnerabilities in the following products: HiRDB Server Version 10 Multiple versions HiRDB Server Version 9 Multiple versions HiRDB Server Version 9(32) Multiple versions HiRDB Server with Additional Function Version 9 Multiple versions HiRDB Server with Additional Function Version 9(32) Multiple versions JP1/Automatic Job Management System 3 - Agent Multiple versions JP1/Automatic Job Management…
Hitachi CA
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]
Tailscale US
Rilevate 10 nuove vulnerabilità, di cui 1 con gravità “alta”, in Nextcloud Server, piattaforma di cloud storage open source. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.00 CVE-2026-77167 Nextcloud IT
Serial number: AV26-1090 Date: October 27, 2026 As of October 26, 2026, Johnson Controls is affected by vulnerabilities in the following product: Kantech Entrapass Prior to 9.20 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Johnson Controls has confirmed two vulnerabilities impacting Kantech Entrapass (PDF) Johnson Controls Product Security Advisories
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-62765 Microsoft US
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-96196 Microsoft US
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVSS 4.3 CVE-2026-88078 Microsoft US
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-20942 Microsoft US
Serial number: AV26-1088 Date: October 27, 2026 As of October 26, 2026, Esri is affected by vulnerabilities in the following product: ArcGIS Server Prior to 12.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. October 2026 ArcGIS Security Bulletin Esri Security Advisories
Esri CA
Stored Cross-Site Scripting vulnerability (CVE-2026-105987) has been found in KGS Software tia Viewer software.
EPSS 0.00 CVE-2026-105987 KGS Software PL
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
Rilasciati aggiornamenti di sicurezza che sanano molteplici vulnerabilità, di cui 32 con gravità “critica” e 31 con gravità “alta”, in HPE Aruba Networking AOS-8 e AOS-10, sistemi operativi di rete per la gestione delle infrastrutture Wi-Fi aziendali.
HPE IT
Unrestricted Upload of File in PuMuKIT application Tue, 10/27/2026 - 14:15 Aviso Affected Resources PuMuKIT versions prior to 5.0.8. Description INCIBE has coordinated the publication of a high severity vulnerability affecting PuMuKIT application, an Open Source Video Platform. The vulnerability was discovered by David Herrero de la Peña. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type: CVE-2026-4337: CVSS v4.0: 8.8 | CVSS AV…
EPSS 0.00 CVSS 8.8 CVE-2026-4337 PuMuKIT ES
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-107145 to CVE-2026-107147) found in twofactor_gauthenticator plugin for Roundcube.
EPSS 0.00 CVE-2026-107145 CVE-2026-107147 Roundcube twofactor_gauthenticator PL
Apple ha rilasciato aggiornamenti di sicurezza per risolvere 327 nuove vulnerabilità, di cui 20 con gravità “critica” e 231 con gravità “alta”, nei prodotti iOS, iPadOS, macOS Golden Gate, macOS Tahoe, macOS Sequoia, tvOS, watchOS, visionOS e Safari.
Apple IT
Multiple vulnerabilities in Sisense’s Cloud BI Platform Tue, 10/27/2026 - 09:49 Aviso Affected Resources Sisense Cloud BI Platform (SaaS). Description INCIBE has coordinated the publication of two high severity vulnerabilities affecting Sisense’s Cloud BI Platform, a cloud-based business intelligence and data analytics platform. The vulnerabilities were discovered by Miguel Jiménez Cámara. The following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type have been assigned to…
EPSS 0.00 CVSS 8.3 CVE-2026-117493 CVE-2026-117494 Sisense ES
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]
KEV ✓ EPSS 1.00 CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 IceWarp PHP veřejná správa US IT
Apple heeft kwetsbaarheden verholpen in iOS en iPadOS. De kwetsbaarheden betreffen diverse beveiligingsproblemen zoals onvoldoende validatie van symbolische links, onjuiste permissiecontroles, out-of-bounds lees- en schrijffouten, use-after-free fouten, integer overflows, race conditions, type confusion, en logische fouten in state management. Deze kunnen leiden tot ongeautoriseerde toegang tot gevoelige gebruikersdata, geheugenbeschadiging, onverwachte systeem- of applicatiecrashes, privilege…
Apple NL
Apple heeft meerdere kwetsbaarheden verholpen in macOS, met name in de versies Golden Gate 27.2, Sequoia 15.8.2, Tahoe 26.7.2 en Monterey 12.4. De kwetsbaarheden betroffen diverse beveiligingsaspecten binnen macOS, waaronder onvoldoende validatie van symbolische links (symlinks), onjuiste permissiecontroles, onvolledige autorisatiemechanismen, en fouten in geheugenbeheer zoals out-of-bounds reads en writes, use-after-free, buffer overflows, en race conditions. Deze fouten konden door lokale of…
Apple NL
Ubiquiti ha rilasciato aggiornamenti di sicurezza per sanare 4 vulnerabilità con gravità “alta” in diversi prodotti. Tali vulnerabilità potrebbero consentire a un utente malintenzionato di eseguire codice arbitrario sui sistemi interessati, di ottenere privilegi elevati o di compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.00 CVE-2026-116836 CVE-2026-116837 CVE-2026-116838 CVE-2026-116839 Ubiquiti IT
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-114551.
CVSS 5.9 CVE-2026-114551 MailEnable US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-114552.
CVSS 6.5 CVE-2026-114552 MailEnable US
Classification: Critical, Solution: Unavailable, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073, Summary: Fortinet is currently investigating the impact of these CVEs over Fortinet Products. Products under investigation: FortiOS Products confirmed NOT impacted: FortiManager FortiAnalyzer FortiClient EMS FortiAuthenticator…
KEV ✓ EPSS 0.83 CVSS 9.8 CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106070 CVE-2026-106071 CVE-2026-106072 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497 Fortinet Node.js FI US
Splunk investigated and determined which products were affected by the compromised eMudhra Intermediate Certificate Authorities.
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Microsoft FR
De multiples vulnérabilités ont été découvertes dans les produits Moxa. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et une atteinte à la confidentialité des données.
EPSS 0.01 CVE-2026-111459 CVE-2026-111460 CVE-2026-111461 CVE-2026-111548 Moxa FR
De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
EPSS 0.00 CVE-2026-114601 CVE-2026-67400 CVE-2026-77167 CVE-2026-77171 CVE-2026-77172 CVE-2026-77173 Nextcloud FR
De multiples vulnérabilités ont été découvertes dans Mozilla Firefox. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
EPSS 0.00 CVE-2026-116631 CVE-2026-116632 Mozilla FR
De multiples vulnérabilités ont été découvertes dans Tenable Network Monitor. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Tenable FR
De multiples vulnérabilités ont été découvertes dans GLPI. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, une injection SQL (SQLi) et une injection de code indirecte à distance (XSS).
GLPI FR