Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. [...]
CVE-2021-21551 * CVE-2026-22769 * CVE-2026-54472 * CVE-2026-61421 * CVE-2026-63688 * CVE-2026-63692 * CVE-2026-67269 * CVE-2026-67273 * Dell US
DESCRIERE Experții în securitate cibernetică au descoperit o vulnerabilitate critică, CVE-...
Fortinet RO
Aggiornamenti di sicurezza sanano diverse vulnerabilità presenti in Apache HTTP Server, di cui 3 con gravità "critica" e 13 con gravità "alta".
EPSS 0.01 CVE-2026-46729 CVE-2026-47360 CVE-2026-48005 CVE-2026-56153 CVE-2026-56154 CVE-2026-56449 CVE-2026-57941 CVE-2026-59685 CVE-2026-59797 CVE-2026-63045 CVE-2026-63292 CVE-2026-63686 CVE-2026-63718 CVE-2026-73636 CVE-2026-73637 CVE-2026-93546 Apache IT
Local Argument Injection vulnerability (CVE-2026-91784) has been found in cjbassi/gotop software.
EPSS < 0.01 CVE-2026-91784 gotop PL
Multiple vulnerabilities in the Repasat application Fri, 10/02/2026 - 09:52 Aviso Affected Resources Repasat application. Description INCIBE has coordinated the publication of 15 medium-severity vulnerabilities affecting the Repasat application, a business management software programme that enables all business operations to be consolidated onto a single platform. The vulnerabilities were discovered by David Padilla Alvarado. These vulnerabilities have been assigned the following codes, CVSS v4…
EPSS 0.02 CVE-2026-59668 CVE-2026-59669 CVE-2026-59670 CVE-2026-59671 CVE-2026-59672 CVE-2026-59673 CVE-2026-59674 CVE-2026-59675 CVE-2026-59676 CVE-2026-59677 CVE-2026-59678 CVE-2026-59679 CVE-2026-59680 CVE-2026-59681 CVE-2026-59682 CVE-2026-59683 REPASAT ES
Rilevato lo sfruttamento attivo in rete delle vulnerabilità CVE-2026-102489 e CVE-2026-102490 - già sanate dal vendor - relative a Zammad, soluzione open source di help desk, ticketing e customer support. Qualora le due vulnerabilità fossero sfruttate in sequenza nell'ambito di una catena di attacco, un attore malevolo potrebbe dapprima ottenere l'esecuzione di codice come utente "zammad" e successivamente elevare i propri privilegi fino a "root" sul sistema interessato.
KEV ✓ EPSS 0.22 CVE-2026-102489 CVE-2026-102490 Zammad IT US NL
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-90443, CVE-2026-90444, CVE-2026-90445, CVE-2026-90446, CVE-2026-90447, CVE-2026-90448, CVE-2026-90449, CVE-2026-90450, CVE-2026-90451, CVE-2026-90452, CVE-2026-90453, CVE-2026-90454, CVE-2026-90455, CVE-2026-90456, CVE-2026-90457, CVE-2026-101104, CVE-2026-96613, CVE-2026-64892, CVE-2026-15952, CVE-2026-15953 (+9 other associated CVEs), Summary: CISA released six Industrial Control…
CVSS 9.8 ABB Johnson Controls Monta Armatura LLC FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.4, CVEs: CVE-2026-103655, Summary: MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had…
EPSS < 0.01 CVSS 9.4 CVE-2026-103655 MISP FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.4, CVEs: CVE-2026-93495, CVE-2026-14157, CVE-2026-13313, Summary: CVE-2026-93495 (CVSS: 7.0): ASUS has released a BIOS update for the affected motherboard models listed below and strongly recommends updating to the latest version to ensure optimal protection. This update addresses a security vulnerability related to improper initialization in certain ASUS motherboards. If exploited, the issue could…
EPSS 0.01 CVSS 9.4 CVE-2026-13313 CVE-2026-14157 CVE-2026-93495 ASUS FI IT
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.5, CVEs: CVE-2026-103245, CVE-2026-103246, CVE-2026-103247, CVE-2026-103248, CVE-2026-103249, CVE-2026-103250, CVE-2026-103251, CVE-2026-103252, CVE-2026-103253, CVE-2026-103254, CVE-2026-103255, CVE-2026-103256, CVE-2026-103257, CVE-2026-103258, CVE-2026-103259, CVE-2026-103260, Summary: CVE-2026-103245 (CVSS: 6.9): n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1…
EPSS < 0.01 CVSS 8.5 CVE-2026-103245 CVE-2026-103246 CVE-2026-103247 CVE-2026-103248 CVE-2026-103249 CVE-2026-103250 CVE-2026-103251 CVE-2026-103252 CVE-2026-103253 CVE-2026-103254 CVE-2026-103255 CVE-2026-103256 CVE-2026-103257 CVE-2026-103258 CVE-2026-103259 CVE-2026-103260 n8n FI
CISA added CVE-2026-102489 to the Known Exploited Vulnerabilities catalog. Affected product: Zammad GmbH Zammad. Remediation due date: 2026-10-05.
KEV ✓ EPSS 0.22 CVE-2026-102489 Zammad GmbH US
CISA added CVE-2026-102490 to the Known Exploited Vulnerabilities catalog. Affected product: Zammad GmbH Zammad. Remediation due date: 2026-10-05.
KEV ✓ EPSS 0.11 CVE-2026-102490 Zammad GmbH US
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
IBM FR
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Microsoft FR
De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
VMware FR
De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
EPSS 0.01 a dalších 3 CVE-2026-47360 CVE-2026-48005 CVE-2026-56153 CVE-2026-56154 CVE-2026-56449 CVE-2026-57941 CVE-2026-58415 CVE-2026-59685 CVE-2026-59797 CVE-2026-63045 CVE-2026-63292 CVE-2026-63686 CVE-2026-63718 CVE-2026-73636 CVE-2026-73637 CVE-2026-79768 CVE-2026-93546 Apache FR
De multiples vulnérabilités ont été découvertes dans Tenable Nessus. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
EPSS < 0.01 CVE-2026-103946 CVE-2026-103947 CVE-2026-103948 CVE-2026-103950 CVE-2026-103951 CVE-2026-103952 CVE-2026-103953 CVE-2026-103954 CVE-2026-103955 Tenable FR
Serial number: AV26-988 Date: October 1, 2026 As of September 30, 2026, Kiteworks is affected by vulnerabilities in the following products: Kiteworks Core Prior to 9.5.0 Prior to 9.5.1 Kiteworks Email Protection Gateway (EPG) Prior to 9.5.0 Prior to 9.5.1 Kiteworks Secure Data Forms (SDF) Prior to 9.5.0 Prior to 9.5.1 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Kiteworks Security Advisories
Kiteworks CA
Serial number: AV26-987 Date: October 1, 2026 As of October 1, 2026, Fortra is affected by a vulnerabilities in the following product: BoKS Manager boks-server Prior to 8.1.0.24 Prior to 9.0.0.7 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Heap overflow in KSL checksum initialization Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability Product…
Fortra CA
Serial number: AV26-986 Date: October 1, 2026 As of October 1, 2026, MISP is affected by vulnerabilities in the following product: MISP Prior to 2.5.48 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Delegation requests stay bound to the event they were authorised for A nested model alias key no longer selects the row a save targets Tag collection saves no longer write sibling user/org rows Refuse a…
MISP CA
Serial number: AV26-985 Date: October 1, 2026 As of October 1, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 1.123.80 Prior to 2.39.6 Prior to 2.40.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Community Package Install Validation Bypass via PubSub in Queue Mode Deployments Dynamic Credentials Authorize Endpoint Leaks Session Token to Attacker-Controlled Resolver…
n8n CA
Serial number: AV26-984 Date: October 1, 2026 As of September 29, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 154.0.8037.92/.93 (Windows/Mac), and 54.0.8037.92 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop
Google CA
Serial number: AV26-983 Date: October 1, 2026 As of September 30, 2026, CODESYS is affected by vulnerabilities in the following products: CODESYS Control RTE (SL) Prior to 3.5.22.40 CODESYS Control RTE (for Beckhoff CX) SL Prior to 3.5.22.40 CODESYS Control Win (SL) Prior to 3.5.22.40 CODESYS Control for BeagleBone SL Prior to 4.23.0.0 CODESYS Control for IOT2000 SL Prior to 4.23.0.0 CODESYS Control for Linux ARM SL Prior to 4.23.0.0 CODESYS Control for Linux SL Prior to 4.23.0.0 CODESYS…
CODESYS CA
Serial number: AV26-982 Date: October 1, 2026 As of September 29, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following products: Instant ON Prior to or equal to 3.4.1.0 HPE Telco Service Orchestrator Prior to v5.7.1 HPE Compute Scale-up Server 3200 Prior to 1.77.30 HPE Compute Scale-up Server 3250 Prior to 1.03.38 HPE Superdome Flex 280 Server Prior to 2.17.03 HPE Superdome Flex Server Prior to 4.17.03 HPE Unified OSS Console (UOC) UOC Prior to 3.1.22 The Cyber…
Il team di sviluppo n8n-io ha rilevato nuove vulnerabilità, di cui 11 con gravità "alta", che interessano la piattaforma open-source per l'automazione dei workflow n8n. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un attaccante di ottenere informazioni riservate, eludere misure di sicurezza e meccanismi di autenticazione o eseguire codice arbitrario sui sistemi interessati.
EPSS < 0.01 CVE-2026-103246 CVE-2026-103248 CVE-2026-103250 CVE-2026-103251 CVE-2026-103252 CVE-2026-103253 CVE-2026-103254 CVE-2026-103255 CVE-2026-103256 CVE-2026-103257 CVE-2026-103259 n8n IT
Serial number: AV26-981 Date: October 1, 2026 As of September 30, 2026, WatchGuard is affected by a vulnerability in the following product: Fireware OS Prior to 12.12.3 Prior to 12.5.21 Prior to 2026.2.3 Prior to 2026.3.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CVE-2026-86134 — Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service WatchGuard Security…
EPSS < 0.01 CVE-2026-86134 WatchGuard CA
Serial number: AV26-980 Date: October 1, 2026 As of September 29, 2026, OpenSSL is affected by vulnerabilities in the following product: OpenSSL Prior to 1.0.2zs Prior to 1.1.1zj Prior to 3.0.23 Prior to 3.4.8 Prior to 3.5.9 Prior to 3.6.5 Prior to 4.0.3 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Vulnerabilities | OpenSSL Library
OpenSSL CA
Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. [...]
Serial number: AV26-979 Date: October 1, 2026 As of September 30, 2026, JetBrains is affected by vulnerabilities in the following products: Hub Prior to 2026.2.52366 IntelliJ IDEA Prior to 2026.2.3 Rider Prior to 2026.2.1 TeamCity Prior to 2026.2, 2026.1.4 and 2025.11.8 YouTrack Prior to 2026.2.18991 and 2026.2.19422 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Fixed security issues
JetBrains CA
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm CVSS Vendor Equipment Vulnerabilities v3 8.8 CISA CISA Malcolm Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF), Authentication Bypass by Spoofing, Missing Authorization,…
EPSS < 0.01 CVSS 8.8 CVE-2026-90443 CVE-2026-90444 CVE-2026-90445 CVE-2026-90446 CVE-2026-90447 CVE-2026-90448 CVE-2026-90449 CISA energetika vodárenství US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64893) EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b24 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64893)…
EPSS < 0.01 CVSS 5.4 CVE-2026-64893 Johnson Controls výroba a průmysl veřejná správa doprava energetika US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files. The following versions of ABB Protection and Control IED Manager PCM600 are affected: Protection and Control IED Manager PCM600 <=2.14 (CVE-2026-15952, CVE-2026-15953) CVSS Vendor Equipment Vulnerabilities v3 6.4 ABB ABB Protection and Control IED Manager PCM600 Incorrect Permission Assignment for Critical Resource, Improper Limitation of a Pathname to a…
EPSS < 0.01 CVSS 6.4 CVE-2026-15952 CVE-2026-15953 ABB energetika US
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. The following versions of Meari IoT Cloud Platform OpenAPI Service are affected: IoT Cloud Platform OpenAPI Service vers:all/* (CVE-2026-101104, CVE-2026-96613) CVSS Vendor Equipment Vulnerabilities v3 7.7 Meari Meari…
EPSS < 0.01 CVSS 7.7 CVE-2026-101104 CVE-2026-96613 Meari US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64892) EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64892) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64892) EasyIO Neo Series CW Controllers…
EPSS < 0.01 CVSS 3.5 CVE-2026-64892 Johnson Controls výroba a průmysl veřejná správa doprava energetika US
View CSAF Summary Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. The following versions of Monta monta.app are affected: monta.app vers:all/* (CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, CVE-2026-93474) CVSS Vendor Equipment Vulnerabilities v3 9.4 Monta Monta monta.app Missing Authentication for Critical Function, Improper…
EPSS < 0.01 CVSS 9.4 CVE-2026-93474 CVE-2026-95102 CVE-2026-97212 CVE-2026-97363 Monta energetika doprava US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. The following versions of Armatura LLC Armatura One are affected: Armatura One <4.7.2 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) Armatura One (USA) <4.6.1 (CVE-2023-46604, CVE-2026-94591, CVE-2026…
KEV ✓ · ransomware EPSS 1.00 CVSS 9.8 CVE-2023-46604 CVE-2026-94591 CVE-2026-94592 CVE-2026-94593 CVE-2026-94594 Armatura LLC Apache telekomunikace výroba a průmysl energetika doprava US
Serial Number: AV26-978 Date: October 1, 2026 As of September 30, 2026, Cisco is affected by a vulnerability in the following product: Cisco Catalyst SD-WAN Manager Versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 et 26.2.1 On September 30, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76504 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply…
KEV ✓ EPSS 0.39 CVSS 9.8 CVE-2026-76504 Cisco CA HU FI FR US IT
Aggiornamenti di sicurezza risolvono 114 vulnerabilità, di cui 78 con gravità "alta", che interessano i driver GPU e il software vGPU di NVIDIA.
NVIDIA IT
Apple heeft een kwetsbaarheid verholpen in CoreGraphics op iOS, iPadOS en macOS. De kwetsbaarheid betreft een out-of-bounds write in de CoreGraphics component. Een aanvaller kan deze kwetsbaarheid misbruiken door speciaal vervaardigde bestanden te verwerken, wat kan leiden tot het uitvoeren van willekeurige code. Deze kwetsbaarheid is gebruikt in gerichte aanvallen op iOS-versies vóór iOS 27. De kwetsbaarheid komt voor in meerdere Apple besturingssystemen.
Apple NL
A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézete riasztást ad ki a széles körben használt WordPress tartalomkezelő rendszer (Core) aktívan kihasznált sérülékenysége miatt. A CISA 2026. szeptember 25-én vette fel a KEV-katalógusába. A hiba hitelesítés nélkül kihasználható, és bizonyos feltételek teljesülése esetén távoli kódfuttatáshoz vezethet. A CVE-2026-87902 azonosítón nyomon követett, magas súlyosságú sérülékenység önmagában helyi fájl beágyazását […]
KEV ✓ EPSS 0.96 CVSS 9.2 CVE-2026-87902 WordPress HU US FI CA NL FR
JetBrains ha rilasciato aggiornamenti di sicurezza che sanano molteplici vulnerabilità, tra cui 9 con gravità "alta" nei prodotti YouTrack, Hub, IntelliJ IDEA e TeamCity.
EPSS < 0.01 CVE-2026-100253 CVE-2026-100254 CVE-2026-100255 CVE-2026-100256 CVE-2026-100262 CVE-2026-100266 CVE-2026-100268 CVE-2026-100273 CVE-2026-100277 JetBrains IT
Aggiornamenti di sicurezza risolvono 2 vulnerabilità, di cui 1 con gravità "critica" e 1 con gravità "alta", in CPython, implementazione di riferimento open source del linguaggio di programmazione Python. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato remoto non autenticato di eludere i meccanismi di sicurezza o di compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.01 CVSS 9.2 CVE-2026-19445 CVE-2026-19553 Python CPython IT FI FR
Multiple vulnerabilities in Entradium by Crocantickets Thu, 10/01/2026 - 10:09 Aviso Affected Resources Entradium. Description INCIBE has coordinated the disclosure of four medium-severity vulnerabilities affecting Entradium by Crocantickets, event management software. The vulnerabilities were discovered by Cosme Vázquez Tomé.These vulnerabilities have been assigned the following identifiers, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type for each vulnerability:CVE-2026-7173:…
EPSS < 0.01 CVSS 4.8 CVE-2026-7173 CVE-2026-7174 CVE-2026-7175 CVE-2026-7176 Crocantickets ES
Aggiornamenti di sicurezza risolvono molteplici vulnerabilità, di cui 4 con gravità "alta", in MISP, nota piattaforma collaborativa open source per la condivisione e l'analisi di informazioni sulle minacce informatiche.
EPSS < 0.01 CVE-2026-103235 CVE-2026-103237 CVE-2026-103239 CVE-2026-103321 MISP IT
[VDE-2025-102] Multiple WAGO devices are affected by a vulnerability in the dynamic creation of BACnet File Objects. The object name is used as a file path without sufficient validation and is not restricted to the intended directory, so relative paths can be used to reach files elsewhere in the file system.
EPSS 0.01 CVE-2025-41753 WAGO DE
[VDE-2025-081] Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are
EPSS < 0.01 CVE-2025-41700 CVE-2025-41738 CVE-2025-41739 WAGO CODESYS DE
CVSSv3 Score: 9.8 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.This has been reported to be exploited in the wild, customers are urged to apply the workaround below. Revised on 2026-10-01 00:00:00
CVSS 9.8 US
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-50375.
EPSS < 0.01 CVSS 8.8 CVE-2026-50375 Microsoft US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.2, CVEs: CVE-2026-86134, CVE-2026-13046, CVE-2026-13224, CVE-2026-18105, CVE-2026-18145, CVE-2026-81433, CVE-2026-86101, CVE-2026-86104, CVE-2026-86105, CVE-2026-86128, CVE-2026-86131, CVE-2026-86132, CVE-2026-86133, CVE-2026-86136, CVE-2026-90441, Summary: CVE-2026-86134 (CVSS: 8.7): A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote,…
EPSS < 0.01 CVSS 9.2 CVE-2026-13046 CVE-2026-13224 CVE-2026-18105 CVE-2026-18145 CVE-2026-81433 CVE-2026-86101 CVE-2026-86104 CVE-2026-86105 CVE-2026-86128 CVE-2026-86131 CVE-2026-86132 CVE-2026-86133 CVE-2026-86134 CVE-2026-86136 CVE-2026-90441 WatchGuard FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.2, CVEs: CVE-2026-77185, CVE-2026-93994, CVE-2026-93995, CVE-2026-93996, CVE-2026-94002, CVE-2026-94053, CVE-2026-94029, CVE-2026-94052, CVE-2026-102509, CVE-2026-102510, CVE-2026-102511, CVE-2026-102508, Summary: CVE-2026-77185 (CVSS:9.1): Apache MINA SSHD: Asynchronous authentication can bypass signature verification CVE-2026-93994 (CVSS:8.1): Apache MINA SSHD: Repeated-publickey policy bypass on…
EPSS < 0.01 CVSS 9.2 CVE-2026-102508 CVE-2026-102509 CVE-2026-102510 CVE-2026-102511 CVE-2026-77185 CVE-2026-93994 CVE-2026-93995 CVE-2026-93996 CVE-2026-94002 CVE-2026-94029 CVE-2026-94052 CVE-2026-94053 Apache FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-62146, Summary: A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.
EPSS < 0.01 CVSS 7.8 CVE-2026-62146 Red Hat FI
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.1, CVEs: CVE-2026-103242, Summary: A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via…
EPSS < 0.01 CVSS 7.1 CVE-2026-103242 Red Hat FI
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 6.2, CVEs: CVE-2026-103388, CVE-2026-103389, CVE-2026-103321, Summary: CVE-2026-103388 (CVSS: 6.2): MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a…
EPSS < 0.01 CVSS 6.2 CVE-2026-103321 CVE-2026-103388 CVE-2026-103389 MISP FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.7, CVEs: CVE-2026-100266, Summary: In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
EPSS < 0.01 CVSS 7.7 CVE-2026-100266 JetBrains FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.9, CVEs: CVE-2026-100257, CVE-2026-100258, CVE-2026-100259, CVE-2026-100260, CVE-2026-100261, CVE-2026-100262, CVE-2026-100263, CVE-2026-100264, CVE-2026-100267, CVE-2026-100268, CVE-2026-100269, CVE-2026-100270, CVE-2026-100271, CVE-2026-100272, CVE-2026-100273, CVE-2026-100274, CVE-2026-100275, CVE-2026-100276, CVE-2026-100277, CVE-2026-100278, CVE-2026-100279, CVE-2026-100280, Summary: CVE-2026-100257 …
EPSS 0.01 CVSS 8.9 a dalších 5 CVE-2026-100262 CVE-2026-100263 CVE-2026-100264 CVE-2026-100267 CVE-2026-100268 CVE-2026-100269 CVE-2026-100270 CVE-2026-100271 CVE-2026-100272 CVE-2026-100273 CVE-2026-100274 CVE-2026-100275 CVE-2026-100276 CVE-2026-100277 CVE-2026-100278 CVE-2026-100279 CVE-2026-100280 JetBrains FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-100256, Summary: In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
EPSS < 0.01 CVSS 7.8 CVE-2026-100256 JetBrains FI