VIRY.CZRADAR
sektor
téma
typ textu
zrušit filtry

Výsledky hledání

typ: zranitelnost× v celém archivu zrušit filtry

4639 karet z 5137 položek · strana 43 z 78 CZ · EN/orig

Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.

Risolte vulnerabilità in Apache HTTP Server

Aggiornamenti di sicurezza sanano diverse vulnerabilità presenti in Apache HTTP Server, di cui 3 con gravità "critica" e 13 con gravità "alta".

EPSS 0.01 CVE-2026-46729 CVE-2026-47360 CVE-2026-48005 CVE-2026-56153 CVE-2026-56154 CVE-2026-56449 CVE-2026-57941 CVE-2026-59685 CVE-2026-59797 CVE-2026-63045 CVE-2026-63292 CVE-2026-63686 CVE-2026-63718 CVE-2026-73636 CVE-2026-73637 CVE-2026-93546 Apache IT

tg: zranitelnost

· CSIRT Itálie (ACN) · Risolte vulnerabilità in Apache HTTP Server

Múltiples vulnerabilidades en la aplicación de Repasat

Multiple vulnerabilities in the Repasat application Fri, 10/02/2026 - 09:52 Aviso Affected Resources Repasat application. Description INCIBE has coordinated the publication of 15 medium-severity vulnerabilities affecting the Repasat application, a business management software programme that enables all business operations to be consolidated onto a single platform. The vulnerabilities were discovered by David Padilla Alvarado. These vulnerabilities have been assigned the following codes, CVSS v4…

EPSS 0.02 CVE-2026-59668 CVE-2026-59669 CVE-2026-59670 CVE-2026-59671 CVE-2026-59672 CVE-2026-59673 CVE-2026-59674 CVE-2026-59675 CVE-2026-59676 CVE-2026-59677 CVE-2026-59678 CVE-2026-59679 CVE-2026-59680 CVE-2026-59681 CVE-2026-59682 CVE-2026-59683 REPASAT ES

tg: zranitelnost

· INCIBE-CERT · Múltiples vulnerabilidades en la aplicación de Repasat

SPOJENO PŘES CVE Zammad: rilevato sfruttamento in rete delle CVE-2026-102489 e CVE-2026-102490

Rilevato lo sfruttamento attivo in rete delle vulnerabilità CVE-2026-102489 e CVE-2026-102490 - già sanate dal vendor - relative a Zammad, soluzione open source di help desk, ticketing e customer support. Qualora le due vulnerabilità fossero sfruttate in sequenza nell'ambito di una catena di attacco, un attore malevolo potrebbe dapprima ottenere l'esecuzione di codice come utente "zammad" e successivamente elevare i propri privilegi fino a "root" sul sistema interessato.

KEV ✓ EPSS 0.22 CVE-2026-102489 CVE-2026-102490 Zammad IT US NL

tg: incident tg: zneužíváno tg: zranitelnost tp: AI

· CSIRT Itálie (ACN) · Zammad: rilevato sfruttamento in rete delle CVE-2026-102489 e CVE-2026-102490 · BleepingComputer · DIVD says Zammad zero-days enabled AI-driven network breach · NCSC-NL · NCSC-2026-0396 [1.00] [H/H] Kwetsbaarheden aangetroffen in Zammad

· zachyceno

CISA Releases Six Industrial Control Systems Advisories

Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-90443, CVE-2026-90444, CVE-2026-90445, CVE-2026-90446, CVE-2026-90447, CVE-2026-90448, CVE-2026-90449, CVE-2026-90450, CVE-2026-90451, CVE-2026-90452, CVE-2026-90453, CVE-2026-90454, CVE-2026-90455, CVE-2026-90456, CVE-2026-90457, CVE-2026-101104, CVE-2026-96613, CVE-2026-64892, CVE-2026-15952, CVE-2026-15953 (+9 other associated CVEs), Summary: CISA released six Industrial Control…

CVSS 9.8 ABB Johnson Controls Monta Armatura LLC FI

tg: zranitelnost tp: průmyslové systémy

· zachyceno · NCSC-FI · CISA Releases Six Industrial Control Systems Advisories

· zachyceno

Critical vulnerability in MISP

Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.4, CVEs: CVE-2026-103655, Summary: MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had…

EPSS < 0.01 CVSS 9.4 CVE-2026-103655 MISP FI

tg: zranitelnost tp: identita

· zachyceno · NCSC-FI · Critical vulnerability in MISP

· zachyceno

SPOJENO PŘES CVE Vulnerabilities in multiple Asus products

Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.4, CVEs: CVE-2026-93495, CVE-2026-14157, CVE-2026-13313, Summary: CVE-2026-93495 (CVSS: 7.0): ASUS has released a BIOS update for the affected motherboard models listed below and strongly recommends updating to the latest version to ensure optimal protection. This update addresses a security vulnerability related to improper initialization in certain ASUS motherboards. If exploited, the issue could…

EPSS 0.01 CVSS 9.4 CVE-2026-13313 CVE-2026-14157 CVE-2026-93495 ASUS FI IT

tg: zranitelnost

· zachyceno · NCSC-FI · Vulnerabilities in multiple Asus products · CSIRT Itálie (ACN) · Vulnerabilità in prodotti ASUS

· zachyceno

Vulnerabilities in n8n

Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.5, CVEs: CVE-2026-103245, CVE-2026-103246, CVE-2026-103247, CVE-2026-103248, CVE-2026-103249, CVE-2026-103250, CVE-2026-103251, CVE-2026-103252, CVE-2026-103253, CVE-2026-103254, CVE-2026-103255, CVE-2026-103256, CVE-2026-103257, CVE-2026-103258, CVE-2026-103259, CVE-2026-103260, Summary: CVE-2026-103245 (CVSS: 6.9): n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1…

EPSS < 0.01 CVSS 8.5 CVE-2026-103245 CVE-2026-103246 CVE-2026-103247 CVE-2026-103248 CVE-2026-103249 CVE-2026-103250 CVE-2026-103251 CVE-2026-103252 CVE-2026-103253 CVE-2026-103254 CVE-2026-103255 CVE-2026-103256 CVE-2026-103257 CVE-2026-103258 CVE-2026-103259 CVE-2026-103260 n8n FI

tg: zranitelnost tp: identita

· zachyceno · NCSC-FI · Vulnerabilities in n8n

· zachyceno

· zachyceno

· zachyceno

· zachyceno

Multiples vulnérabilités dans le noyau Linux de SUSE (02 octobre 2026)

De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

SUSE Linux FR

tg: zranitelnost

· zachyceno · CERT-FR – avis · Multiples vulnérabilités dans le noyau Linux de SUSE (02 octobre 2026)

· zachyceno

· zachyceno

· zachyceno

· zachyceno

· zachyceno

· zachyceno

Multiples vulnérabilités dans Apache HTTP Server (02 octobre 2026)

De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

EPSS 0.01 a dalších 3 CVE-2026-47360 CVE-2026-48005 CVE-2026-56153 CVE-2026-56154 CVE-2026-56449 CVE-2026-57941 CVE-2026-58415 CVE-2026-59685 CVE-2026-59797 CVE-2026-63045 CVE-2026-63292 CVE-2026-63686 CVE-2026-63718 CVE-2026-73636 CVE-2026-73637 CVE-2026-79768 CVE-2026-93546 Apache FR

tg: zranitelnost tp: DDoS

· zachyceno · CERT-FR – avis · Multiples vulnérabilités dans Apache HTTP Server (02 octobre 2026)

· zachyceno

Multiples vulnérabilités dans Tenable Nessus (02 octobre 2026)

De multiples vulnérabilités ont été découvertes dans Tenable Nessus. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

EPSS < 0.01 CVE-2026-103946 CVE-2026-103947 CVE-2026-103948 CVE-2026-103950 CVE-2026-103951 CVE-2026-103952 CVE-2026-103953 CVE-2026-103954 CVE-2026-103955 Tenable FR

tg: zranitelnost

· zachyceno · CERT-FR – avis · Multiples vulnérabilités dans Tenable Nessus (02 octobre 2026)

Kiteworks security advisory (AV26-988)

Serial number: AV26-988 Date: October 1, 2026 As of September 30, 2026, Kiteworks is affected by vulnerabilities in the following products: Kiteworks Core Prior to 9.5.0 Prior to 9.5.1 Kiteworks Email Protection Gateway (EPG) Prior to 9.5.0 Prior to 9.5.1 Kiteworks Secure Data Forms (SDF) Prior to 9.5.0 Prior to 9.5.1 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Kiteworks Security Advisories

Kiteworks CA

tg: zranitelnost

· Cyber Centre Kanada · Kiteworks security advisory (AV26-988)

Fortra security advisory (AV26-987)

Serial number: AV26-987 Date: October 1, 2026 As of October 1, 2026, Fortra is affected by a vulnerabilities in the following product: BoKS Manager boks-server Prior to 8.1.0.24 Prior to 9.0.0.7 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Heap overflow in KSL checksum initialization Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability Product…

Fortra CA

tg: zranitelnost

· Cyber Centre Kanada · Fortra security advisory (AV26-987)

MISP security advisory (AV26-986)

Serial number: AV26-986 Date: October 1, 2026 As of October 1, 2026, MISP is affected by vulnerabilities in the following product: MISP Prior to 2.5.48 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Delegation requests stay bound to the event they were authorised for A nested model alias key no longer selects the row a save targets Tag collection saves no longer write sibling user/org rows Refuse a…

MISP CA

tg: zranitelnost

· Cyber Centre Kanada · MISP security advisory (AV26-986)

n8n security advisory (AV26-985)

Serial number: AV26-985 Date: October 1, 2026 As of October 1, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 1.123.80 Prior to 2.39.6 Prior to 2.40.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Community Package Install Validation Bypass via PubSub in Queue Mode Deployments Dynamic Credentials Authorize Endpoint Leaks Session Token to Attacker-Controlled Resolver…

n8n CA

tg: zranitelnost tp: identita

· Cyber Centre Kanada · n8n security advisory (AV26-985)

Google security advisory (AV26-984)

Serial number: AV26-984 Date: October 1, 2026 As of September 29, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 154.0.8037.92/.93 (Windows/Mac), and 54.0.8037.92 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop

Google CA

tg: zranitelnost

· Cyber Centre Kanada · Google security advisory (AV26-984)

[Control systems] CODESYS security advisory (AV26-983)

Serial number: AV26-983 Date: October 1, 2026 As of September 30, 2026, CODESYS is affected by vulnerabilities in the following products: CODESYS Control RTE (SL) Prior to 3.5.22.40 CODESYS Control RTE (for Beckhoff CX) SL Prior to 3.5.22.40 CODESYS Control Win (SL) Prior to 3.5.22.40 CODESYS Control for BeagleBone SL Prior to 4.23.0.0 CODESYS Control for IOT2000 SL Prior to 4.23.0.0 CODESYS Control for Linux ARM SL Prior to 4.23.0.0 CODESYS Control for Linux SL Prior to 4.23.0.0 CODESYS…

CODESYS CA

tg: zranitelnost tp: průmyslové systémy

· Cyber Centre Kanada · [Control systems] CODESYS security advisory (AV26-983)

HPE security advisory (AV26-982)

Serial number: AV26-982 Date: October 1, 2026 As of September 29, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following products: Instant ON Prior to or equal to 3.4.1.0 HPE Telco Service Orchestrator Prior to v5.7.1 HPE Compute Scale-up Server 3200 Prior to 1.77.30 HPE Compute Scale-up Server 3250 Prior to 1.03.38 HPE Superdome Flex 280 Server Prior to 2.17.03 HPE Superdome Flex Server Prior to 4.17.03 HPE Unified OSS Console (UOC) UOC Prior to 3.1.22 The Cyber…

Hewlett Packard Enterprise CA

tg: zranitelnost

· Cyber Centre Kanada · HPE security advisory (AV26-982)

Rilevate vulnerabilità in n8n

Il team di sviluppo n8n-io ha rilevato nuove vulnerabilità, di cui 11 con gravità "alta", che interessano la piattaforma open-source per l'automazione dei workflow n8n. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un attaccante di ottenere informazioni riservate, eludere misure di sicurezza e meccanismi di autenticazione o eseguire codice arbitrario sui sistemi interessati.

EPSS < 0.01 CVE-2026-103246 CVE-2026-103248 CVE-2026-103250 CVE-2026-103251 CVE-2026-103252 CVE-2026-103253 CVE-2026-103254 CVE-2026-103255 CVE-2026-103256 CVE-2026-103257 CVE-2026-103259 n8n IT

tg: zranitelnost

· CSIRT Itálie (ACN) · Rilevate vulnerabilità in n8n

WatchGuard security advisory (AV26-981)

Serial number: AV26-981 Date: October 1, 2026 As of September 30, 2026, WatchGuard is affected by a vulnerability in the following product: Fireware OS Prior to 12.12.3 Prior to 12.5.21 Prior to 2026.2.3 Prior to 2026.3.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CVE-2026-86134 — Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service WatchGuard Security…

EPSS < 0.01 CVE-2026-86134 WatchGuard CA

tg: zranitelnost tp: DDoS

· Cyber Centre Kanada · WatchGuard security advisory (AV26-981)

OpenSSL security advisory (AV26-980)

Serial number: AV26-980 Date: October 1, 2026 As of September 29, 2026, OpenSSL is affected by vulnerabilities in the following product: OpenSSL Prior to 1.0.2zs Prior to 1.1.1zj Prior to 3.0.23 Prior to 3.4.8 Prior to 3.5.9 Prior to 3.6.5 Prior to 4.0.3 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Vulnerabilities | OpenSSL Library

OpenSSL CA

tg: zranitelnost

· Cyber Centre Kanada · OpenSSL security advisory (AV26-980)

JetBrains security advisory (AV26-979)

Serial number: AV26-979 Date: October 1, 2026 As of September 30, 2026, JetBrains is affected by vulnerabilities in the following products: Hub Prior to 2026.2.52366 IntelliJ IDEA Prior to 2026.2.3 Rider Prior to 2026.2.1 TeamCity Prior to 2026.2, 2026.1.4 and 2025.11.8 YouTrack Prior to 2026.2.18991 and 2026.2.19422 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Fixed security issues

JetBrains CA

tg: zranitelnost

· Cyber Centre Kanada · JetBrains security advisory (AV26-979)

· zachyceno

CISA Malcolm

View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm CVSS Vendor Equipment Vulnerabilities v3 8.8 CISA CISA Malcolm Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF), Authentication Bypass by Spoofing, Missing Authorization,…

EPSS < 0.01 CVSS 8.8 CVE-2026-90443 CVE-2026-90444 CVE-2026-90445 CVE-2026-90446 CVE-2026-90447 CVE-2026-90448 CVE-2026-90449 CISA energetika vodárenství US

tg: zranitelnost

· zachyceno · CISA Advisories · CISA Malcolm

· zachyceno

Johnson Controls EasyIO Neo Series EC and CW Controllers

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64893) EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b24 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64893)…

EPSS < 0.01 CVSS 5.4 CVE-2026-64893 Johnson Controls výroba a průmysl veřejná správa doprava energetika US

tg: zranitelnost tp: průmyslové systémy

· zachyceno · CISA Advisories · Johnson Controls EasyIO Neo Series EC and CW Controllers

· zachyceno

ABB Protection and Control IED Manager PCM600

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files. The following versions of ABB Protection and Control IED Manager PCM600 are affected: Protection and Control IED Manager PCM600 <=2.14 (CVE-2026-15952, CVE-2026-15953) CVSS Vendor Equipment Vulnerabilities v3 6.4 ABB ABB Protection and Control IED Manager PCM600 Incorrect Permission Assignment for Critical Resource, Improper Limitation of a Pathname to a…

EPSS < 0.01 CVSS 6.4 CVE-2026-15952 CVE-2026-15953 ABB energetika US

tg: zranitelnost tp: průmyslové systémy

· zachyceno · CISA Advisories · ABB Protection and Control IED Manager PCM600

· zachyceno

Meari IoT Cloud Platform OpenAPI Service

View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. The following versions of Meari IoT Cloud Platform OpenAPI Service are affected: IoT Cloud Platform OpenAPI Service vers:all/* (CVE-2026-101104, CVE-2026-96613) CVSS Vendor Equipment Vulnerabilities v3 7.7 Meari Meari…

EPSS < 0.01 CVSS 7.7 CVE-2026-101104 CVE-2026-96613 Meari US

tg: zranitelnost tp: identita

· zachyceno · CISA Advisories · Meari IoT Cloud Platform OpenAPI Service

· zachyceno

Johnson Controls EasyIO Neo Series EC and CW Controllers

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64892) EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64892) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64892) EasyIO Neo Series CW Controllers…

EPSS < 0.01 CVSS 3.5 CVE-2026-64892 Johnson Controls výroba a průmysl veřejná správa doprava energetika US

tg: zranitelnost tp: průmyslové systémy

· zachyceno · CISA Advisories · Johnson Controls EasyIO Neo Series EC and CW Controllers

· zachyceno

Monta monta.app

View CSAF Summary Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. The following versions of Monta monta.app are affected: monta.app vers:all/* (CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, CVE-2026-93474) CVSS Vendor Equipment Vulnerabilities v3 9.4 Monta Monta monta.app Missing Authentication for Critical Function, Improper…

EPSS < 0.01 CVSS 9.4 CVE-2026-93474 CVE-2026-95102 CVE-2026-97212 CVE-2026-97363 Monta energetika doprava US

tg: zranitelnost tp: DDoS tp: průmyslové systémy

· zachyceno · CISA Advisories · Monta monta.app

· zachyceno

Armatura LLC Armatura One

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. The following versions of Armatura LLC Armatura One are affected: Armatura One <4.7.2 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) Armatura One (USA) <4.6.1 (CVE-2023-46604, CVE-2026-94591, CVE-2026…

KEV ✓ · ransomware EPSS 1.00 CVSS 9.8 CVE-2023-46604 CVE-2026-94591 CVE-2026-94592 CVE-2026-94593 CVE-2026-94594 Armatura LLC Apache telekomunikace výroba a průmysl energetika doprava US

tg: zranitelnost tp: průmyslové systémy

· zachyceno · CISA Advisories · Armatura LLC Armatura One

SPOJENO PŘES CVE Cisco security advisory (AV26-978)

Serial Number: AV26-978 Date: October 1, 2026 As of September 30, 2026, Cisco is affected by a vulnerability in the following product: Cisco Catalyst SD-WAN Manager Versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 et 26.2.1 On September 30, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76504 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply…

KEV ✓ EPSS 0.39 CVSS 9.8 CVE-2026-76504 Cisco CA HU FI FR US IT

tg: zneužíváno tg: zranitelnost tp: identita

· Cyber Centre Kanada · Cisco security advisory (AV26-978) · NKI Maďarsko · Riasztás a Cisco Catalyst SD-WAN Manager rendszert érintő sérülékenységről · zachyceno · NCSC-FI · Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability · zachyceno · CERT-FR – avis · Vulnérabilité dans Cisco Catalyst SD-WAN (01 octobre 2026) · BleepingComputer · Cisco warns of new SD-WAN zero-day exploited in attacks · CSIRT Itálie (ACN) · Cisco: rilevato sfruttamento in rete di una vulnerabilità in Catalyst SD-WAN Manager · Cisco PSIRT · Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability · zachyceno · CISA KEV · Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (CVE-2026-76504)

NCSC-2026-0397 [1.00] [M/H] Kwetsbaarheid verholpen in Apple CoreGraphics

Apple heeft een kwetsbaarheid verholpen in CoreGraphics op iOS, iPadOS en macOS. De kwetsbaarheid betreft een out-of-bounds write in de CoreGraphics component. Een aanvaller kan deze kwetsbaarheid misbruiken door speciaal vervaardigde bestanden te verwerken, wat kan leiden tot het uitvoeren van willekeurige code. Deze kwetsbaarheid is gebruikt in gerichte aanvallen op iOS-versies vóór iOS 27. De kwetsbaarheid komt voor in meerdere Apple besturingssystemen.

Apple NL

tg: zneužíváno tg: zranitelnost

· NCSC-NL · NCSC-2026-0397 [1.00] [M/H] Kwetsbaarheid verholpen in Apple CoreGraphics

SPOJENO PŘES CVE Riasztás a WordPress Core-t érintő sérülékenységről

A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézete riasztást ad ki a széles körben használt WordPress tartalomkezelő rendszer (Core) aktívan kihasznált sérülékenysége miatt. A CISA 2026. szeptember 25-én vette fel a KEV-katalógusába. A hiba hitelesítés nélkül kihasználható, és bizonyos feltételek teljesülése esetén távoli kódfuttatáshoz vezethet. A CVE-2026-87902 azonosítón nyomon követett, magas súlyosságú sérülékenység önmagában helyi fájl beágyazását […]

KEV ✓ EPSS 0.96 CVSS 9.2 CVE-2026-87902 WordPress HU US FI CA NL FR

tg: zneužíváno tg: zranitelnost

· NKI Maďarsko · Riasztás a WordPress Core-t érintő sérülékenységről · zachyceno · CISA KEV · WordPress Core Remote File Inclusion Vulnerability (CVE-2026-87902) · zachyceno · NCSC-FI · WordPress Core – Critical Path Traversal Vulnerability · BleepingComputer · Hackers start exploiting critical WordPress flaw for code execution · Cyber Centre Kanada · WordPress security advisory (AV26-952) · NCSC-NL · NCSC-2026-0389 [1.00] [M/H] Kwetsbaarheid verholpen in WordPress · zachyceno · CERT-FR – avis · Vulnérabilité dans WordPress (23 septembre 2026)

SPOJENO PŘES CVE Risolte vulnerabilità in CPython

Aggiornamenti di sicurezza risolvono 2 vulnerabilità, di cui 1 con gravità "critica" e 1 con gravità "alta", in CPython, implementazione di riferimento open source del linguaggio di programmazione Python. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato remoto non autenticato di eludere i meccanismi di sicurezza o di compromettere la disponibilità del servizio sui sistemi interessati.

EPSS 0.01 CVSS 9.2 CVE-2026-19445 CVE-2026-19553 Python CPython IT FI FR

tg: zranitelnost tp: DDoS

· CSIRT Itálie (ACN) · Risolte vulnerabilità in CPython · zachyceno · NCSC-FI · CRITICAL severity vulnerability affecting CPython · zachyceno · CERT-FR – avis · Multiples vulnérabilités dans CPython (01 octobre 2026)

Múltiples vulnerabilidades en Entradium de Crocantickets

Multiple vulnerabilities in Entradium by Crocantickets Thu, 10/01/2026 - 10:09 Aviso Affected Resources Entradium. Description INCIBE has coordinated the disclosure of four medium-severity vulnerabilities affecting Entradium by Crocantickets, event management software. The vulnerabilities were discovered by Cosme Vázquez Tomé.These vulnerabilities have been assigned the following identifiers, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type for each vulnerability:CVE-2026-7173:…

EPSS < 0.01 CVSS 4.8 CVE-2026-7173 CVE-2026-7174 CVE-2026-7175 CVE-2026-7176 Crocantickets ES

tg: zranitelnost

· INCIBE-CERT · Múltiples vulnerabilidades en Entradium de Crocantickets

WAGO: Multiple Devices are affected by a Vulnerability in BACnet IP Stack

[VDE-2025-102] Multiple WAGO devices are affected by a vulnerability in the dynamic creation of BACnet File Objects. The object name is used as a file path without sufficient validation and is not restricted to the intended directory, so relative paths can be used to reach files elsewhere in the file system.

EPSS 0.01 CVE-2025-41753 WAGO DE

tg: zranitelnost tp: průmyslové systémy

· CERT@VDE · WAGO: Multiple Devices are affected by a Vulnerability in BACnet IP Stack

· zachyceno

Improper limitation of a pathname to a restricted directory

CVSSv3 Score: 9.8 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.This has been reported to be exploited in the wild, customers are urged to apply the workaround below. Revised on 2026-10-01 00:00:00

CVSS 9.8 US

tg: zneužíváno tg: zranitelnost

· zachyceno · Fortinet PSIRT · Improper limitation of a pathname to a restricted directory

· zachyceno

SPOJENO PŘES CVE ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-50375.

EPSS < 0.01 CVSS 8.8 CVE-2026-50375 Microsoft US

tg: zranitelnost

· zachyceno · Zero Day Initiative · ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability · Microsoft Security · CVE-2026-50375 DirectX Graphics Kernel Elevation of Privilege Vulnerability

· zachyceno

Vulnerabilities in WatchGuard Fireware OS

Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.2, CVEs: CVE-2026-86134, CVE-2026-13046, CVE-2026-13224, CVE-2026-18105, CVE-2026-18145, CVE-2026-81433, CVE-2026-86101, CVE-2026-86104, CVE-2026-86105, CVE-2026-86128, CVE-2026-86131, CVE-2026-86132, CVE-2026-86133, CVE-2026-86136, CVE-2026-90441, Summary: CVE-2026-86134 (CVSS: 8.7): A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote,…

EPSS < 0.01 CVSS 9.2 CVE-2026-13046 CVE-2026-13224 CVE-2026-18105 CVE-2026-18145 CVE-2026-81433 CVE-2026-86101 CVE-2026-86104 CVE-2026-86105 CVE-2026-86128 CVE-2026-86131 CVE-2026-86132 CVE-2026-86133 CVE-2026-86134 CVE-2026-86136 CVE-2026-90441 WatchGuard FI

tg: zranitelnost

· zachyceno · NCSC-FI · Vulnerabilities in WatchGuard Fireware OS

· zachyceno

Vulnerabilties in Apache MINA SSHD and PLC4X

Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.2, CVEs: CVE-2026-77185, CVE-2026-93994, CVE-2026-93995, CVE-2026-93996, CVE-2026-94002, CVE-2026-94053, CVE-2026-94029, CVE-2026-94052, CVE-2026-102509, CVE-2026-102510, CVE-2026-102511, CVE-2026-102508, Summary: CVE-2026-77185 (CVSS:9.1): Apache MINA SSHD: Asynchronous authentication can bypass signature verification CVE-2026-93994 (CVSS:8.1): Apache MINA SSHD: Repeated-publickey policy bypass on…

EPSS < 0.01 CVSS 9.2 CVE-2026-102508 CVE-2026-102509 CVE-2026-102510 CVE-2026-102511 CVE-2026-77185 CVE-2026-93994 CVE-2026-93995 CVE-2026-93996 CVE-2026-94002 CVE-2026-94029 CVE-2026-94052 CVE-2026-94053 Apache FI

tg: zranitelnost tp: průmyslové systémy

· zachyceno · NCSC-FI · Vulnerabilties in Apache MINA SSHD and PLC4X

· zachyceno

Vulnerability in Red Hat OpenShift Container Platform 4

Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-62146, Summary: A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.

EPSS < 0.01 CVSS 7.8 CVE-2026-62146 Red Hat FI

tg: zranitelnost

· zachyceno · NCSC-FI · Vulnerability in Red Hat OpenShift Container Platform 4

· zachyceno

Vulnerability in Red Hat Enterprise Linux 10

Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.1, CVEs: CVE-2026-103242, Summary: A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via…

EPSS < 0.01 CVSS 7.1 CVE-2026-103242 Red Hat FI

tg: zranitelnost

· zachyceno · NCSC-FI · Vulnerability in Red Hat Enterprise Linux 10

· zachyceno

Vulnerabilities in MISP

Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 6.2, CVEs: CVE-2026-103388, CVE-2026-103389, CVE-2026-103321, Summary: CVE-2026-103388 (CVSS: 6.2): MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a…

EPSS < 0.01 CVSS 6.2 CVE-2026-103321 CVE-2026-103388 CVE-2026-103389 MISP FI

tg: zranitelnost

· zachyceno · NCSC-FI · Vulnerabilities in MISP

· zachyceno

· zachyceno

Vulnerabilities in JetBrains YouTrack

Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.9, CVEs: CVE-2026-100257, CVE-2026-100258, CVE-2026-100259, CVE-2026-100260, CVE-2026-100261, CVE-2026-100262, CVE-2026-100263, CVE-2026-100264, CVE-2026-100267, CVE-2026-100268, CVE-2026-100269, CVE-2026-100270, CVE-2026-100271, CVE-2026-100272, CVE-2026-100273, CVE-2026-100274, CVE-2026-100275, CVE-2026-100276, CVE-2026-100277, CVE-2026-100278, CVE-2026-100279, CVE-2026-100280, Summary: CVE-2026-100257 …

EPSS 0.01 CVSS 8.9 a dalších 5 CVE-2026-100262 CVE-2026-100263 CVE-2026-100264 CVE-2026-100267 CVE-2026-100268 CVE-2026-100269 CVE-2026-100270 CVE-2026-100271 CVE-2026-100272 CVE-2026-100273 CVE-2026-100274 CVE-2026-100275 CVE-2026-100276 CVE-2026-100277 CVE-2026-100278 CVE-2026-100279 CVE-2026-100280 JetBrains FI

tg: zranitelnost tp: identita

· zachyceno · NCSC-FI · Vulnerabilities in JetBrains YouTrack

· zachyceno

· zachyceno

Vulnerabilities in JetBrains TeamCity

Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2026-100253, CVE-2026-100254, CVE-2026-100255, Summary: CVE-2026-100253 (CVSS: 8.8): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL CVE-2026-100254 (CVSS: 8.8): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF…

EPSS < 0.01 CVSS 8.8 CVE-2026-100253 CVE-2026-100254 CVE-2026-100255 JetBrains FI

tg: zranitelnost tp: identita

· zachyceno · NCSC-FI · Vulnerabilities in JetBrains TeamCity