Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
Rilevate 6 vulnerabilità con gravità “alta” in diversi moduli di FreePBX, piattaforma open source per la configurazione e la gestione grafica di centralini telefonici basati su Asterisk.
EPSS 0.01 CVE-2026-45562 CVE-2026-54674 CVE-2026-54675 CVE-2026-54708 CVE-2026-54710 CVE-2026-75600 FreePBX Asterisk telekomunikace IT
Out-of-bounds write vulnerability (CVE-2026-15390) has been found in DENX Software Engineering Das U-Boot software.
EPSS < 0.01 CVE-2026-15390 DENX Software Engineering PL
Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment Tue, 09/29/2026 - 12:27 Aviso Affected Resources T-CPE301K 4G Mini WiFi Router (Dbit). Description INCIBE has coordinated the publication of two vulnerabilities – one of critical severity and one of high severity – affecting the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment, a portable router that uses a 4G SIM card to create a Wi-Fi network. The vulnerabilities were…
EPSS < 0.01 CVSS 9.3 CVE-2026-7192 CVE-2026-7193 Shenzhen Dbit Network Equipment ES
Rilasciati aggiornamenti di sicurezza per sanare due vulnerabilità, di cui una con gravità “alta”, in Progress Telerik Fiddler Everywhere.
EPSS < 0.01 CVE-2026-86158 Progress Software IT
American tech company Kiteworks has lifted a precautionary advisory asking customers to shut down systems after patching a critical vulnerability. [...]
Kiteworks US
Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
CVE-2025-14174 * CVE-2025-20701 * CVE-2025-24085 * CVE-2025-24200 * CVE-2025-24201 * CVE-2025-31200 * CVE-2025-31201 * CVE-2025-43529 * CVE-2026-20700 * Apple US
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.0, CVEs: CVE-2026-80357, CVE-2026-80359, CVE-2026-80358, Summary: CVE-2026-80357 (CVSS: 7.0): Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to…
EPSS < 0.01 CVSS 7.0 CVE-2026-80357 CVE-2026-80358 CVE-2026-80359 Dell FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.9, CVEs: CVE-2026-82375, CVE-2026-82379, CVE-2026-82380, CVE-2026-82381, CVE-2026-82382, CVE-2026-82383, CVE-2026-82384, CVE-2026-82348, CVE-2026-82376, CVE-2026-82377, CVE-2026-82378, CVE-2026-82385, CVE-2026-82386, CVE-2026-82387, CVE-2026-82546, CVE-2026-91204, CVE-2026-91206, Summary: CVE-2026-82375 (CVSS: 7.4): Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user…
EPSS 0.01 CVSS 9.9 CVE-2026-82348 CVE-2026-82375 CVE-2026-82376 CVE-2026-82377 CVE-2026-82378 CVE-2026-82379 CVE-2026-82380 CVE-2026-82381 CVE-2026-82382 CVE-2026-82383 CVE-2026-82384 CVE-2026-82385 CVE-2026-82386 CVE-2026-82387 CVE-2026-82546 CVE-2026-91204 CVE-2026-91206 Apache FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 8.3, CVEs: CVE-2026-81375, Summary: A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.
EPSS < 0.01 CVSS 8.3 CVE-2026-81375 Google FI
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.2, CVEs: CVE-2026-86330, Summary: An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with…
EPSS 0.02 CVSS 7.2 CVE-2026-86330 Red Hat FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.2, CVEs: CVE-2026-101292, Summary: Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT…
EPSS 0.01 CVSS 8.2 CVE-2026-101292 Red Hat Apache FI
Serial Number: AV26-970Date: September 28, 2026 Linux security advisory (AV26-970) As of September 25, 2026, Linux is affected by a vulnerability in the following product: Linux Kernel Version prior to 4.7 Version 5.10 prior to 5.10.270 Version 5.15 prior to 5.15.221 Version 6.1 prior to 6.1.188 Version 6.12 prior to 6.12.110 Version 6.18 prior to 6.18.52 Version 6.6 prior to 6.6.157 Version 7.2 prior to 7.2.6 The Cyber Centre encourages users and administrators to review the provided web links…
Linux CA
Serial Number: AV26-969Date: September 28, 2026 As of September 25, 2026, wolfSSL is affected by vulnerabilities in the following product: wolfSSL Prior to or equal to 5.9.4 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. wolfSSL Release 5.9.4 (September 25, 2026)
wolfSSL CA
Serial Number: AV26-968Date: September 28, 2026 As of September 28, 2026, SUSE is affected by a vulnerability in the following product: NeuVector Prior to 5.4.11 Prior to 5.5.4 Prior to 5.6.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes SUSE Update Advisories
SUSE CA
Serial Number: AV26-967Date: September 28, 2026 As of September 25, 2026, IBM is affected by vulnerabilities in the following products: IBM Big Replicate LiveData Migrator Prior to or equal to 3.3 IBM App Connect Enterprise Prior to or equal to version 13.0.1.0 to 13.0.8.2 DataStage on Cloud Pak for Data Prior to or equal to 5.4.0.0 Analyst Workflow Prior to or equal to version 1.0.0 - 3.1.0 IBM QRadar Deployment Intelligence App Prior to or equal to version 1.0.0 - 3.0.19 IBM Rhapsody Systems…
IBM CA
Serial Number: AV26-966Date: September 28, 2026 As of September 24, 2026, Dell is affected by vulnerabilities in the following products: Rugged Control Center (RCC) Prior to 5.2.206 Secure Connect Gateway (SCG) Policy Manager Prior to 5.36.00.16 ThinOS 10 Prior to SecurityAddon_2605.10.2766_T10 Dell Trusted Device Client Prior to 8.1.359.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. DSA-2026-410:…
Dell CA
Incident responders began warning of potential vulnerabilities in NetScaler Gateway products on Saturday before cybersecurity agencies in the Netherlands, U.S. and U.K. released advisories on Sunday confirming vulnerabilities. Citrix itself confirmed eight new vulnerabilities.
Citrix US
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-73640 to CVE-2026-73642) found in Dayforce Payroll software.
EPSS < 0.01 CVE-2026-73640 CVE-2026-73642 Dayforce PL
CERT Polska has received a report about 2 vulnerabilities (CVE-2026-52748 and CVE-2026-52749) found in Kaon AR2140 routers.
EPSS < 0.01 CVE-2026-52748 CVE-2026-52749 KAON PL
Serial number: AV26-965Date: September 28, 2026 As of September 27, 2026, Citrix is affected by vulnerabilities in the following products: NetScaler ADC and NetScaler Gateway 14.1 Prior to 14.1-73.37 NetScaler ADC and NetScaler Gateway 13.1 Prior to 13.1-63.23 NetScaler ADC FIPS Prior to 14.1-73.37 FIPS NetScaler ADC FIPS and NDcPP Prior to 13.1-37.279 On September 27, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88771 and CVE-2026-88772 to their Known Exploited…
KEV ✓ EPSS 0.82 CVSS 9.5 CVE-2026-88771 CVE-2026-88772 CVE-2026-88773 CVE-2026-88774 CVE-2026-88775 CVE-2026-88776 CVE-2026-88777 CVE-2026-88778 Citrix CA FI FR NL AT US
The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited.
Citrix GB
CERT Polska has received a report about 7 vulnerabilities (from CVE-2026-82928 to CVE-2026-82930 and CVE-2026-82932, CVE-2026-82933, CVE-2026-82935 and CVE-2026-82936) found in F&F Filipowski mH-DEVELOPER devices.
EPSS < 0.01 CVE-2026-82928 CVE-2026-82930 CVE-2026-82932 CVE-2026-82933 CVE-2026-82935 CVE-2026-82936 F&F Filipowski PL
CONTEXT La data de 27 septembrie 2026, Citrix a publicat un buletin de securitate referitor la opt ...
Citrix RO
OverviewOn September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution (RCE) vulnerabilities: CVE-2026-88771 and CVE-2026-88772. Both of these RCE vulnerabilities carry a critical CVSSv4 score of 9.5, and both have been confirmed as being actively exploited in the wild as zero-days prior to the vendor disclosure. CVE-2026-88771 affects vulnerable NetScaler deployments in their default configuration,…
KEV ✓ EPSS 0.82 CVSS 9.5 CVE-2026-88771 CVE-2026-88772 CVE-2026-887729 CVE-2026-887739 Citrix US
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-85542 – già sanata dal vendor - che interessa il prodotto IBM Guardium Data Protection. Tale vulnerabilità potrebbe consentire a un utente malintenzionato autenticato di elevare i propri privilegi ed eseguire codice arbitrario sui sistemi interessati.
EPSS 0.03 CVE-2026-85542 IBM IT
Disponibili Proof of Concept (PoC) per lo sfruttamento di 6 nuove vulnerabilità, di cui 2 con gravità "critica" e 4 con gravità "alta", presenti in Flowise, piattaforma per la creazione e gestione di applicazioni e flussi basati sull’intelligenza artificiale.
EPSS < 0.01 CVE-2026-100605 CVE-2026-100606 CVE-2026-100607 CVE-2026-100608 CVE-2026-100609 CVE-2026-100610 FlowiseAI IT
Rilasciati aggiornamenti di sicurezza per risolvere 30 vulnerabilità, di cui 1 con gravità "critica" e 10 con gravità “alta”, presenti nel prodotto Zammad, soluzione open source per la gestione dell’help desk e del supporto clienti.
EPSS < 0.01 CVE-2026-56723 CVE-2026-56724 CVE-2026-56725 CVE-2026-56727 CVE-2026-56731 CVE-2026-56733 CVE-2026-61525 CVE-2026-84458 CVE-2026-84462 CVE-2026-84464 CVE-2026-84465 Zammad IT
Multiple vulnerabilities in TPVEnlanube Mon, 09/28/2026 - 09:56 Aviso Affected Resources TPVEnlanube. Description INCIBE has coordinated the publication of 3 medium-severity vulnerabilities affecting TPVEnlanube, a software for managing inventory, warehouses, orders, and suppliers. The vulnerabilities were discovered by David Padilla Alvarado.These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type for each vulnerability:From CVE…
EPSS < 0.01 CVE-2026-7170 CVE-2026-7171 CVE-2026-7172 TPVEnlanube ES
Rilasciati aggiornamenti di sicurezza per risolvere diverse vulnerabilità, di cui con 4 con gravità “critica”, in Zimbra Collaboration Suite (ZCS), nota piattaforma di collaborazione e-mail sviluppata da Synacor.
EPSS 0.01 CVE-2026-93641 CVE-2026-93642 CVE-2026-93643 CVE-2026-93647 Synacor Zimbra IT
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. [...]
CVE-2026-19490 * CVE-2026-3055 * CVE-2026-4368 * CVE-2026-88771 * CVE-2026-88772 * Citrix veřejná správa US
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 6.5, CVEs: CVE-2026-82294, CVE-2026-82300, CVE-2026-94396, CVE-2026-94397, CVE-2026-94398, CVE-2026-94399, CVE-2026-94408, Summary: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). See also: https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682, See also: https://discuss.elastic.co…
EPSS < 0.01 CVSS 6.5 CVE-2026-82294 CVE-2026-82300 CVE-2026-94396 CVE-2026-94397 CVE-2026-94398 CVE-2026-94399 CVE-2026-94408 Elastic FI
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5, CVEs: CVE-2026-72662, CVE-2026-72668, CVE-2026-78582, Summary: CVE-2026-72662 (CVSS: 6.3): Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate,…
EPSS < 0.01 CVSS 7.5 CVE-2026-72662 CVE-2026-72668 CVE-2026-78582 CVE-2026-94400 Elastic FI
De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.
EPSS < 0.01 CVE-2026-96745 CVE-2026-96746 CVE-2026-96747 CVE-2026-96748 CVE-2026-96749 MongoDB FR
On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE) vulnerabilities. Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild. CERT-EU recommends updating affected software and running a compromise assessment on those exposed on the internet.
Citrix EU
Two unpatched Citrix NetScaler zero-day vulnerabilities are reportedly being exploited in attacks, with cybersecurity agencies, security researchers, and IT providers privately warning organizations about the flaws ahead of patches expected next week. [...]
KEV ✓ EPSS 0.33 CVSS 9.3 CVE-2026-19489 CVE-2026-19490 Citrix US CA IT NL FI FR
Wireshark release 4.6.9 fixes 19 vulnerabilities and 16 bugs. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Wireshark US
Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host. [...]
Cloudflare US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.0, CVEs: CVE-2026-100551, Summary: The iOS Control UI did not enforce saved Gateway TLS pins. In affected versions, authenticated Terminal and session Dashboard WebViews omitted the saved Gateway fingerprint even though native connections enforced it. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators,…
EPSS < 0.01 CVSS 9.0 CVE-2026-100551 OpenClaw FI
CISA added CVE-2026-88771 to the Known Exploited Vulnerabilities catalog. Affected product: Citrix NetScaler. Remediation due date: 2026-09-30.
KEV ✓ EPSS 0.82 CVE-2026-88771 Citrix US
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2026-93834, Summary: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary…
EPSS < 0.01 CVSS 8.8 CVE-2026-93834 Red Hat QEMU FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-93642, CVE-2026-93643, CVE-2026-93647, Summary: CVE-2026-93642 (CVSS: 9.3): An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim. CVE-2026-93643 (CVSS: 9.8): When OnlyOffice/Document Editing is available, an unauthenticated remote…
EPSS 0.01 CVSS 9.8 CVE-2026-93642 CVE-2026-93643 CVE-2026-93647 Zimbra FI
Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack. [...]
Kiteworks US
Serial Number: AV26-964Date: September 25, 2026 As of September 25, 2026, Zimbra is affected by vulnerabilities in the following product: Zimbra Collaboration Suite (ZCS) (Daffodil) Prior to 10.1.21 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. What’s New in Zimbra 10.1.21 (Daffodil) Zimbra Blog - All Things Zimbra
Zimbra CA
A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]
The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]
KEV ✓ EPSS 0.22 CVE-2026-5430 WSO2 US
Elastic ha rilevato nuove vulnerabilità nei propri prodotti, di cui una con gravità "alta", in Kibana. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di elevare i propri privilegi sui sistemi interessati
EPSS < 0.01 CVE-2026-72668 Elastic IT
Insertion of sensitive information into log file in Microsoft Office allows an authorized attacker to disclose information over a network.
CVSS 6.5 CVE-2026-100206 Microsoft US
Serial number: AV26-963Date: September 25, 2026 As of September 24, 2026, ServiceNow is affected by vulnerabilities in the following product: ServiceNow AI Platform Versions prior to Australia Patch 2 Hot Fix 4b W32 Versions prior to Australia Patch 4 Hot Fix 3 Versions prior to Australia Patch 5 Versions prior to Yokohama Patch 13 Hot Fix 5a Versions prior to Zurich Patch 10 Hot Fix 3b Versions prior to Zurich Patch 10 Hot Fix 4a W32 Versions prior to Zurich Patch 11 Hot Fix 3 The Cyber Centre…
ServiceNow CA
Serial number: AV26-962Date: September 25, 2026 As of September 23, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Prior to 19.2.7 Prior to 19.3.3 Prior to 19.4.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7 GitLab release notes | GitLab Docs
GitLab CA
Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-71540 – già sanata dal vendor – presente in Wazuh, piattaforma open-source con funzionalità di Security Information and Event Management (SIEM) e Extended Detection and Response (XDR).
EPSS < 0.01 CVE-2026-71540 Wazuh IT
Aggiornamenti di sicurezza Dell risolvono molteplici vulnerabilità, di cui 5 con gravità "alta" nei prodotti Boot Optimized Server Storage (BOSS), Rugged Control Center (RCC), Trusted Device Client e ThinOS 10. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eludere i meccanismi di autenticazione e sicurezza, elevare i propri privilegi e la modifica non autorizzata di dati o codice sui sistemi interessati.
EPSS < 0.01 CVE-2026-80357 CVE-2026-81455 CVE-2026-81473 CVE-2026-82157 CVE-2026-82164 Dell IT
Rilasciati aggiornamenti di sicurezza che risolvono 5 vulnerabilità, di cui 2 con gravità "critica" e 3 con gravità "alta", in ServiceNow AI Platform, piattaforma di intelligenza artificiale e automazione di ServiceNow, progettata per integrare funzionalità di AI generativa, machine learning e workflow automation nei processi aziendali e IT.
EPSS < 0.01 CVSS 9.3 CVE-2026-13016 CVE-2026-86857 CVE-2026-86858 CVE-2026-86859 CVE-2026-86860 ServiceNow IT FI
MongoDB ha rilasciato aggiornamenti di sicurezza per risolvere 5 vulnerabilità con gravità "alta" nei prodotti Python Driver (PyMongo), C Driver, Compass e Laravel MongoDB. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eseguire codice arbitrario, accedere a informazioni sensibili, alterare i dati e compromettere la disponibilità del servizio sui sistemi interessati.
EPSS < 0.01 CVE-2026-96744 CVE-2026-96746 CVE-2026-96748 CVE-2026-96749 CVE-2026-96750 MongoDB IT
Stored Cross-Site Scripting in StockAgile by Novadigits technologies Fri, 09/25/2026 - 17:31 Aviso Affected Resources API y el panel de gestión de StockAgile. Description INCIBE has coordinated the disclosure of seven medium-severity vulnerabilities affecting the API and the StockAgile management dashboard, software for retail stores, e-commerce, and warehouses. The vulnerability was discovered by Miguel Jiménez Cámara.These vulnerabilities have been assigned the following code, CVSS v4.0 base…
EPSS < 0.01 CVE-2026-6082 CVE-2026-6083 CVE-2026-6084 CVE-2026-6085 CVE-2026-6086 CVE-2026-6087 CVE-2026-6088 Novadigits technologies obchod ES
Classification: Severe, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv4.0: 9.4, CVEs: CVE-2026-68489, CVE-2026-68490, CVE-2026-68492, CVE-2026-87898, CVE-2026-87899, CVE-2026-87900, Summary: Multiple vulnerabilities affect components supplied with the Plesk and cPanel hosting-management platforms. Depending on the affected component, authenticated or local users could execute commands or code with root privileges, access another hosting account’s calendars or contacts, or modify…
EPSS 0.01 CVSS 9.4 CVE-2026-68489 CVE-2026-68490 CVE-2026-68492 CVE-2026-87898 CVE-2026-87899 CVE-2026-87900 WebPros FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv4.0: 8.7, CVEs: CVE-2026-14441, CVE-2026-14442, CVE-2026-14443, CVE-2026-82368, CVE-2026-82369, CVE-2026-82370, CVE-2026-82371, CVE-2026-82372, Summary: Brocade has fixed multiple vulnerabilities in SANnav Management Portal. The vulnerabilities could allow local, adjacent or network-adjacent attackers to access internal services, execute commands, obtain administrative control of managed Fabric OS switches or…
EPSS 0.01 CVSS 8.7 CVE-2026-14441 CVE-2026-14442 CVE-2026-14443 CVE-2026-82368 CVE-2026-82369 CVE-2026-82370 CVE-2026-82371 CVE-2026-82372 Brocade FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: 9.8, CVEs: CVE-2026-63077, Summary: An unauthenticated remote code execution vulnerability affects TeamCity On-Premises. An attacker with HTTP or HTTPS access to a vulnerable server can exploit the TeamCity agent polling protocol to bypass authentication and execute operating-system commands with the privileges of the TeamCity server process.
KEV ✓ · ransomware EPSS 0.95 CVSS 9.8 CVE-2026-63077 JetBrains veřejná správa FI US
Classification: Important, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 7.5, CVEs: CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682, Summary: PHP has released security updates addressing multiple vulnerabilities in PHP-FPM, OpenSSL, MySQLnd, Phar, SOAP, HTTP streams and Windows file handling. The most serious vulnerability allows an unauthenticated…
EPSS < 0.01 CVSS 7.5 CVE-2025-1218 CVE-2025-14181 CVE-2026-17545 CVE-2026-6103 CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769 CVE-2026-92842 CVE-2026-93682 PHP FI FR
Categories: Threat ResearchTags: advisory, Kiteworks
Kiteworks GB
CISA added CVE-2026-65660 to the Known Exploited Vulnerabilities catalog. Affected product: Microsoft SharePoint. Remediation due date: 2026-09-28.
KEV ✓ EPSS 0.08 CVE-2026-65660 Microsoft US CA