Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20176.
EPSS 0.01 CVSS 7.2 CVE-2026-20176 Cisco US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20211.
EPSS 0.01 CVSS 7.2 CVE-2026-20211 Cisco US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20235.
EPSS < 0.01 CVSS 4.9 CVE-2026-20235 Cisco US
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases](https://chromereleases.googleblog.com/2026)) for more information.
EPSS < 0.01 CVSS 8.8 CVE-2026-91745 Google Microsoft US
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases](https://chromereleases.googleblog.com/2026)) for more information.
EPSS < 0.01 CVSS 9.6 CVE-2026-91728 Google Microsoft US
The FBI and Defense Department partnered with Japan’s National Police Agency and law enforcement agencies in Australia and Germany on a new advisory about “WaterPlum” — a group of cyber actors allegedly stealing cryptocurrency from job applicants by posing as AI or blockchain companies.
US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.0: 9.9, CVEs: CVE-2026-13348, CVE-2026-31431, CVE-2026-13336, CVE-2026-13337, CVE-2025-6625, CVE-2024-4872, CVE-2024-3980, CVE-2024-3982, CVE-2024-7940, CVE-2024-7941, CVE-2026-15688, CVE-2026-86520, CVE-2026-86689, CVE-2026-77960, CVE-2026-13584, Summary: CISA released eight Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues,…
KEV ✓ EPSS 0.98 CVSS 9.9 CVE-2024-3980 CVE-2024-3982 CVE-2024-4872 CVE-2024-7940 CVE-2024-7941 CVE-2025-6625 CVE-2026-13336 CVE-2026-13337 CVE-2026-13348 CVE-2026-13584 CVE-2026-15688 CVE-2026-31431 CVE-2026-77960 CVE-2026-86520 CVE-2026-86689 Bransys Mitsubishi Electric Hitachi Energy Schneider Electric FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.1, CVEs: CVE-2026-81642, CVE-2026-81634, CVE-2026-82717, CVE-2026-77955, CVE-2026-78227, CVE-2026-80225, CVE-2026-82720, CVE-2026-85501, CVE-2026-77860, Summary: Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab for the report. Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC…
EPSS 0.01 CVSS 9.1 CVE-2026-77860 CVE-2026-77955 CVE-2026-78227 CVE-2026-80225 CVE-2026-81634 CVE-2026-81642 CVE-2026-82717 CVE-2026-82720 CVE-2026-85501 FI
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5, CVEs: CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736, Summary: In 16 September 2026, Internet Systems Consortium disclosed fourteen vulnerabilities affecting our BIND 9 software: - CVE-2026-19033: Unauthenticated IXFR deltas…
EPSS 0.07 CVSS 7.5 CVE-2026-19033 CVE-2026-19662 CVE-2026-19666 CVE-2026-19667 CVE-2026-19668 CVE-2026-19941 CVE-2026-75029 CVE-2026-76163 CVE-2026-77119 CVE-2026-77692 CVE-2026-78301 CVE-2026-80274 CVE-2026-81563 CVE-2026-81736 ISC FI
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
IBM FR
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Une vulnérabilité a été découverte dans Kaspersky Secure Mail Gateway. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
EPSS 0.03 CVE-2023-41056 Kaspersky FR
De multiples vulnérabilités ont été découvertes dans WordPress. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
WordPress FR
CISA added CVE-2026-53266 to the Known Exploited Vulnerabilities catalog. Affected product: Linux Kernel. Remediation due date: 2026-09-21.
KEV ✓ EPSS 0.01 CVE-2026-53266 Linux US
CISA added CVE-2025-39964 to the Known Exploited Vulnerabilities catalog. Affected product: Linux Kernel. Remediation due date: 2026-09-21.
KEV ✓ EPSS 0.02 CVE-2025-39964 Linux US
Serial Number: AV26-935Date: September 17, 2026 As of September 16, 2026, Tanium is affected by a vulnerability in the following product: Threat Response Prior to Update 15 (v4.12.317) Prior to Update 8 (v4.17.289) Prior to Update 25 (v4.9.447) The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. TAN-2026-047 - Tanium Security Advisories All Advisories - Tanium Security Advisories
Tanium CA
Serial number: AV26-934Date: September 17, 2026 As of September 17, 2026, Dell is affected by vulnerabilities in the following products: Dell Networking OS10 Prior to 10.6.1.3 Dell OpenManage Server Administrator (OMSA) Multiple versions and models Elastic Cloud Storage (ECS) Prior to 4.4.0.0 ObjectScale Prior to 4.4.0.0 Dell Update Package (DUP) Framework Prior to 26.07.03 Dell Wyse Management Suite Prior to 2605.0.3.683 Dell Repository Manager (DRM) Prior to 3.5.2 The Cyber Centre encourages…
Dell CA
Serial number: AV26-933Date: September 17, 2026 As of September 16, 2026, Check Point is affected by a vulnerability in the following products: Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server R81.20 with Jumbo Hotfix Take 166 and prior R82 with Jumbo Hotfix Take 126 and prior R82.10 with Jumbo Hotfix Take 44 and prior R82.20 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary…
EPSS 0.01 CVE-2026-91843 Check Point CA IT FR
Number: AL26-021Date: September 17, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian…
KEV ✓ EPSS 0.76 CVE-2026-20192 CVE-2026-76423 CVE-2026-76460 Cisco CA
Serial number: AV26-932Date: September 17, 2026 As of September 16, 2026, Cisco is affected by vulnerabilities in the following products: Cisco Secure Firewall Threat Defense (FTD) Software Prior to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0 Cisco Secure Firewall Management Center (FMC) Software Prior to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0 Cisco Identity Services Engine (ISE) Software Prior to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4…
KEV ✓ EPSS 0.76 CVE-2026-76460 Cisco CA SE HU IT FR US
Questo CSIRT ha recentemente registrato, nel contesto nazionale, un aumento significativo di sfruttamenti attivi della CVE-2026-48907 – già sanata dal vendor e trattata nell’ambito dell’AL02/260615/CSIRT-ITA – ai danni di server web esposti. Tale vulnerabilità interessa il plugin Joomla Content Editor (JCE), estensione per il noto Content Management System (CMS) Joomla!.
KEV ✓ EPSS 0.85 CVE-2026-48907 Joomla JCE IT
Rilevato lo sfruttamento in rete di una vulnerabilità, identificata tramite la CVE-2026-59822, in LiteLLM di BerriAI, server proxy impiegato come gateway per l'accesso a modelli linguistici di grandi dimensioni (LLM). La vulnerabilità consente a un attaccante remoto non autenticato di eludere i meccanismi di autenticazione e accedere agli strumenti MCP senza disporre di credenziali valide.
KEV ✓ EPSS 0.01 CVE-2026-59822 BerriAI IT US
Aggiornamenti di sicurezza Dell Technologies sanano molteplici vulnerabilità, di cui una con gravità "critica" e 11 con gravità "alta", in vari prodotti.
EPSS 0.01 CVE-2025-43936 CVE-2026-31694 CVE-2026-56795 CVE-2026-70416 CVE-2026-71179 CVE-2026-71180 CVE-2026-81235 CVE-2026-81236 CVE-2026-81238 CVE-2026-81239 CVE-2026-81240 CVE-2026-86359 Dell IT
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-85887 US
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
EPSS < 0.01 CVE-2026-83946 US
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69843 Microsoft US
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-85878 US
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
EPSS < 0.01 CVE-2026-62874 US
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-85917 US
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-85889 US
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-70200 US
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-87701 US
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-78501 Microsoft US
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
EPSS < 0.01 CVE-2026-83944 US
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-85885 Microsoft US
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-68791 US
Information published.
EPSS 0.01 CVE-2026-69399 US
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
EPSS < 0.01 CVE-2026-77903 Microsoft US
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69865 Microsoft US
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-70009 US
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
EPSS < 0.01 CVE-2026-55946 Microsoft US
Apache Software Foundation ha rilasciato aggiornamenti di sicurezza per Apache NiFi e Apache NiFi Registry, piattaforme open source per la gestione, l'elaborazione e il versionamento dei flussi di dati, che sanano alcune vulnerabilità, di cui 2 con gravità "alta". Tali vulnerabilità potrebbero consentire a un attaccante di effettuare operazioni sui file al di fuori della directory prevista, manipolare dati, eludere misure di sicurezza e, tramite richieste HTTP opportunamente predisposte, comprom
EPSS 0.01 CVE-2026-70469 CVE-2026-87976 Apache IT
HP ha rilasciato aggiornamenti di sicurezza per risolvere diverse vulnerabilità, di cui 4 con gravità "critica" e 5 con gravità "alta", che interessano HP AC Print & Scan, HP Output Central e HP Linux Imaging and Printing Software (HPLIP), soluzioni software destinate alla gestione delle funzionalità di stampa e scansione.
EPSS 0.01 CVE-2026-89082 CVE-2026-89083 CVE-2026-89084 CVE-2026-91097 CVE-2026-91098 CVE-2026-91102 CVE-2026-91104 CVE-2026-91105 CVE-2026-91106 HP IT
Weak password recovery mechanism for forgotten password in MobiAPParc Thu, 09/17/2026 - 14:21 Aviso Affected Resources IOS MobiAPParc v0 – v2.28;Android MobiAPParc v0 – v2.42. Description INCIBE has coordinated the disclosure of a high-severity vulnerability affecting SMAP’s MobiAPParc, an app that enables users to pay for parking in regulated parking zones and in municipal car parks managed by Palma City Council. The vulnerability was discovered by Llorenç Romá.This vulnerability has been…
EPSS < 0.01 CVSS 8.1 CVE-2026-14850 SMAP doprava ES
View CSAF Summary Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations. Failure to apply the remediation provided below may risk improper authentication validation which could result in disruption of operations and access to system data. The following versions of Schneider Electric…
EPSS 0.01 CVSS 5.3 CVE-2026-13348 Schneider Electric energetika výroba a průmysl US
View CSAF Summary Schneider Electric is aware of a vulnerability in its Modicon M340 https://www.se.com/ww/en/product-range/1468-modicon-m340-pac/, BMXNOR0200H https://www.se.com/us/en/product/BMXNOR0200H/communication-module-modicon-m340-iec-608705101-104-dnp3-for-severe-environments/: Modicon M340 X80 Ethernet Communication Modules, BMXNGD0100 https://www.se.com/us/en/product/BMXNGD0100/communication-module-modicon-m580-global-data-service/: M580 Global Data module, BMXNOC0401 https://www.se…
EPSS < 0.01 CVSS 7.5 CVE-2025-6625 Schneider Electric energetika vodárenství výroba a průmysl US
View CSAF Summary Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities. Failure to apply the remediation provided below may risk arbitrary or remote code execution over the local network, which could result in device manipulation and unauthorized data access. The following versions…
EPSS 0.02 CVSS 6.4 CVE-2026-13336 CVE-2026-13337 Schneider Electric výroba a průmysl US
View CSAF Summary Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware. The following versions of Bransys ELD are affected: Android <11.00.00 (CVE-2026-86520, CVE-2026-86689, CVE-2026-77960) iOS <1.1.54 (CVE-2026-86520, CVE-2026-86689, CVE-2026-77960) CVSS Vendor Equipment Vulnerabilities v3 7.5 Bransys Bransys ELD Use of Hard-coded Credentials, Cleartext Transmission of Sensitive Information Background Critical Infrastructure Sectors:…
EPSS < 0.01 CVSS 7.5 CVE-2026-77960 CVE-2026-86520 CVE-2026-86689 Bransys doprava US
View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker exploiting these vulnerabilities can cause impact on confidentiality, integrity and availability of the product. Following FACTS Control systems with GWS component deployed from year 2020 onwards are likely affected by the above vulnerabilities. Product deployments without GWS component are not affected. • SVC Light (STATCOM) • Fixed Series…
EPSS 0.01 CVSS 9.9 CVE-2024-3980 CVE-2024-3982 CVE-2024-4872 CVE-2024-7940 CVE-2024-7941 Hitachi Energy energetika US
View CSAF Summary Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, destroy, or delete control programs. The following versions of Mitsubishi Electric GX Works3 and Motion Control Settings are affected: Mitsubishi Electric GX Works3 vers:all/* (CVE-2026-15688)…
EPSS < 0.01 CVSS 8.8 CVE-2026-15688 Mitsubishi Electric výroba a průmysl US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly. The following versions of Mitsubishi Electric CC-Link IE TSN…
EPSS < 0.01 CVE-2026-13584 Mitsubishi Electric výroba a průmysl US
Aggiornamenti di sicurezza Docker sanano due vulnerabilità, di cui una con gravità "critica" e una con gravità "alta", in Docker Sandboxes.
EPSS < 0.01 CVE-2026-77179 CVE-2026-79994 Docker IT FR
Oracle heeft 19 kwetsbaarheden verholpen in Oracle VM VirtualBox. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle VM VirtualBox, waaronder mogelijkheden voor lokale en geauthenticeerde kwaadwillenden om ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van laag tot hoog. Van de in totaal 19 kwetsbaarheden kan volgens Oracle één kwetsbaarheid zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden…
EPSS < 0.01 CVE-2026-87273 CVE-2026-87277 Oracle NL
Rilasciati aggiornamenti di sicurezza per Craft CMS, sistema di gestione dei contenuti per la realizzazione e gestione di siti e applicazioni web, che sanano alcune vulnerabilità, di cui 4 con gravità "alta". Tali vulnerabilità potrebbero consentire a un attaccante di accedere a informazioni sensibili, eludere restrizioni di sicurezza, elevare i privilegi utente ed eseguire codice arbitrario sui sistemi interessati.
EPSS 0.01 CVE-2026-92591 CVE-2026-92592 CVE-2026-92593 CVE-2026-92594 Craft CMS IT
Cisco heeft 21 kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC). De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Cisco ISE en ISE-PIC, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van middel tot kritiek. Van de in totaal 21 kwetsbaarheden zijn 13 als kritiek…
KEV ✓ EPSS 0.76 CVE-2026-20130 CVE-2026-20192 CVE-2026-76423 CVE-2026-76460 Cisco NL
ISC ha rilasciato aggiornamenti di sicurezza per BIND 9 e BIND Supported Preview Edition, software per la gestione e la risoluzione delle richieste DNS, che sanano alcune vulnerabilità, di cui 7 con gravità "alta". Tali vulnerabilità possono causare la terminazione anomala di alcuni processi o un consumo eccessivo delle risorse, fino a compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.07 CVE-2026-19666 CVE-2026-19667 CVE-2026-76163 CVE-2026-77692 CVE-2026-80274 CVE-2026-81563 CVE-2026-81736 ISC IT
Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. [...]
CVE-2025-20337 * CVE-2026-20176 * CVE-2026-20211 * CVE-2026-20284 * CVE-2026-20307 * CVE-2026-76423 * CVE-2026-76460 * Cisco US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung rlottie. Interaction with the rlottie library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-91826.
EPSS < 0.01 CVSS 7.8 CVE-2026-91826 Samsung US