Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
De multiples vulnérabilités ont été découvertes dans HPE Aruba Networking ClearPass Policy Manager. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
EPSS 0.01 CVE-2026-73769 CVE-2026-73786 CVE-2026-73787 CVE-2026-73788 CVE-2026-73789 HPE FR
Une vulnérabilité a été découverte dans Apereo CAS. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Apereo FR
Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks. [...]
KEV ✓ EPSS 0.89 CVE-2026-20079 Cisco veřejná správa US
The Carnegie Mellon University CERT Coordination Center (CERT/CC) is warning that Skullcandy Dime 3 wireless earbuds accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction. [...]
Serial number: AV26-023Date: January 13, 2026Updated: September 9, 2026 On January 13, 2026, Fortinet published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following: FortiFone 7.0 – versions 7.0.0 to 7.0.1 FortiFone 3.0 – versions 3.0.13 to 3.0.23 FortiOS 7.6 – versions 7.6.0 to 7.6.3 FortiOS 7.4 – versions 7.4.0 to 7.4.8 FortiOS 7.2 – versions 7.2.0 to 7.2.11 FortiOS 7.0 – versions 7.0.0 to 7.0.17 FortiOS 6.4 – versions 6.4.0 to…
KEV ✓ EPSS 0.44 CVE-2025-25249 CVE-2025-47855 CVE-2025-64155 Fortinet CA
EPSS < 0.01 CVE-2026-0304 US
EPSS < 0.01 CVE-2026-0307 US
US
EPSS 0.01 CVE-2026-0302 US
EPSS < 0.01 CVE-2026-0303 US
EPSS < 0.01 CVE-2026-0305 US
EPSS < 0.01 CVE-2026-0306 US
EPSS 0.01 CVE-2026-0309 US
EPSS 0.01 CVE-2026-0308 US
On September 16, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: BroadWorks CommPilot Application Software Identity Services Engine (ISE) (security hardening release) Nexus Dashboard (security hardening release) Secure Firewall Adaptive Security Appliance (ASA) (security hardening release) Secure Firewall Management Center (FMC) (security…
Cisco US
Serial Number: AV26-901Date: September 9, 2026 As of September 4, 2026, misp is affected by vulnerabilities in the following product: misp Prior to or equal to 2.5.45 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Authorise the sharing group whenever one is submitted
MISP CA
Serial Number: AV26-900Date: September 9, 2026 As of September 8, 2026, NVIDIA is affected by vulnerabilities in the following product: Triton Inference Server Versions 0.0 to 26.03 Versions 0.0 to 26.06 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Bulletin: Triton Inference Server - September 2026 NVIDIA Product Security
NVIDIA CA
Ivanti ha rilasciato aggiornamenti di sicurezza che sanano 10 vulnerabilità, di cui 6 con gravità "critica" e 4 con gravità "alta" in alcuni prodotti. Tali vulnerabilità potrebbero consentire a un attaccante remoto, in alcuni casi non autenticato, di eseguire codice arbitrario sui sistemi interessati, di eludere i meccanismi di autorizzazione o di ottenere privilegi elevati.
EPSS 0.03 CVE-2026-12645 CVE-2026-12646 CVE-2026-12647 CVE-2026-12648 CVE-2026-12650 CVE-2026-12651 CVE-2026-12744 CVE-2026-12745 CVE-2026-18851 CVE-2026-83527 Ivanti IT
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Illustrator. De kwetsbaarheden bevinden zich in de wijze waarop Adobe Illustrator bestanden verwerkt. Eén kwetsbaarheid betreft een onjuiste autorisatie die het mogelijk maakt dat een aanvaller willekeurige code uitvoert wanneer een gebruiker een kwaadaardig bestand opent. Een andere kwetsbaarheid betreft onjuiste inputvalidatie, waardoor eveneens code-uitvoering mogelijk is bij het openen van speciaal vervaardigde bestanden. Daarnaast is…
Adobe NL
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Experience Manager. Adobe Experience Manager bevat meerdere Cross-Site Scripting (XSS) kwetsbaarheden, waaronder DOM-based en stored XSS. Deze kwetsbaarheden stellen een aanvaller in staat om kwaadaardige JavaScript-code te injecteren en uit te voeren binnen de browsers van gebruikers die een speciaal vervaardigde webpagina bezoeken of met deze pagina's interacteren. De stored XSS kwetsbaarheden ontstaan door onvoldoende input sanitatie en…
Adobe NL
Serial Number: AV26-899Date: September 9, 2026 Commvault security advisory (AV26-899) As of September 8, 2026, Commvault is affected by vulnerabilities in the following product: Commvault Cloud 36.0 Prior to 11.36.123 40.0 Prior to 11.40.72 44.0 Prior to 11.44.20 46.0 Prior to 11.46.20 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Commvault Cloud Security Advisories
Commvault CA
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe ColdFusion. De kwetsbaarheden in Adobe ColdFusion omvatten onder andere een stored Cross-Site Scripting (XSS) waarbij een aanvaller met lage privileges kwaadaardige scripts kan injecteren in formulier velden die vervolgens uitgevoerd worden in de browser van een gebruiker. Daarnaast is er een kwetsbaarheid in de dynamische code-evaluatie die het mogelijk maakt voor een aanvaller met lage privileges om zonder gebruikersinteractie…
Adobe NL
Citrix har publicerat information om en kritisk sårbarhet som påverkar Citrix NetScaler ADC och NetScaler Gateway. Sårbarheten, CVE-2026-19490, har fått CVSS v.4-klassning på 9.3. [1, 2]
KEV ✓ EPSS 0.33 CVSS 9.3 CVE-2026-19490 Citrix SE US
Serial Number: AV26-898Date: September 9, 2026 As of September 8, 2026, Fortinet is affected by vulnerabilities in the following products: FortiOS 7.6 Versions 7.6.1 to 7.6.6 FortiProxy 7.6 Versions 7.6.2 to 7.6.6 FortiPAM Chrome Extension 8.0 All versions FortiPAM Chrome Extension 7.4 All versions FortiSandbox 5.0 Versions 5.0.0 to 5.0.5 FortiSandbox 4.4 Versions 4.4.0 to 4.4.8 FortiSandbox Cloud 5.0 Versions 5.0.4 to 5.0.5 FortiSandbox PaaS 5.0 Versions 5.0.4 to 5.0.5 FortiMonitorOnSight 7.2…
Fortinet CA
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Commerce. De kwetsbaarheden betreffen onder andere stored Cross-Site Scripting (XSS) waarbij aanvallers kwaadaardige JavaScript-code kunnen injecteren in formulier velden binnen de applicatie. Deze code wordt uitgevoerd in de context van de browser van het slachtoffer en kan ongeautoriseerde acties uitvoeren, zoals het kapen van sessies of het escaleren van privileges. Daarnaast zijn er meerdere incorrecte autorisatieproblemen…
Adobe NL
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Photoshop Desktop. De kwetsbaarheden bevinden zich in de verwerking van speciaal vervaardigde bestanden binnen Adobe Photoshop Desktop. Deze omvatten out-of-bounds write, integer overflow of wraparound, uncontrolled search path element en heap-based buffer overflow. Door het openen van kwaadaardig opgemaakte bestanden kan een aanvaller code uitvoeren met de privileges van de gebruiker die de applicatie draait. De kwetsbaarheden kunnen…
Adobe NL
Ivanti heeft een kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobile. De kwetsbaarheid betreft een ontbrekende autorisatiecontrole in Ivanti Endpoint Manager Mobile versies ouder dan 12.10.0.0, 12.9.0.2 en 12.8.0.4. Hierdoor kunnen geauthenticeerde gebruikers hun privileges verhogen tot een administratief niveau.
Ivanti NL
Ivanti heeft meerdere kwetsbaarheden verholpen in Ivanti Neurons for ITSM. Een kwaadwillende kan de kwetsbaarheden misbruiken om ongeautoriseerde acties uit te voeren, waaronder het uitvoeren van willekeurige code op de server.
Ivanti NL
Ivanti heeft een kwetsbaarheid verholpen in Sentry versies voorafgaand aan R10.8.2, R10.7.3 en R10.6.4. De kwetsbaarheid betreft een authenticatie-bypass die het mogelijk maakt voor externe aanvallers zonder authenticatie om administratieve toegang tot het systeem te verkrijgen. Deze kwetsbaarheid treft meerdere releases van het Sentry-platform en kan leiden tot ongeautoriseerde controle over administratieve functies.
Ivanti NL
On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products[3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed "OVERPASS" by the Onapsis Research Labs (ORL), which discovered and responsibly disclosed it[3]. The second, CVE-2026-58240 (CVSS 9.8), nicknamed "S4GET", is a missing authentication…
EPSS 0.01 CVSS 10.0 CVE-2026-44756 CVE-2026-58240 SAP EU
Aggiornamenti di sicurezza Google sanano 104 vulnerabilità, di cui 31 con gravità “critica” e 73 con gravità “alta”, nei componenti Android. Tali vulnerabilità, qualora sfruttate, potrebbero consentire di eseguire codice arbitrario, elevare i privilegi, accedere a informazioni riservate o compromettere la disponibilità del servizio sui dispositivi interessati.
SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence. De kwetsbaarheid met kenmerk CVE…
EPSS 0.01 CVE-2026-44756 CVE-2026-58240 CVE-2026-66768 CVE-2026-76969 SAP NL
Rilasciati aggiornamenti di sicurezza Fortinet che sanano alcune vulnerabilità, di cui una con gravità “critica” e una con gravità “alta”, in diversi prodotti.
EPSS < 0.01 CVE-2026-26084 CVE-2026-84393 Fortinet IT
Adobe ha rilasciato aggiornamenti di sicurezza per risolvere molteplici vulnerabilità, di cui 6 con gravità “critica” e 42 con gravità “alta”, in numerosi prodotti.
Adobe IT
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel…
KEV ✓ EPSS 0.89 CVE-2025-25249 CVE-2026-19490 CVE-2026-20079 CVE-2026-87491 Fortinet Citrix Google Cisco veřejná správa US
Gli aggiornamenti di sicurezza rilasciati da N-able sanano tre vulnerabilità, di cui una con gravità "critica" ed una con gravità "alta", in N-central, piattaforma per il monitoraggio e la gestione remota delle infrastrutture IT. Tra queste si segnala la CVE-2026-86218 che risulta essere attivamente sfruttata in rete.
KEV ✓ EPSS 0.15 CVE-2026-86218 N-able IT CA US
Fortinet heeft kwetsbaarheden verholpen in FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM en FortiSOAR. De kwetsbaarheden betreffen verschillende typen fouten in meerdere Fortinet-producten. De ernstigste kwetsbaarheid met kenmerk CVE-2026-26084 heeft een CVSS-score van 8,9. Het betreft een autorisatiekwetsbaarheid in Fortinet FortiSandbox waardoor een ongeauthenticeerde kwaadwillende via speciaal…
EPSS < 0.01 CVSS 8.9 CVE-2026-26084 Fortinet NL FI
Over 36,000 Plex Media servers exposed online remain unpatched against multiple security vulnerabilities and are vulnerable to attacks. [...]
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs, including 104 rated Critical and 860 rated Important, making it the company’s largest Patch Tuesday release on record. Microsoft lists 974 CVEs in its full September security release. However, 10 of those affect cloud services or involve fixes that Microsoft applies itself, leaving 964 vulnerabilities that customers need to patch. The release includes fixes for two actively exploited Windows zero-days. Both are local elevation-of…
KEV ✓ EPSS < 0.01 CVSS 7.8 CVE-2026-81963 CVE-2026-85880 Microsoft US CA
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 230 nuove vulnerabilità di sicurezza, di cui 5 con gravità “critica” e 41 con gravità “alta”.
Google IT
An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026 Patch Tuesday security updates. [...]
EPSS 0.01 CVE-2026-69414 Microsoft US
Il team di sviluppo n8n-io ha rilevato nuove vulnerabilità, tra cui 5 con gravità “alta”, che interessano la piattaforma open source per l’automazione dei workflow n8n.
EPSS 0.01 CVE-2026-86075 CVE-2026-86076 CVE-2026-86081 CVE-2026-86082 CVE-2026-86083 n8n IT
Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 973 nuove vulnerabilità, di cui 2 di tipo 0-day.
Microsoft IT
Google has patched 230 vulnerabilities on Tuesday, including another actively exploited Chrome zero-day bug, the seventh such vulnerability patched since the start of the year. [...]
CVE-2026-2441 * CVE-2026-3909 * CVE-2026-3910 * CVE-2026-5281 * CVE-2026-85046 * CVE-2026-87491 * Google US
A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézet riasztást ad ki a Microsoft szoftvereket érintő kritikus kockázati besorolású sérülékenységek kapcsán azok súlyossága, a szoftverek széleskörű elterjedtsége, valamint az egyes biztonsági hibákat érintő aktív kihasználások miatt. A Microsoft tárgyhavi biztonsági csomagjában összesen 974 különböző biztonsági hibát javított, köztük 2 db nulladik napi (zero-day) sebezhetőséget is, amelyet a Microsoft […]
Microsoft HU
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.8.
CVSS 5.8 Microsoft US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI LabVIEW. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-18445.
EPSS < 0.01 CVSS 3.3 CVE-2026-18445 NI US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI LabVIEW. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-18444.
EPSS < 0.01 CVSS 3.3 CVE-2026-18444 NI US
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-13086.
EPSS 0.01 CVSS 8.8 CVE-2026-13086 WatchGuard US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-4153.
EPSS 0.01 CVSS 7.8 CVE-2026-4153 GIMP US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-70477.
EPSS 0.01 CVSS 9.8 CVE-2026-70477 Flowise US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must open a malicious file or visit a malicious page. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-60392.
EPSS < 0.01 CVSS 7.8 CVE-2026-60392 Oracle US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-60412.
EPSS < 0.01 CVSS 7.8 CVE-2026-60412 Oracle US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-60413.
EPSS < 0.01 CVSS 7.8 CVE-2026-60413 Oracle US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-60414.
EPSS < 0.01 CVSS 7.8 CVE-2026-60414 Oracle US
This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-71116.
EPSS < 0.01 CVSS 7.5 CVE-2026-71116 Oracle US
This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-71132.
EPSS < 0.01 CVSS 5.3 CVE-2026-71132 Oracle US
This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.1. The following CVEs are assigned: CVE-2026-71114.
EPSS < 0.01 CVSS 6.1 CVE-2026-71114 Oracle US
This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-60159.
EPSS < 0.01 CVSS 7.5 CVE-2026-60159 Oracle US
This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.1. The following CVEs are assigned: CVE-2026-60162.
EPSS < 0.01 CVSS 6.1 CVE-2026-60162 Oracle US