Rilasciato aggiornamento di sicurezza Hikvision che sana una vulnerabilità con gravità "alta" in HikCentral Access Control, piattaforma per la gestione centralizzata dei sistemi di controllo degli accessi.
EPSS 0.00 CVE-2026-85545 Hikvision IT
Autodesk risolve una vulnerabilità di sicurezza con gravità “alta” nel prodotto Fusion. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato la modifica non autorizzata di dati e/o l'accesso ad informazioni sensibili sui sistemi interessati.
EPSS 0.00 CVE-2026-85217 Autodesk IT
REZUMAT În data de 8 septembrie 2026, compania SAP a publicat actualizările de securitate af...
SAP RO
Arista heeft kwetsbaarheden verholpen in de Arista EOS-platform. De kwetsbaarheid met kenmerk CVE-2026-73456 bevindt zich in de verwerking van verzoeken die via gNPSI worden aangeboden. Onder de kwetsbare configuratie kan een niet-geauthenticeerde client een kwaadaardig verzoek aanbieden waarmee code-injectie kan worden veroorzaakt. Een kwaadwillende met netwerktoegang tot de gNPSI-service kan zonder authenticatie een speciaal vervaardigd verzoek versturen waarmee willekeurige code kan worden…
EPSS 0.01 CVE-2026-73456 CVE-2026-73457 Arista NL
Rilevata una vulnerabilità con gravità "alta" nel noto Content Management System Craft CMS. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto, autenticato con privilegi limitati, di eseguire codice arbitrario sui sistemi interessati.
EPSS 0.00 CVE-2026-79987 Craft CMS IT
Classification: Critical, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv3.1: 9.8, CVEs: CVE-2026-85102, CVE-2026-8510, Summary: Check Point research team has identified and remediated two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, which could potentially allow unauthenticated remote code execution under specific conditions. These issues were discovered internally, and we have no indication of active exploitation. To ensure continued protection, we…
EPSS 0.00 CVSS 9.8 CVE-2026-8510 CVE-2026-85102 CVE-2026-85103 Check Point FI
CISA added CVE-2026-42018 to the Known Exploited Vulnerabilities catalog. Affected product: JFrog Artifactory. Remediation due date: 2026-09-25.
KEV ✓ EPSS 0.01 CVE-2026-42018 JFrog US
CISA added CVE-2026-42016 to the Known Exploited Vulnerabilities catalog. Affected product: JFrog Artifactory. Remediation due date: 2026-09-25.
KEV ✓ EPSS 0.01 CVE-2026-42016 JFrog US
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
EPSS 0.01 CVE-2026-22575 CVE-2026-26084 CVE-2026-84385 CVE-2026-84386 CVE-2026-84387 CVE-2026-84388 CVE-2026-84389 CVE-2026-84390 CVE-2026-84391 CVE-2026-84392 CVE-2026-84393 Fortinet FR
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
IBM FR
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à l'intégrité des données.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
GitLab FR
Number: AL26-020Date: September 10, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Cyber…
KEV ✓ EPSS 0.01 CVE-2026-67276 CVE-2026-67277 CVE-2026-86060 MikroTik CA US
Serial number: AV26-909Date: September 10, 2026 As of September 9, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following products: ClearPass Policy Manager (CPPM) Prior to or equal to 6.11.14 Prior to or equal to 6.12.8 HPE IceWall products Multiple versions and models The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. HPESBNW05130 rev.1 - Multiple Vulnerabilities in HPE…
HPE CA
Welcome to this week’s edition of the Threat Source newsletter. Ask anybody in this industry what the work does to the health of the people who do it and you get one word back: burnout. It's a fine word, in and of itself. It’s easy to reach for, understandable to everyone… and it's the wrong one, most of the time. So, story time. Last year I gave an interview with the amazing Hazel Burton about VPNFilter, and my run-in with burnout. I was a manager during that time, and it took a toll on me and…
KEV ✓ · ransomware EPSS 0.76 CVSS 10.0 CVE-2026-20079 CVE-2026-20316 Cisco US
Serial number: AV26-908Date: September 10, 2026 As of September 10, 2026, WebPros is affected by vulnerabilities in the following products: cPanel & WebHost Manager (WHM) software Prior to 11.110.0.143 Prior to 11.134.0.55 Prior to 11.136.0.39 Prior to 11.138.0.4 Prior to WP2: 11.138.1.9 ConfigServer Security & Firewall (CSF) software Versions 14.00 to 16.29 (CVE-2026-65638) Versions 2.15 to 16.29 (CVE-2026-65639) The Cyber Centre encourages users and administrators to review the provided web…
EPSS 0.03 CVE-2026-65638 CVE-2026-65639 CVE-2026-67401 WebPros CA
Fortinet heeft een kwetsbaarheid verholpen in FortiOS (Specifiek voor FortiSASE en FortiSwitchManager). De kwetsbaarheid bevindt zich in de cw_acd daemon in FortiOS en FortiSwitchManager. Deze daemon is kwetsbaar voor exploitatie door externe, niet-geauthenticeerde aanvallers. Door het verzenden van speciaal vervaardigde pakketten of verzoeken, kunnen aanvallers willekeurige code of commando's op de getroffen systemen uitvoeren. **UPDATE** Het Amerikaanse CISA heeft op 9 september de…
Fortinet NL
Serial number: AV26-907Date: September 10, 2026 As of September 10, 2026, Advantech is affected by vulnerabilities in the following product: Advantech WISE-6610 industrial gateway Multiple versions and models The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerabilities Identified in WISE-6610 Security Advisories - Advantech
Advantech CA
Serial number: AV26-906Date: September 10, 2026 As of September 9, 2026, Fortra is affected by a vulnerability in the following product: GoAnywhere MFT Endpoint Prior to 7.10.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Path Traversal in Fortra's GoAnywhere MFT Endpoint Product Security Advisories | Fortra
Fortra CA
Palo Alto Networks ha rilasciato aggiornamenti di sicurezza per PAN-OS, sistema operativo impiegato nei firewall di nuova generazione e nelle soluzioni di gestione centralizzata della sicurezza del produttore, che sanano alcune vulnerabilità, di cui una con gravità "alta".
EPSS 0.00 CVE-2026-0310 Palo Alto Networks IT CA US
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational…
KEV ✓ EPSS 0.01 CVE-2026-67277 CVE-2026-86060 MikroTik veřejná správa US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session. The following versions of AVEVA Pipeline Integrity Monitor are affected: AVEVA Pipeline Integrity Monitor <=2025_SP1_P1_build_7.1.9580.8513 (CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, CVE-2026-81824) CVSS Vendor Equipment Vulnerabilities v3 8.4 AVEVA AVEVA Pipeline Integrity Monitor Use of Hard-coded…
EPSS 0.00 CVSS 8.4 CVE-2026-81821 CVE-2026-81822 CVE-2026-81823 CVE-2026-81824 AVEVA výroba a průmysl US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition. The following versions of ST Engineering iDirect iQ-Series Terminals (Update A) are affected: Evolution iQ‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058) 3315‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058) 9‑Series terminals <=4…
EPSS 0.01 CVSS 8.8 CVE-2026-38056 CVE-2026-38057 CVE-2026-38058 CVE-2026-38059 ST Engineering iDirect telekomunikace obrana energetika veřejná správa US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition. The following versions of NextGen Healthcare Mirth Connect are affected: Mirth Connect <=v4.7.1 (CVE-2026-82583, CVE-2026-78224, CVE-2026-82578) CVSS Vendor Equipment Vulnerabilities v3 8.3 NextGen Healthcare NextGen Healthcare Mirth Connect Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Improper Restriction…
EPSS 0.00 CVSS 8.3 CVE-2026-78224 CVE-2026-82578 CVE-2026-82583 NextGen Healthcare zdravotnictví US
View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated remote attacker to write past the end of a heap allocation when Orthanc decodes an attacker-supplied PNG or JPEG image, resulting in a crash of the Orthanc process and a denial-of-service condition. The following versions of Orthanc DICOM Server are affected: Orthanc DICOM Server <1.13.0. (CVE-2026-87020) CVSS Vendor Equipment Vulnerabilities v3 8.1 Orthanc Orthanc DICOM Server Integer Overflow or…
EPSS 0.01 CVSS 8.1 CVE-2026-87020 Orthanc zdravotnictví US
Sårbarhet Patchtisdag Cisco Microsoft SAP Ivanti Adobe
CONTEXT Compania Cisco a actualizat, pe 9 septembrie 2026, recomandările aferente vulnerabilităț...
Cisco RO
Rapid7 ha rilasciato aggiornamenti di sicurezza per Velociraptor, piattaforma open source per attività di digital forensics e risposta agli incidenti, che sanano alcune vulnerabilità, di cui una con gravità "critica" e una con gravità "alta".
EPSS 0.01 CVE-2026-19583 CVE-2026-19584 Rapid7 IT
Risolta vulnerabilità di sicurezza con gravità "alta", in diversi prodotti ESET. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di elevare i propri privilegi sui sistemi interessati.
Aggiornamenti di sicurezza Fortra sanano una vulnerabilità, con gravità "alta", in GoAnywhere MFT, piattaforma per il trasferimento sicuro e la gestione centralizzata di file.
EPSS 0.00 CVE-2026-15913 Fortra IT
Use of Hard-coded Credentials vulnerability (CVE-2026-17038) has been found in drEryk Gabinet software.
EPSS 0.00 CVE-2026-17038 drEryk zdravotnictví PL
[VDE-2026-088] The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25. The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25 All other vulnerabilities are to be fixed in the upcoming releases.
EPSS 0.48 CVE-2025-15467 CVE-2025-69419 CVE-2026-0915 CVE-2026-33186 CVE-2026-33671 CVE-2026-39821 CVE-2026-4800 METTLER TOLEDO DE
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December. [...]
KEV ✓ · ransomware EPSS 0.91 CVE-2022-23176 CVE-2025-14733 CVE-2025-9242 WatchGuard US
On 9 September 2026, Check Point released emergency security updates addressing two critical vulnerabilities affecting Check Point Security Gateway, Security Management Server, and Spark Firewall deployments configured to use Remote Access VPN or Site-to-Site VPN. Both vulnerabilities carry a CVSS score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary code on affected appliances. CERT-EU strongly recommends applying the available hotfixes as soon as possible,…
CVSS 9.8 Check Point EU
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-19590.
EPSS 0.00 CVSS 7.8 CVE-2026-19590 OpenAI US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must open a malicious folder. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-19591.
EPSS 0.00 CVSS 7.8 CVE-2026-19591 OpenAI US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-19592.
EPSS 0.00 CVSS 7.8 CVE-2026-19592 OpenAI US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must open a malicious folder. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-19593.
EPSS 0.00 CVSS 7.8 CVE-2026-19593 OpenAI US
This vulnerability allows local attackers to escalate privileges on affected installations of TrendAI Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71416.
CVSS 7.8 CVE-2025-71416 TrendAI US
This vulnerability allows local attackers to escalate privileges on affected installations of TrendAI Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71415.
CVSS 7.8 CVE-2025-71415 TrendAI US
This vulnerability allows local attackers to escalate privileges on affected installations of TrendAI Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71414.
CVSS 7.8 CVE-2025-71414 TrendAI US
This vulnerability allows local attackers to escalate privileges on affected installations of PAPPL. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 PAPPL US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PAPPL. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
CVSS 9.8 PAPPL US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ASUS Control Center Express Agent. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19397.
EPSS 0.00 CVSS 9.8 CVE-2026-19397 ASUS US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-81987.
EPSS 0.00 CVSS 7.8 CVE-2026-81987 Adobe US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-80160.
EPSS 0.00 CVSS 3.3 CVE-2026-80160 Adobe US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-80162.
EPSS 0.00 CVSS 3.3 CVE-2026-80162 Adobe US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-81985.
EPSS 0.00 CVSS 7.8 CVE-2026-81985 Adobe US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-81990.
EPSS 0.00 CVSS 7.8 CVE-2026-81990 Adobe US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-81989.
EPSS 0.00 CVSS 7.8 CVE-2026-81989 Adobe US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-81986.
EPSS 0.00 CVSS 7.8 CVE-2026-81986 Adobe US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-79909.
EPSS 0.00 CVSS 7.8 CVE-2026-79909 Adobe US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-79910.
EPSS 0.00 CVSS 3.3 CVE-2026-79910 Adobe US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-81975.
EPSS 0.00 CVSS 7.8 CVE-2026-81975 Adobe US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-81984.
EPSS 0.00 CVSS 3.3 CVE-2026-81984 Adobe US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-81978.
EPSS 0.00 CVSS 3.3 CVE-2026-81978 Adobe US
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-81991.
EPSS 0.00 CVSS 3.3 CVE-2026-81991 Adobe US