CVE-2026-66308 Skype for Business and Lync Denial of Service Vulnerability
Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-66308 US
Výsledky hledání
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
· zachyceno
· zachyceno
CVE-2026-66306 Skype for Business Information Disclosure Vulnerability
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-66306 US
· zachyceno
CVE-2026-66302 Skype for Business Remote Code Execution Vulnerability
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-66302 US
· zachyceno
CVE-2026-66304 Skype for Business Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-66304 US
· zachyceno
CVE-2026-62744 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-62744 Microsoft US
· zachyceno
CVE-2026-62694 Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVE-2026-62694 US
· zachyceno
CVE-2026-62706 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-62706 Microsoft US
NCSC-2026-0346 [1.01] [M/H] Kwetsbaarheden verholpen in Siemens producten
Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance. De kwetsbaarheden stellen een kwaadwillende in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: * Denial-of-Service (DoS) * Manipulatie van gegevens * Omzeilen van een beveiligingsmaatregel * (Remote) code execution (root/admin rechten) * (Remote) code execution (gebruikersrechten) * Toegang tot gevoelige gegevens * Verhogen van rechten…
Siemens NL
SPOJENO PŘES CVE Sanate vulnerabilità in TYPO3 CMS
Aggiornamenti di sicurezza TYPO3 sanano 2 vulnerabilità con gravità “alta” in TYPO3 CMS, sistema open source per la gestione di contenuti web. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malevolo autenticato di accedere a informazioni sensibili ed elevare i propri privilegi sui sistemi interessati.
EPSS < 0.01 CVE-2026-77132 CVE-2026-85400 TYPO3 IT FR
Vulnerabilità in prodotti Schneider Electric
Schneider Electric ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità nei propri prodotti, di cui 1 con gravità “critica” e 3 con gravità “alta”.
EPSS 0.01 CVE-2026-19233 CVE-2026-3869 CVE-2026-77120 CVE-2026-8044 Schneider Electric IT
Risolte vulnerabilità in prodotti Qualcomm Technologies Inc.
Aggiornamenti di sicurezza Qualcomm Technologies Inc. sanano 14 vulnerabilità con gravità “alta” che interessano componenti software impiegati nelle piattaforme e nei chipset del produttore, utilizzati in dispositivi mobili, sistemi di connettività wireless, piattaforme automotive e soluzioni di calcolo. Tali vulnerabilità, qualora sfruttate, potrebbero consentire di accedere a informazioni riservate, compromettere la disponibilità del servizio sui sistemi interessati.
EPSS < 0.01 CVE-2025-59607 CVE-2026-24073 CVE-2026-24074 CVE-2026-24075 CVE-2026-24081 CVE-2026-25275 CVE-2026-25278 CVE-2026-25280 CVE-2026-25281 CVE-2026-25282 CVE-2026-25283 CVE-2026-25284 CVE-2026-25290 CVE-2026-25294 Qualcomm IT
· zachyceno
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2026-81963 Microsoft Windows Link Following Vulnerability CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CVE-2026-86218 N-able N-central Static Code Injection Vulnerability These types of vulnerabilities…
KEV ✓ EPSS 0.35 CVE-2026-75650 CVE-2026-81963 CVE-2026-85880 CVE-2026-86218 Adobe Magento Microsoft N-able veřejná správa US
· zachyceno
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
Executive summary China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy. While “distillation” is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation…
US
· zachyceno
CareCam Pro IP Cameras
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to take full control of the device. The following versions of CareCam Pro IP Cameras are affected: ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn13796_/_Bootloader_U-Boot_2010.06_compiled_2020-08-26 (CVE-2026-85083) CVSS Vendor Equipment Vulnerabilities v3 6.8 CareCam CareCam Pro IP Cameras Use of Hard-coded Credentials Background Critical Infrastructure Sectors: Commercial Facilities Countries…
EPSS < 0.01 CVSS 6.8 CVE-2026-85083 CareCam US
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
OverviewWhile conducting research into a recent N-able N-central authentication bypass vulnerability (CVE-2026-18577), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker to bypass authentication and create a new attacker-controlled System administrator account on an affected server.CVE IDDescriptionCWECVSSv4CVE-2026-86206Semicolon/Forwarded access-control bypassCWE…
KEV ✓ EPSS 0.15 CVE-2026-18577 CVE-2026-86206 CVE-2026-86207 N-able US
Risolte vulnerabilità in Dell Secure Connect Gateway
Rilasciati aggiornamenti di sicurezza che sanano numerose vulnerabilità, di cui 3 con gravità "critica" e 34 con gravità "alta" in Dell Secure Connect Gateway, soluzione utilizzata per la gestione e il supporto remoto dei sistemi.
Dell IT
Risolte vulnerabilità in prodotti JetBrains
Aggiornamenti di sicurezza JetBrains sanano alcune vulnerabilità, di cui 2 con gravità “critica” e 7 con gravità “alta”, che interessano vari prodotti. Tali vulnerabilità potrebbero consentire a un utente malintenzionato di accedere a informazioni riservate, alterare dati, eludere i meccanismi di sicurezza ed eseguire codice arbitrario sui sistemi interessati.
EPSS 0.01 CVE-2026-86478 CVE-2026-86479 CVE-2026-86480 CVE-2026-86482 CVE-2026-86492 CVE-2026-86494 CVE-2026-86498 CVE-2026-86502 CVE-2026-86504 JetBrains IT
SPOJENO PŘES CVE MikroTik router flaws allow takeover without a password
CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet. Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The vulnerabilities can affect users anywhere if their router is running a vulnerable version of RouterOS and its SSH remote-management service is accessible from the internet. Attackers are exploiting two…
KEV ✓ EPSS 0.09 CVSS 9.2 CVE-2026-67276 CVE-2026-86060 MikroTik US HR IT
NCSC-2026-0345 [1.00] [M/H] Kwetsbaarheden verholpen in MikroTik RouterOS
MikroTik heeft meerdere kwetsbaarheden verholpen in RouterOS. De eerste kwetsbaarheid betreft een fout in de SSH-authenticatiemechanisme waarbij de exponent van RSA-sleutels niet werd geverifieerd. Hierdoor kunnen aanvallers RSA-handtekeningen vervalsen en ongeautoriseerde SSH-toegang verkrijgen. De tweede kwetsbaarheid betreft een probleem met gebruikersnamen die beginnen met een verboden teken, waardoor de trusted policy mask kan worden gemanipuleerd en privilege escalation mogelijk is binnen…
MikroTik NL
Aggiornamenti per prodotti Siemens
Siemens ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità nei propri prodotti, di cui 2 con gravità “critica” e 8 con gravità “alta”.
EPSS 0.01 CVE-2026-34223 CVE-2026-50093 CVE-2026-62645 CVE-2026-62646 CVE-2026-62647 CVE-2026-62648 CVE-2026-62649 CVE-2026-62650 CVE-2026-67367 Siemens IT
NCSC-2026-0344 [1.00] [H/H] Kwetsbaarheid verholpen in Adobe Commerce en Magento
Adobe heeft een kwetsbaarheid verholpen in Adobe Commerce en Magento. De kwetsbaarheid bevindt zich in de template engine van Adobe Commerce, waarbij speciale elementen niet correct worden geneutraliseerd. Een aanvaller kan hierdoor op afstand willekeurige code uitvoeren zonder dat er gebruikersinteractie nodig is. Dit gebeurt door misbruik te maken van een gewijzigde scope om privileges te escaleren of de uitvoeringcontext aan te passen. Adobe geeft aan dat deze kwetsbaarheid reeds actief…
Adobe NL
· zachyceno
ZTNA Portal Improper Certificate Validation
CVSSv3 Score: 7.3 An improper certificate validation vulnerability [CWE-295] in FortiOS and FortiProxy Agentless ZTNA portal may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the ZTNA portal and the backend destination website. Revised on 2026-09-08 00:00:00
CVSS 7.3 Fortinet US
· zachyceno
Workflow session email approval process bypass
CVSSv3 Score: 4.7 An improper access control vulnerability [CWE-284] in FortiManager may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests. Revised on 2026-09-08 00:00:00
CVSS 4.7 Fortinet US
· zachyceno
Uncontrolled Resource Consumption in SNMP
CVSSv3 Score: 5.9 A Use of Uninitialized Variable [CWE-457] vulnerability in Fortinet FortiAnalyzer SNMP daemon may allow a remote authenticated attacker with user permission to cause a denial of service via SNMP GETBULK requests. Revised on 2026-09-08 00:00:00
CVSS 5.9 Fortinet US
· zachyceno
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
CVSSv3 Score: 8.9 An improper access control vulnerability [CWE-284] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests. Revised on 2026-09-08 00:00:00
CVSS 8.9 Fortinet US
· zachyceno
Open Redirect on FortiSIEM
CVSSv3 Score: 2.8 An URL redirection to untrusted site ('open redirect') [CWE-601] vulnerability in FortiSIEM may allow an authenticated attacker to cause a redirection to any website via specially crafted HTTP requests Revised on 2026-09-08 00:00:00
CVSS 2.8 Fortinet US
· zachyceno
Null Pointer Dereference in Log Report
CVSSv3 Score: 2.5 A NULL Pointer Dereference vulnerability [CWE-476] in FortiOS, FortiProxy and FortiPAM may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests. Revised on 2026-09-08 00:00:00
CVSS 2.5 Fortinet US
· zachyceno
JWT used for authentication in web GUI signed with static key
CVSSv3 Score: 9.6 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00
CVSS 9.6 Fortinet US
· zachyceno
Improper Authentication of FortiPAM Server
CVSSv3 Score: 9.1 An improper authentication vulnerability [CWE-287] in the Fortinet Privileged Access Agent Chrome Extension may allow a remote unauthenticated attacker to proxy a user's browser traffic through attacker controlled servers if the user visits a malicious website. Revised on 2026-09-08 00:00:00
CVSS 9.1 Fortinet US
· zachyceno
Cron Job Injection in Remote Backup
CVSSv3 Score: 6.7 An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests. Revised on 2026-09-08 00:00:00
CVSS 6.7 Fortinet US
· zachyceno
Broken Access control on Websocket streams
CVSSv3 Score: 4.9 An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests Revised on 2026-09-08 00:00:00
CVSS 4.9 Fortinet US
· zachyceno
Arbitrary process termination from exposed minifilter communication port
CVSSv3 Score: 4.7 An Unverified Ownership Vulnerability [CWE-283] in FortiClient Windows fortimon3 driver may allow an authenticated attacker to terminate arbitrary processes via an exposed minifilter communication port. Revised on 2026-09-08 00:00:00
CVSS 4.7 Fortinet US
September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
US
· zachyceno
ZDI-26-616: Koha Eval Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-19780.
EPSS 0.01 CVSS 8.8 CVE-2026-19780 Koha US
· zachyceno
SPOJENO PŘES CVE ZDI-26-617: Microsoft Windows MIDI Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-66804.
EPSS < 0.01 CVSS 7.8 CVE-2026-66804 Microsoft US
· zachyceno
SPOJENO PŘES CVE ZDI-26-618: Microsoft Windows UMPDDrvStretchBlt Improper Object Management Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-62712.
EPSS < 0.01 CVSS 7.8 CVE-2026-62712 Microsoft US
· zachyceno
SPOJENO PŘES CVE ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. Authentication is not required to exploit this vulnerability, but only systems with specific IPsec configurations are vulnerable. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-50696.
EPSS 0.01 CVSS 8.1 CVE-2026-50696 Microsoft US
· zachyceno
Multiples vulnérabilités dans les produits Siemens (08 septembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et une élévation de privilèges.
KEV ✓ EPSS 0.98 CVE-2026-31431 CVE-2026-34223 Siemens FR
· zachyceno
Multiples vulnérabilités dans Schneider Electric EcoStruxure (08 septembre 2026)
De multiples vulnérabilités ont été découvertes dans Schneider Electric EcoStruxure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une falsification de requêtes côté serveur (SSRF).
EPSS 0.01 CVE-2026-19233 CVE-2026-8044 Schneider Electric FR
· zachyceno
Multiples vulnérabilités dans strongSwan (08 septembre 2026)
De multiples vulnérabilités ont été découvertes dans strongSwan. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
EPSS 0.02 CVE-2014-2338 CVE-2017-9023 CVE-2026-78127 CVE-2026-78129 CVE-2026-78130 CVE-2026-78131 CVE-2026-78132 CVE-2026-78133 CVE-2026-78134 CVE-2026-78135 strongSwan FR
· zachyceno
Multiples vulnérabilités dans Mattermost Server (08 septembre 2026)
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
EPSS < 0.01 CVE-2026-86348 CVE-2026-86349 Mattermost FR
NCSC-2026-0343 [1.00] [M/H] Kwetsbaarheden verholpen in GeoNetwork door OpenGeo
OpenGeo heeft meerdere kwetsbaarheden verholpen in GeoNetwork, een open-source catalogusapplicatie, specifiek in versies 4.4.5 tot en met 4.4.11 en versies voorafgaand aan 4.4.12 en 4.2.17. De eerste kwetsbaarheid betreft een reflected cross-site scripting (XSS) in de publieke, niet-geauthenticeerde cataloguszoekfunctie. Dit wordt veroorzaakt door onvoldoende sanering van de uiconfig queryparameter, waardoor een aanvaller JavaScript kan injecteren en uitvoeren in de browsercontext van…
Risolte vulnerabilità in HPE Aruba Networking ArubaOS-CX
Aggiornamenti di sicurezza HPE sanano numerose vulnerabilità di sicurezza, tra cui una con gravità “critica” e 22 con gravità “alta”, che interessano ArubaOS-CX, sistema operativo di rete utilizzato negli switch HPE Aruba Networking.
EPSS 0.02 a dalších 6 CVE-2026-73764 CVE-2026-73765 CVE-2026-73766 CVE-2026-73767 CVE-2026-73768 CVE-2026-73770 CVE-2026-73771 CVE-2026-73773 CVE-2026-73774 CVE-2026-73775 CVE-2026-73776 CVE-2026-73777 CVE-2026-73778 CVE-2026-73779 CVE-2026-73780 CVE-2026-73781 CVE-2026-73782 HPE Aruba Networks IT
Risolte vulnerabilità in OpenVPN
Aggiornamenti di sicurezza sanano tre vulnerabilità con gravità “alta” in OpenVPN, software open source per la creazione di reti private virtuali (VPN). Tali vulnerabilità potrebbero permettere a un utente malintenzionato di eludere i meccanismi di sicurezza sui sistemi interessati.
EPSS < 0.01 CVE-2026-84226 CVE-2026-84256 CVE-2026-84732 OpenVPN IT
StyleSmuggler fix: patch the Magento and Adobe Commerce RCE
StyleSmuggler is an unauthenticated RCE hitting Magento and Adobe Commerce, with no CVE and no Adobe patch yet. Aikido already has the fix. Category: Vulnerabilities & Threats
NCSC-2026-0342 [1.00] [H/H] Kwetsbaarheid verholpen in N-central van N-able
N-able heeft een kwetsbaarheid verholpen in N-central versies eerder dan 2026.3.1.14. De kwetsbaarheid betreft een pre-authenticatie remote code execution flaw. Een aanvaller kan hierdoor op afstand willekeurige code uitvoeren op het getroffen systeem zonder enige vorm van authenticatie. Alle installaties die draaien op de kwetsbare versies van N-central zijn getroffen. Klanten met een on-premises N-central-omgeving wordt geadviseerd zo snel mogelijk te upgraden naar N-central 2026.3 HF4. Voor…
N-able NL
VAROVANIE: Útočníci aktívne zneužívajú zraniteľnosti MIKROTIK smerovačov
Národné centrum kybernetickej bezpečnosti (NCKB) NBÚ varuje pred útokmi na smerovače značky MikroTik. Útočníci zreťazením bezpečnostných zraniteľností operačného systému MikroTik RouterOS dokážu získať úplnú kontrolu nad zariadením bez potreby autentifikácie. MikroTik routre sú sieťové zariadenia vyrábané spoločnosťou MikroTik a využívajú vlastný operačný systém RouterOS. Využívané sú poskytovateľmi internetových služieb, v komerčnej sfére a rovnako aj v domácnostiach.... The post VAROVANIE:…
MikroTik SK
ConnectWise warns of new ScreenConnect flaw without patch
ConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week. [...]
CVE-2024-1709 * CVE-2025-3935 * CVE-2026-3564 * ConnectWise US
Risolte vulnerabilità nei chipset MediaTek
Aggiornamenti di sicurezza MediaTek sanano alcune vulnerabilità, di cui 5 con gravità “alta”, nei chipset MediaTek, componenti hardware impiegati in numerosi dispositivi mobili e sistemi embedded. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eseguire codice arbitrario o compromettere la disponibilità del servizio sui sistemi interessati.
EPSS < 0.01 CVE-2026-20500 CVE-2026-20501 CVE-2026-20502 CVE-2026-20503 CVE-2026-20504 MediaTek IT
Control de acceso incorrecto en PrestaShop
Incorrect access control in PrestaShop Mon, 09/07/2026 - 13:19 Aviso Affected Resources PrestaShop, versions prior to 9.1.5 and 8.2.8, depending on the branch. Description INCIBE has coordinated the publication of a medium-severity vulnerability affecting PrestaShop, a free and open-source content management system designed to build e-commerce online shops from scratch. The vulnerability was discovered by Pedro Gabaldón Juliá.This vulnerability has been assigned the following code, CVSS v4.0…
EPSS 0.01 CVSS 6.9 CVE-2026-84186 PrestaShop ES
Upozornění na zranitelnost ve firmware RouterOS v zařízeních MikroTik
Upozorňujeme na zranitelnost ve firmware RouterOS v zařízeních MikroTik, kterou lze před autentizací zneužít k vzdálenému spuštění kódu s administrátorskými oprávněními. Aktuálně dochází k masovému zneužití této zranitelnosti. Dne 4. září 2026 byla vydána aktualizace RouterOS, v současnosti jsou však na internetu v ČR stále vystaveny tisíce zranitelných zařízení. Útočníci navíc u napadených zařízení upravují konfiguraci, aby si zajistili trvalý přístup k zařízení, který přežije jakoukoli…
MikroTik CZ
N-able patches max severity N-central flaw amid ongoing attacks
N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. [...]
CVE-2025-8875 * CVE-2025-8876 * CVE-2026-86206 * CVE-2026-86207 * CVE-2026-86218 * N-able US
· zachyceno
Multiples vulnérabilités dans Traefik (07 septembre 2026)
De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Traefik FR
· zachyceno
Vulnérabilité dans Belden HiOS Switch Platform (07 septembre 2026)
Une vulnérabilité a été découverte dans Belden HiOS Switch Platform. Elle permet à un attaquant de provoquer un déni de service à distance.
Belden FR
· zachyceno
Multiples vulnérabilités dans les produits VMware (07 septembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
VMware FR
· zachyceno
Multiples vulnérabilités dans les produits Juniper Networks (07 septembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
EPSS 0.98 CVE-2013-5211 CVE-2016-9042 CVE-2016-9310 CVE-2017-6451 CVE-2017-6452 CVE-2017-6455 CVE-2017-6458 CVE-2017-6459 CVE-2017-6460 CVE-2017-6462 CVE-2017-6463 CVE-2017-6464 Juniper Networks FR
· zachyceno
Multiples vulnérabilités dans MongoDB (07 septembre 2026)
De multiples vulnérabilités ont été découvertes dans MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de requêtes illégitimes par rebond (CSRF).
EPSS < 0.01 CVE-2026-84962 CVE-2026-84963 CVE-2026-84964 CVE-2026-84965 CVE-2026-84966 CVE-2026-84967 CVE-2026-84968 CVE-2026-84969 CVE-2026-84970 CVE-2026-84971 MongoDB FR
· zachyceno
Multiples vulnérabilités dans Roundcube Webmail (07 septembre 2026)
De multiples vulnérabilités ont été découvertes dans Roundcube Webmail. Certaines d'entre elles permettent à un attaquant de provoquer une falsification de requêtes côté serveur (SSRF), une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Roundcube FR
Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)
Mikrotik released a patch late last week for an already-exploited vulnerability. The vulnerability allows an SSH authentication bypass and is already being exploited. At this point, assume compromise. Attackers have been adding new accounts to affected devices to maintain access after a patch is installed. The patch will attempt to detect compromise and set the "Flagged" status. Details: https://mikrotik.com/supportsec/september-2026-vulnerability -- Johannes B. Ullrich, Ph.D. , Dean of…
MikroTik US
Vulnerabilities in Mikrotik RouterOS software
CERT Polska has found 6 vulnerabilities (from CVE-2026-67276 to CVE-2026-67279, CVE-2026-67281 and CVE-2026-86060) in Mikrotik RouterOS software.
KEV ✓ EPSS 0.09 CVE-2026-67276 CVE-2026-67279 CVE-2026-67281 CVE-2026-86060 MikroTik PL