Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
[VDE-2026-093] A vulnerability has been found in the firmware update process of SAUTER Building Controllers. The identified vulnerability could allow unauthorized code execution on affected controllers.
EPSS 0.01 CVE-2026-78319 SAUTER DE
Aggiornamenti di sicurezza sanano una vulnerabilità in libexpat, nota libreria scritta in C per l'analisi di documenti XML. Tale vulnerabilità, qualora sfruttata, consentirebbe ad utente malintenzionato di innescare la corruzione della memoria o il crash dell'applicazione, portando alla compromissione della disponibilità del servizio sulle istanze interessate.
EPSS < 0.01 CVE-2026-76641 libexpat IT
Lack of authorisation in OpenNebula by OpenNebula Systems Tue, 09/01/2026 - 12:12 Aviso Affected Resources OpenNebula 7.4. Description INCIBE has coordinated the publication of a high-severity vulnerability affecting OpenNebula by OpenNebula Systems, a platform for managing virtualised data. The vulnerability was discovered by Yonghwa Lee, Xint from Theori.This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:CVE-2026-84165: CVSS…
EPSS < 0.01 CVSS 8.7 CVE-2026-84165 OpenNebula Systems ES
Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks. [...]
CVE-2023-2533 * CVE-2026-81578 * CVE-2026-82078 * PaperCut US
Code injection in the Lutece Core Tue, 09/01/2026 - 11:44 Aviso Affected Resources Lutece Core: versión 7.1.7 y anteriores. Description INCIBE has coordinated the disclosure of a critical-severity vulnerability in Lutece Core, an open platform that enables local authorities to share, reuse and adapt digital services. The vulnerability was discovered by I Dorian Piette (Trachinus).This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability…
EPSS 0.01 CVSS 9.4 CVE-2026-4813 Lutece veřejná správa ES
De multiples vulnérabilités ont été découvertes dans SPIP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un problème de sécurité non spécifié par l'éditeur.
SPIP FR
Une vulnérabilité a été découverte dans Kaspersky Endpoint Security Windows. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Kaspersky FR
De multiples vulnérabilités ont été découvertes dans JFrog Artifactory. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une falsification de requêtes côté serveur (SSRF) et un contournement de la politique de sécurité.
KEV ✓ EPSS 0.14 CVE-2026-69104 CVE-2026-70548 CVE-2026-70550 CVE-2026-70551 CVE-2026-82329 JFrog FR
Une vulnérabilité a été découverte dans Mozilla Firefox pour iOS. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
EPSS < 0.01 CVE-2026-81267 Mozilla FR
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
EPSS < 0.01 CVE-2026-12985 CVE-2026-82920 Mattermost FR
Serial Number: AV26-865Date: August 31, 2026 As of August 27, 2026, WatchGuard is affected by vulnerabilities in the following products: Dimension Prior to 2.3.1 Fireware OS Prior to 12.12.2 Prior to 12.5.20 Prior to 2026.2.2 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. WatchGuard Security Advisories
WatchGuard CA
Serial Number: AV26-864Date: August 31, 2026 As of August 27, 2026, Siemens is affected by a vulnerability in the following products: Element maps-ng V47 Prior to V47.12.3 Element maps-ng V48 Prior to V48.11.3 Element maps-ng V49 Prior to V49.16.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. SSA-682041 CERT Services | Siemens
Siemens CA
Serial Number: AV26-863Date: August 31, 2026 As of August 28, 2026, Dell is affected by vulnerabilities in the following products: Dell PowerEdge Server for Intel Processor Firmware Multiple versions and models Dell AppSync Prior to or equal to 4.6.0.4 and 4.6.1.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. DSA-2026-356: Security Update for Dell PowerEdge Server for Intel® Processor Firmware…
Dell CA
Serial Number: AV26-862Date: August 31, 2026 As of August 28, 2026, IBM is affected by vulnerabilities in the following products: SPSS Collaboration and Deployment Services Multiple versions IBM SPSS Analytic Server Multiple version IBM MQ Agent Multiple versions IBM Maximo Application Suite - Monitor Component Prior to or equal to 9.2, 9.1 and 9.0 IBM Observability with Instana (Agent) Prior to or equal to 1.0.323 IBM Financial Transaction Manager (FTM) for RedHat OpenShift Multiple versions…
IBM CA
For the latest discoveries in cyber research for the week of 31st August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, has disclosed a cyberattack that exposed data belonging to about 8.7 million customers. The compromised information includes contact details, vehicle registration numbers, and information collected through car park, lounge, fast-track, and Wi-Fi…
KEV ✓ EPSS 0.85 CVSS 10.0 CVE-2026-18885 CVE-2026-18886 CVE-2026-74820 CVE-2026-75604 CVE-2026-81578 CVE-2026-82078 PaperCut Ubiquiti Vercel ServiceNow IL
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates…
KEV ✓ EPSS 0.85 CVSS 9.4 CVE-2026-81578 CVE-2026-82078 PaperCut veřejná správa US IT FI FR
Rilevate 8 nuove vulnerabilità di sicurezza, di cui 2 con gravità “critica” e 4 con gravità “alta”, che interessano il software Langflow, nota piattaforma open-source che permette di costruire, testare e distribuire applicazioni e agenti basati su intelligenza artificiale.
EPSS 0.02 CVE-2026-18729 CVE-2026-18891 CVE-2026-18899 CVE-2026-18904 CVE-2026-19286 CVE-2026-19295 Langflow IT
Rilevata una vulnerabilità di sicurezza con gravità "alta" in Sudo, nota utility per sistemi operativi Unix-like che permette di delegare i privilegi utente. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente locale autenticato di eludere i meccanismi di sicurezza e di eseguire programmi non autorizzati sul sistema interessato, ottenendo privilegi superiori rispetto a quelli previsti dalle policy configurate.
EPSS < 0.01 CVE-2026-82474 Sudo IT
Aggiornamenti di sicurezza sanano sanano una vulnerabilità con gravità “alta” nel linguaggio di programmazione Go. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a utenti malintenzionati di aggirare i meccanismi di autenticazione sui sistemi interessati.
EPSS < 0.01 CVE-2026-56854 Go IT
This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 pdfforge US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 pdfforge US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 pdfforge US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 pdfforge US
This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 pdfforge US
De multiples vulnérabilités ont été découvertes dans les produits Tenable. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une élévation de privilèges.
EPSS 0.02 CVE-2026-19626 CVE-2026-19628 CVE-2026-19629 CVE-2026-19635 Tenable FR
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Microsoft FR
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 10.0, CVEs: CVE-2026-76581, CVE-2026-18431, CVE-2026-19632, CVE-2026-19598, CVE-2026-82222, Summary: Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack,…
EPSS 0.05 CVSS 10.0 CVE-2026-18431 CVE-2026-19598 CVE-2026-19632 CVE-2026-76581 CVE-2026-82222 WordPress WPMU DEV Avada TranslatePress FI
PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes. [...]
CVE-2023-27350 * CVE-2026-81578 * CVE-2026-82078 * PaperCut US
A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server. [...]
PaperCut released an emergency advisory on Thursday evening saying vulnerabilities in their print management software, PaperCut NG and MF, are under active exploitation.
PaperCut US
Serial Number: AV26-861Date: August 28, 2026 As of August 27, 2026, WebPros is affected by vulnerabilities in the following products: cPanel & WebHost Manager (WHM) software Prior to 11.110.0.141 Prior to 11.134.0.53 Prior to 11.136.0.37 Prior to 11.138.0.2 Prior to WP2: 11.138.1.7 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available Security: CVE-2026-65643 Vulnerability in cPanel’s Domain Parking…
EPSS 0.01 CVE-2026-65643 WebPros cPanel CA IT FI
Serial Number: AV26-860Date: August 28, 2026 As of August 27, 2026, Grafana is affected by a vulnerability in the following product: Alloy Prior to or equal to 1.18.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Grafana: The open and composable observability platform | Grafana Labs CVE-2026-19516 CVE Record
EPSS < 0.01 CVE-2026-19516 Grafana CA IT
Serial Number: AV26-859Date: August 28, 2026 As of August 27, 2026, Redis is affected by a vulnerability in the following product: Redis 8.0 All except 8.10.1 All except 8.2.9 All except 8.4.6 All except 8.6.6 All except 8.8.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Fix use-after-free in tlsProcessPendingData() pending-list iteration GitHub Releases
Redis CA
Serial number: AV26-858Date: August 28, 2026 As of August 27, 2026, PaperCut is affected by vulnerabilities in the following products: PaperCut MF Prior to v24 Emergency Patch Release 2 Prior to v25 Emergency Patch Release 2 Prior to v26 Emergency Patch Release 2 PaperCut NG Prior to v24 Emergency Patch Release 2 Prior to v25 Emergency Patch Release 2 Prior to v26 Emergency Patch Release 2 The Cyber Centre encourages users and administrators to review the provided web link and apply any…
PaperCut CA
Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
EPSS < 0.01 CVSS 4.4 CVE-2026-69446 Microsoft US
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
EPSS < 0.01 CVE-2026-70309 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-72984 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-66798 Microsoft US
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-66324 Microsoft US
Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS < 0.01 CVE-2026-66323 Microsoft US
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
EPSS < 0.01 CVE-2026-62904 Microsoft US
Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.
EPSS < 0.01 CVE-2026-58616 Microsoft US
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
EPSS < 0.01 CVE-2026-70331 Microsoft US
Serial number: AV26-857Date: August 28, 2026 As of August 27, 2026, ServiceNow is affected by vulnerabilities in the following products: Xanadu Versions prior to Patch 11 Hot Fix 7a Yokohama Versions prior to Yokohama Patch 12 Hot Fix 3b Versions prior to Yokohama Patch 13 Hot Fix 4 Zurich Multiple versions Australia Multiple versions The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. August 2026 CVE…
ServiceNow CA
PaperCut heeft kwetsbaarheden verholpen in PaperCut MF en PaperCut NG. Een ongeauthenticeerde kwaadwillende kan de kwetsbaarheden mogelijk achtereenvolgens misbruiken om een PaperCut-omgeving over te nemen en hierop willekeurige code uit te voeren. Hiertoe dient de kwaadwillende malafide netwerkverkeer naar de kwetsbare PaperCut-omgeving te sturen.
PaperCut NL
Rilasciati aggiornamenti di sicurezza per risolvere due vulnerabilità con gravità “alta” che interessano GitLab AI Gateway. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente autenticato malevolo di accedere a informazioni sensibili sui sistemi interessati.
EPSS < 0.01 CVE-2026-19889 CVE-2026-75871 GitLab IT
Serial Number: AV26-856Date: August 28, 2026 As of August 25, 2026, National Instruments is affected by vulnerabilities in the following product: LabVIEW Prior to 23.0.0 Prior to 23.3.10 Prior to 24.3.7 Prior to 25.3.5 Prior to 26.3.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Memory Corruption Vulnerabilities in NI LabVIEW - NI Integer Conversion Vulnerability Resulting in an Out of Bounds Read…
National Instruments výroba a průmysl energetika vodárenství telekomunikace CA
Rilevate molteplici vulnerabilità, tra cui 6 con gravità “alta”, in varie librerie client per MongoDB. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato la modifica non autorizzata di dati o codice e la compromissione della disponibilità del servizio sui sistemi interessati.
EPSS < 0.01 CVE-2026-75159 CVE-2026-81521 CVE-2026-81522 CVE-2026-81525 CVE-2026-81526 CVE-2026-81529 MongoDB IT
Wibu-Systems heeft meerdere kwetsbaarheden verholpen in CodeMeter Runtime. De kwetsbaarheden bevinden zich in verschillende onderdelen van CodeMeter Runtime, met name in versies voor 8.41a en 9.10. Een lokale aanvaller kan misbruik maken van onjuiste verificatie van NTFS reparse points bij het aanmaken van tijdelijke bestanden door cmu.exe, wat kan leiden tot het verwijderen van willekeurige systeembestanden met System-privileges en daarmee lokale privilege-escalatie. Daarnaast bevat de…
EPSS < 0.01 CVE-2026-81573 Wibu-Systems NL
ServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in code injection, SQL injection, and privilege escalation attacks. [...]
CVE-2024-4879 * CVE-2024-5178 * CVE-2024-5217 * CVE-2026-18885 * CVE-2026-18886 * CVE-2026-6875 * CVE-2026-6876 * CVE-2026-74820 * ServiceNow US
Overview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the time of writing, the vulnerability has not been assigned a CVE identifier, and PaperCut has not publicly disclosed a CVSS score, vulnerability class, authentication requirements, or the technical details…
KEV ✓ · ransomware EPSS 1.00 CVE-2023-27350 PaperCut Software PaperCut školství výroba a průmysl US
Rilasciati aggiornamenti di sicurezza per risolvere una vulnerabilità con gravità “alta” presente in Grafana Alloy, agente open source per la raccolta ed elaborazione di dati di osservabilità e monitoraggio. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato di accedere ad informazioni sensibili sui sistemi interessati.
EPSS < 0.01 CVE-2026-75889 Grafana IT
Aggiornamenti di sicurezza sanano una vulnerabilità con gravità "critica" presente in Synology Chat Server, componente del prodotto DiskStation Manager (DSM) di Synology. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente autenticato remoto di leggere o scrivere file arbitrari e compromettere la disponibilità del sistema.
EPSS < 0.01 CVE-2026-40541 Synology IT
Rilevate nuove vulnerabilità e disponibili PoC pubblici per le CVE-2026-54083 e CVE-2026-61800 presenti in Wazuh, piattaforma open-source con funzionalità Security Information and Event Management (SIEM) e Extended Detection and Response (XDR).
EPSS 0.01 CVE-2026-54083 CVE-2026-61800 Wazuh IT
Aggiornamenti di sicurezza Siemens sanano una vulnerabilità con gravità "alta" presente in Element Maps, libreria open source per la visualizzazione di mappe interattive. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente non autenticato remoto di iniettare codice arbitrario nella sessione del browser sul sistema target.
EPSS < 0.01 CVE-2026-66155 Siemens IT
Rilasciati aggiornamenti di sicurezza che sanano 4 vulnerabilità ,di cui una con gravità "alta" e 3 con gravità "critica", presenti nella piattaforma ServiceNow. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un attaccante non autenticato di eseguire codice arbitrario, manipolare dati delle istanze e ottenere privilegi elevati sui sistemi interessati.
EPSS 0.07 CVSS 10.0 CVE-2026-18885 CVE-2026-18886 CVE-2026-6876 CVE-2026-74820 ServiceNow IT FI
Aggiornamenti di sicurezza sanano numerose vulnerabilità, tra cui 5 con gravità "critica" e 12 con gravità “alta”, in prodotti WatchGuard. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eludere i meccanismi di autenticazione, eseguire codice arbitrario e/o compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.01 CVE-2026-13086 CVE-2026-13108 CVE-2026-19313 CVE-2026-19314 CVE-2026-19315 CVE-2026-19316 CVE-2026-19317 CVE-2026-19318 CVE-2026-78008 CVE-2026-78009 CVE-2026-78010 CVE-2026-78011 CVE-2026-78174 CVE-2026-78610 CVE-2026-78612 CVE-2026-78613 CVE-2026-78614 WatchGuard IT
PaperCut NG and PaperCut MF are under active exploitation. Huntress reproduced a pre-auth RCE chain and shares urgent patching and exposure guidance.
PaperCut US
CISA added CVE-2026-81578 to the Known Exploited Vulnerabilities catalog. Affected product: PaperCut NG/MF. Remediation due date: 2026-09-11.
KEV ✓ EPSS 0.85 CVE-2026-81578 PaperCut US
CISA added CVE-2026-82078 to the Known Exploited Vulnerabilities catalog. Affected product: PaperCut NG/MF. Remediation due date: 2026-09-11.
KEV ✓ EPSS 0.63 CVE-2026-82078 PaperCut US