Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]
CVE-2026-109618 * CVE-2026-109619 * CVE-2026-46300 * Linux veřejná správa US
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-64849.
KEV ✓ EPSS 0.10 CVSS 6.8 CVE-2026-64849 MLflow veřejná správa US CA
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]
KEV ✓ EPSS 1.00 CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 IceWarp PHP veřejná správa US IT
Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha Mon, 10/26/2026 - 09:38 Aviso Affected Resources Web application for the video library of the Regional Parliament of Castile-La Mancha, available at http://videoteca.cortesclm.es/. Description INCIBE has coordinated the disclosure of a medium severity vulnerability affecting the web application for the Castile-La Mancha Regional Parliament’s video library. The vulnerability was discovered by…
EPSS 0.00 CVSS 5.1 CVE-2026-103377 Cortes de Castilla-La Mancha veřejná správa ES
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]
KEV ✓ · ransomware EPSS 1.00 CVE-2014-6278 CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2019-11510 CVE-2021-22205 CVE-2021-3199 CVE-2023-22894 Microsoft veřejná správa výroba a průmysl zdravotnictví školství US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. The following versions of Johnson Controls EasyIO FG are affected: EasyIO FG firmware <=2.0b52 (CVE-2026-27872, CVE-2026-27873) CVSS Vendor Equipment v3 7.7 Johnson Controls EasyIO FG firmware 2 Vulnerabilities Use of Hard-coded Credentials, Improper Privilege Management Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial…
EPSS 0.00 CVE-2026-27872 CVE-2026-27873 Johnson Controls výroba a průmysl veřejná správa doprava energetika US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64893) EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b24 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64893)…
EPSS 0.00 CVSS 5.4 CVE-2026-64893 Johnson Controls výroba a průmysl veřejná správa doprava energetika US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64892) EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64892) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64892) EasyIO Neo Series CW Controllers…
EPSS 0.00 CVSS 3.5 CVE-2026-64892 Johnson Controls výroba a průmysl veřejná správa doprava energetika US
De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité. Gitlab indique que la vulnérabilité CVE-2026-85706 est activement exploitée.
KEV ✓ EPSS 0.97 CVE-2026-85706 GitLab veřejná správa FR CZ NL CA US
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. [...]
CVE-2026-19490 * CVE-2026-3055 * CVE-2026-4368 * CVE-2026-88771 * CVE-2026-88772 * Citrix veřejná správa US
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: 9.8, CVEs: CVE-2026-63077, Summary: An unauthenticated remote code execution vulnerability affects TeamCity On-Premises. An attacker with HTTP or HTTPS access to a vulnerable server can exploit the TeamCity agent polling protocol to bypass authentication and execute operating-system commands with the privileges of the TeamCity server process.
KEV ✓ · ransomware EPSS 0.94 CVSS 9.8 CVE-2026-63077 JetBrains veřejná správa FI US
Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). [...]
Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini Tue, 09/22/2026 - 12:21 Aviso Affected Resources Tankuam Places, versions published before 25 November 2025. Description INCIBE has coordinated the publication of a critical-severity vulnerability affecting Tankuam Places by Kompini, a software programme for managing municipal facilities. The vulnerability was discovered by Xavi Márquez González.This vulnerability has been assigned the following code, CVSS v4.0 base score,…
EPSS 0.00 CVSS 9.3 CVE-2026-93556 Kompini veřejná správa ES
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management…
KEV ✓ EPSS 0.03 CVE-2025-39682 Linux veřejná správa US
Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0 Fri, 09/18/2026 - 11:30 Aviso Affected Resources TAO 2.0 Description INCIBE has coordinated the publication of a medium-severity vulnerability affecting T-Systems’ TAO 2.0 suite, a management platform for the public sector. The vulnerability was discovered by Cayetano de Juan Úbeda.This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:CVE-2026-92976: CVSS v4.0: 5.1 | CVSS:4.0…
EPSS 0.00 CVSS 5.1 CVE-2026-92976 T-Systems veřejná správa ES
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-58704 Google Pixel Improper Authorization Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian…
KEV ✓ EPSS 0.01 CVE-2026-58704 Google veřejná správa US
15. September 2026 Beschreibung In Cisco Secure Email Gateway existiert eine kritische Sicherheitslücke. Bei erfolgreicher Ausnutzung könnte diese Sicherheitslücke es nicht authentifizierten Angreifer:innen aus der Ferne ermöglichen Befehle mit Root-Rechten auf dem zugrunde liegenden Betriebssystem auszuführen. Laut Cisco wurde eine Ausnutzung der Sicherheitslücke bereits beobachtet. CVE-Nummer(n): CVE-2026-76461 CVSS Base Score: 9.8 Auswirkungen Ein Angreifer könnte diese Sicherheitslücke…
KEV ✓ EPSS 0.30 CVSS 9.8 CVE-2026-76461 Cisco veřejná správa AT SE US FI GB FR CA IT
View CSAF Summary Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point. The following versions of Digital Watchdog VMAX DVR and NVR Product Lineups are affected: VMAX A1 G4 DVRs vers:all/* (CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887, CVE-2026-66372) VMAX IP G4 NVRs vers:all/* …
EPSS 0.01 CVSS 9.6 CVE-2026-66372 CVE-2026-66887 CVE-2026-66890 CVE-2026-68070 CVE-2026-68950 CVE-2026-68953 Digital Watchdog veřejná správa zdravotnictví doprava US
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant…
KEV ✓ EPSS 0.10 CVE-2026-42016 CVE-2026-42018 CVE-2026-84869 JFrog ConnectWise veřejná správa US
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational…
KEV ✓ EPSS 0.06 CVE-2026-67277 CVE-2026-86060 MikroTik veřejná správa US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition. The following versions of ST Engineering iDirect iQ-Series Terminals (Update A) are affected: Evolution iQ‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058) 3315‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058) 9‑Series terminals <=4…
EPSS 0.01 CVSS 8.8 CVE-2026-38056 CVE-2026-38057 CVE-2026-38058 CVE-2026-38059 ST Engineering iDirect telekomunikace obrana energetika veřejná správa US
Une vulnérabilité a été découverte dans Microsoft Edge. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance. Microsoft indique que la vulnérabilité CVE-2026-85046 est activement exploitée.
KEV ✓ EPSS 0.02 CVE-2026-85046 Microsoft Google veřejná správa FR CA NL US IT
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel…
KEV ✓ EPSS 0.89 CVE-2025-25249 CVE-2026-19490 CVE-2026-20079 CVE-2026-87491 Fortinet Citrix Google Cisco veřejná správa US
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2026-81963 Microsoft Windows Link Following Vulnerability CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CVE-2026-86218 N-able N-central Static Code Injection Vulnerability These types of vulnerabilities…
KEV ✓ EPSS 0.15 CVE-2026-75650 CVE-2026-81963 CVE-2026-85880 CVE-2026-86218 Adobe Magento Microsoft N-able veřejná správa US
A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézet (NBSZ NKI) riasztást ad ki Magyarország Ügyészségének nevével és arculati elemeivel visszaélő, zsarolóvírus fertőzéshez vezető adathalász üzenetekről. A bejelentések alapján a támadók hamis, hivatalos megkeresés látszatát keltő leveleket küldenek, amelyekben ügyészségi alkalmazottak nevével élnek vissza. A kampány célja az, hogy a felhasználó a levélben szereplő hivatkozásra kattintson, majd a […]
CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability CVE-2026-83548…
KEV ✓ EPSS 0.70 CVE-2026-48710 CVE-2026-49869 CVE-2026-59822 CVE-2026-82329 CVE-2026-83548 CVE-2026-83549 CVE-2026-9586 Sangoma JFrog SonicWall BerriAI veřejná správa US
Code injection in the Lutece Core Tue, 09/01/2026 - 11:44 Aviso Affected Resources Lutece Core: versión 7.1.7 y anteriores. Description INCIBE has coordinated the disclosure of a critical-severity vulnerability in Lutece Core, an open platform that enables local authorities to share, reuse and adapt digital services. The vulnerability was discovered by I Dorian Piette (Trachinus).This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability…
EPSS 0.01 CVSS 9.4 CVE-2026-4813 Lutece veřejná správa ES
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates…
KEV ✓ EPSS 0.85 CVSS 9.4 CVE-2026-81578 CVE-2026-82078 PaperCut veřejná správa US IT FI FR