Rilasciato aggiornamento che risolve 2 vulnerabilità di sicurezza, con gravità “critica”, in pgAdmin, nota piattaforma di amministrazione e sviluppo open source per PostgreSQL. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eludere i meccanismi di autenticazione e di scrivere file arbitrari sul filesystem dei sistemi interessati
EPSS 0.00 CVE-2026-86863 CVE-2026-86864 pgAdmin IT
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20235.
EPSS 0.00 CVSS 4.9 CVE-2026-20235 Cisco US
Number: AL26-021Date: September 17, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian…
KEV ✓ EPSS 0.01 CVE-2026-20192 CVE-2026-76423 CVE-2026-76460 Cisco CA
Serial number: AV26-932Date: September 17, 2026 As of September 16, 2026, Cisco is affected by vulnerabilities in the following products: Cisco Secure Firewall Threat Defense (FTD) Software Prior to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0 Cisco Secure Firewall Management Center (FMC) Software Prior to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0 Cisco Identity Services Engine (ISE) Software Prior to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4…
KEV ✓ EPSS 0.01 CVE-2026-76460 Cisco CA SE HU IT FR US
Rilevato lo sfruttamento in rete di una vulnerabilità, identificata tramite la CVE-2026-59822, in LiteLLM di BerriAI, server proxy impiegato come gateway per l'accesso a modelli linguistici di grandi dimensioni (LLM). La vulnerabilità consente a un attaccante remoto non autenticato di eludere i meccanismi di autenticazione e accedere agli strumenti MCP senza disporre di credenziali valide.
KEV ✓ EPSS 0.01 CVE-2026-59822 BerriAI IT US
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69843 Microsoft US
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.00 CVE-2026-77903 Microsoft US
Weak password recovery mechanism for forgotten password in MobiAPParc Thu, 09/17/2026 - 14:21 Aviso Affected Resources IOS MobiAPParc v0 – v2.28;Android MobiAPParc v0 – v2.42. Description INCIBE has coordinated the disclosure of a high-severity vulnerability affecting SMAP’s MobiAPParc, an app that enables users to pay for parking in regulated parking zones and in municipal car parks managed by Palma City Council. The vulnerability was discovered by Llorenç Romá.This vulnerability has been…
EPSS 0.00 CVSS 8.1 CVE-2026-14850 SMAP doprava ES
View CSAF Summary Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations. Failure to apply the remediation provided below may risk improper authentication validation which could result in disruption of operations and access to system data. The following versions of Schneider Electric…
EPSS 0.00 CVSS 5.3 CVE-2026-13348 Schneider Electric energetika výroba a průmysl US
Cisco heeft 21 kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC). De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Cisco ISE en ISE-PIC, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van middel tot kritiek. Van de in totaal 21 kwetsbaarheden zijn 13 als kritiek…
KEV ✓ EPSS 0.01 CVE-2026-20130 CVE-2026-20192 CVE-2026-76423 CVE-2026-76460 Cisco NL
Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. [...]
KEV ✓ EPSS 0.68 CVE-2025-20337 CVE-2026-20176 CVE-2026-20211 CVE-2026-20284 CVE-2026-20307 CVE-2026-76423 CVE-2026-76460 Cisco US
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv4.0: 9.3, CVEs: CVE-2026-89026, Summary: The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System…
EPSS 0.01 CVSS 9.3 CVE-2026-89026 Issabel FI
Une vulnérabilité a été découverte dans KeyCloak. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
EPSS 0.00 CVE-2026-90997 KeyCloak FR
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to access or manipulate data, obtain sensitive information, or cause a reload of certificate and key material on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these…
EPSS 0.00 CVE-2026-76439 CVE-2026-76444 CVE-2026-76446 CVE-2026-76447 Cisco US
Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software could allow a remote attacker to gain root access and perform session forgery or session impersonation. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:https://sec.cloudapps.cisco.com…
EPSS 0.00 CVE-2026-76412 CVE-2026-76413 CVE-2026-76420 Cisco US
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing. One of them is known to be actively exploited. For more information, see Cisco…
EPSS 0.00 CVE-2026-20130 CVE-2026-20192 CVE-2026-20194 CVE-2026-20234 CVE-2026-20237 CVE-2026-20287 Cisco US
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an unauthenticated, local attacker to either conduct an authentication bypass or disclose sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:https://sec.cloudapps.cisco.com…
EPSS 0.00 CVE-2026-20071 CVE-2026-20072 Cisco US
Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated attacker to perform an sftunnel authentication bypass or sftunnel denial of service (DoS) attack. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This…
EPSS 0.01 CVE-2026-20295 CVE-2026-20323 Cisco US
Aggiornamenti di sicurezza Atlassian sanano alcune vulnerabilità, di cui una con gravità "alta", che interessano il prodotto Crowd Data Center. Tale vulnerabilità, qualora sfruttata, potrebbe consentire, a un utente malintenzionato non autenticato, di eludere i meccanismi di autenticazione e ottenere accesso a funzionalità o risorse riservate sui sistemi interessati.
EPSS 0.00 CVE-2026-21582 Atlassian IT
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access live video and sensitive device information, enable unauthorized services, execute arbitrary code, modify device operation, and recover stored credentials. The following versions of CareCam CM2507 are affected: HMT.CM2507 Firmware v251211.1507 (CVE-2026-88259, CVE-2026-84398, CVE-2026-84400, CVE-2026-81305, CVE-2026-85478, CVE-2026-85497, CVE-2026-81321) CVSS Vendor Equipment Vulnerabilities v3…
CVSS 7.5 CVE-2026-81305 CVE-2026-81321 CVE-2026-84398 CVE-2026-84400 CVE-2026-85478 CVE-2026-85497 CVE-2026-88259 CareCam US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to deliver an unauthorized update, execute code, or extract credentials to allow the attacker to impersonate a privileged client. The following versions of Wärtsilä FOS-Onboard are affected: FOS-Onboard 5.07.0923.01 (CVE-2026-78225, CVE-2026-81855) CVSS Vendor Equipment Vulnerabilities v3 9.1 Wärtsilä Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key Background Critical Infrastructure Sectors:…
EPSS 0.00 CVSS 9.1 CVE-2026-78225 CVE-2026-81855 Wärtsilä doprava US
View CSAF Summary Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. The following versions of Siemens Mendix SAML are affected: Mendix SAML (Mendix 10 compatible) vers:intdot/<4.2.3 (CVE-2026-80465) Mendix SAML (Mendix 11 compatible) vers:intdot/<4.2.3 (CVE-2026-80465) Mendix SAML (Mendix 9.24…
EPSS 0.00 CVSS 8.7 CVE-2026-80465 Siemens výroba a průmysl US IT
View CSAF Summary Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Failure to apply the mitigations provided below may increase the risk of unauthorized access to RTU configuration through the Secure Lock functionality, potentially resulting in a loss of confidentiality. The…
EPSS 0.00 CVSS 6.5 CVE-2026-81861 Schneider Electric výroba a průmysl energetika US
View CSAF Summary Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point. The following versions of Digital Watchdog VMAX DVR and NVR Product Lineups are affected: VMAX A1 G4 DVRs vers:all/* (CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887, CVE-2026-66372) VMAX IP G4 NVRs vers:all/* …
EPSS 0.00 CVSS 9.6 CVE-2026-66372 CVE-2026-66887 CVE-2026-66890 CVE-2026-68070 CVE-2026-68950 CVE-2026-68953 Digital Watchdog veřejná správa zdravotnictví doprava US
Rilevate quattro vulnerabilità, di cui due con gravità “alta”, in Design Scuole Italia, noto tema WordPress destinato alla realizzazione dei siti istituzionali delle scuole italiane. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di leggere file arbitrari sul filesystem, eludere i meccanismi di autenticazione ed accedere a informazioni sensibili sui sistemi interessati
EPSS 0.00 CVE-2026-87791 CVE-2026-87792 CVE-2026-87793 CVE-2026-89307 WordPress Design Scuole Italia školství IT
CISA added CVE-2026-42018 to the Known Exploited Vulnerabilities catalog. Affected product: JFrog Artifactory. Remediation due date: 2026-09-25.
KEV ✓ EPSS 0.01 CVE-2026-42018 JFrog US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition. The following versions of ST Engineering iDirect iQ-Series Terminals (Update A) are affected: Evolution iQ‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058) 3315‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058) 9‑Series terminals <=4…
EPSS 0.01 CVSS 8.8 CVE-2026-38056 CVE-2026-38057 CVE-2026-38058 CVE-2026-38059 ST Engineering iDirect telekomunikace obrana energetika veřejná správa US
Use of Hard-coded Credentials vulnerability (CVE-2026-17038) has been found in drEryk Gabinet software.
EPSS 0.00 CVE-2026-17038 drEryk zdravotnictví PL
Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks. [...]
KEV ✓ EPSS 0.76 CVE-2026-20079 Cisco veřejná správa US
Citrix har publicerat information om en kritisk sårbarhet som påverkar Citrix NetScaler ADC och NetScaler Gateway. Sårbarheten, CVE-2026-19490, har fått CVSS v.4-klassning på 9.3. [1, 2]
KEV ✓ EPSS 0.06 CVSS 9.3 CVE-2026-19490 Citrix SE US
Ivanti heeft een kwetsbaarheid verholpen in Sentry versies voorafgaand aan R10.8.2, R10.7.3 en R10.6.4. De kwetsbaarheid betreft een authenticatie-bypass die het mogelijk maakt voor externe aanvallers zonder authenticatie om administratieve toegang tot het systeem te verkrijgen. Deze kwetsbaarheid treft meerdere releases van het Sentry-platform en kan leiden tot ongeautoriseerde controle over administratieve functies.
Ivanti NL
SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence. De kwetsbaarheid met kenmerk CVE…
EPSS 0.00 CVE-2026-44756 CVE-2026-58240 CVE-2026-66768 CVE-2026-76969 SAP NL
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.8.
CVSS 5.8 Microsoft US
Classification: Severe, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv3.0: 8.1, CVEs: CVE-2026-83527, Summary: Ivanti has released updates for Ivanti Sentry that address one high severity vulnerability. This vulnerability impacts deployments managed by EPMM and Ivanti Neurons for MDM. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. CVE-2026-83527 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:3.0 8.1 An Authentication Bypass…
EPSS 0.01 CVSS 8.1 CVE-2026-83527 Ivanti FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.6, CVEs: CVE-2026-84390, Summary: An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT
EPSS 0.01 CVSS 9.6 CVE-2026-84390 Fortinet FI
Microsoft heeft 9 kwetsbaarheden verholpen in Exchange Server. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service uit te voeren, zich voor te doen als andere gebruiker, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en/of toegang te krijgen tot gevoelige gegevens. De ernstigste kwetsbaarheid met kenmerk CVE-2026-69380 heeft een CVSS-score van 9,9 en betreft een autorisatiekwetsbaarheid. Een geauthenticeerde kwaadwillende met beperkte rechten en…
EPSS 0.01 CVE-2026-55007 CVE-2026-69355 CVE-2026-69356 CVE-2026-69361 CVE-2026-69375 CVE-2026-69378 CVE-2026-69380 CVE-2026-69382 CVE-2026-69641 Microsoft NL
Microsoft heeft 4 kwetsbaarheden verholpen in diverse Azure componenten. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade, zoals genoemd in onderstaande tabel. De kwetsbaarheid met kenmerk CVE-2026-69854 heeft een CVSS-score van 9,0. Een kwaadwillende die al over een geldige sessie beschikt, kan de kwetsbaarheid onder specifieke voorwaarden, zoals bepaalde protocolinstellingen of configuraties, misbruiken om zijn rechten…
EPSS 0.01 CVE-2026-62895 CVE-2026-69854 CVE-2026-77909 CVE-2026-81961 Microsoft NL
Serial Number: AV26-895Date: September 8, 2026 As of September 8, 2026, Commvault is affected by vulnerabilities in the following product: Commvault Cloud 11.36.0 Prior to 11.36.123 11.40.0 Prior to 11.40.72 11.44.0 Prior to 11.44.20 11.46.0 Prior to 11.46.20 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CV_2026_07_1: Command Center API Authentication Bypass Commvault Cloud Security Advisories
Commvault CA
Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-84003 Microsoft US
Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-81354 US
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-69854 US
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-73025 US
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-64918 Microsoft US
Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69820 US
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69864 US
Double free in Windows Hello allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69725 US
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69710 US
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69799 US
Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69821 US
Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-69297 US
Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.
EPSS 0.00 CVE-2026-62759 US
Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-84001 US
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-81381 GitHub US
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-80097 Microsoft US
Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-77909 US
Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.
EPSS 0.00 CVE-2026-72980 US
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
EPSS 0.00 CVE-2026-69646 US
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-72958 US
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-66305 US
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-69740 US