Known exploited

Advisories on the CISA Known Exploited Vulnerabilities catalog, or flagged as exploited by the vendor. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

136-77% vs 7-day avg of 597

2 critical, 34 high, 59 medium, 21 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Critical	9.4	CVE-2026-114625	VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host Arista, Arista NetworksArista VeloCloud Orchestrator, Arista Networks VeloCloud Orchestrator, Arista VeloCloud Orchestrator (VCO), Arista VeloCloud Orchestrator On-Prem	NVD	KEV	Oct 22 21:17 UTC
CVE-2026-114625VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host Executive summary Arista's VeloCloud Orchestrator (VCO) on-prem software has a flaw that lets any authenticated user gain operator-level privileges and reach internal-only functions. The advisory rates it critical (CVSS v3.1 base score 9.9) and says it is known to be actively exploited. The vendor recommends upgrading to a fixed VCO release as soon as possible. Technical summary The advisory classifies the issue as CWE-89 SQL Injection, and says a remote attacker with a valid authenticated session can become a local "superuser operator" and reach internal-only functionality. Exploitation requires network access to the VCO web interface and a session for at least the Enterprise Read Only role, and the advisory states VCO is exposed by default with no configuration that prevents exposure. Affected versions are VCO 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, and 6.4.x prior to 6.4.2.12, with fixed releases 5.2.3.18, 6.1.3.10, and 6.4.2.12 and later. End-of-support versions have not been assessed. The advisory lists indicators of compromise, including two IP addresses (74.82.197.86 and 38.54.50.151) and suspicious web access log patterns, and recommends blocking those IPs and reviewing logs. No workaround that removes the exposure is stated; the advisory recommends restricting web interface access, monitoring for webshells and backdoor daemons, and reviewing administrator activity until patching. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Arista Arista Networks Arista VeloCloud Orchestrator Arista Networks VeloCloud Orchestrator Arista VeloCloud Orchestrator (VCO)Arista VeloCloud Orchestrator On-Prem NIST National Vulnerability DatabasePublished Oct 22, 2026 21:17 UTC Read the advisory
	Critical	9.3	CVE-2026-102764	The vulnerability exists within internal components of BeyondTrust’s Remote Support product BeyondTrustBeyondTrust Remote Support	NVD	KEV	Oct 15 21:17 UTC
CVE-2026-102764The vulnerability exists within internal components of BeyondTrust’s Remote Support product From the advisory The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects BeyondTrust BeyondTrust Remote Support NIST National Vulnerability DatabasePublished Oct 15, 2026 21:17 UTC Read the advisory
	High	8.4	CVE-2026-110936	A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8) SiemensSiemens Software Center	NVD	KEV	Oct 15 15:17 UTC
CVE-2026-110936A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8) From the advisory A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Siemens Siemens Software Center NIST National Vulnerability DatabasePublished Oct 15, 2026 15:17 UTC Read the advisory
	High	8.6	CVE-2026-0322	A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute... Palo Alto NetworksPalo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW, Palo Alto Networks Prisma Access	NVD	KEV	Oct 14 18:17 UTC
CVE-2026-0322A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute... From the advisory A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red Affects Palo Alto Networks Palo Alto Networks PAN-OS Palo Alto Networks Cloud NGFW Palo Alto Networks Prisma Access NIST National Vulnerability DatabasePublished Oct 14, 2026 18:17 UTC Read the advisory
	Critical	9.8	CVE-2026-76519	A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the... CiscoCisco Secure Email, Cisco Asyncos	NVD	KEV	Oct 14 17:19 UTC
CVE-2026-76519A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the... From the advisory A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Cisco Cisco Secure Email Cisco Asyncos NIST National Vulnerability DatabasePublished Oct 14, 2026 17:19 UTC Read the advisory
	High	8.5	CVE-2026-106931	SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the... EG Secure Solutions, E-GuardianEG Secure Solutions SiteGuard Server Edition for Apache httpd, EG Secure Solutions SiteGuard Server Edition for Nginx, EG Secure Solutions SiteGuard Server Edition for IIS, EG Secure Solutions SiteGuard Server Edition for Apache httpd on FreeBSD, EG Secure Solutions SiteGuard Server Edition for Nginx on FreeBSD, E-Guardian Siteguard	NVD	KEV	Oct 14 05:16 UTC
CVE-2026-106931SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the... From the advisory SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects EG Secure Solutions E-Guardian EG Secure Solutions SiteGuard Server Edition for Apache httpd EG Secure Solutions SiteGuard Server Edition for Nginx EG Secure Solutions SiteGuard Server Edition for IIS EG Secure Solutions SiteGuard Server Edition for Apache httpd on FreeBSD EG Secure Solutions SiteGuard Server Edition for Nginx on FreeBSD E-Guardian Siteguard NIST National Vulnerability DatabasePublished Oct 14, 2026 05:16 UTC Read the advisory
	Critical	9.2	CVE-2026-110447	Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October... CollaboraCollabora Online – Built-in CODE Server	NVD	KEV	Oct 14 03:17 UTC
CVE-2026-110447Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October... From the advisory Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Collabora Collabora Online – Built-in CODE Server NIST National Vulnerability DatabasePublished Oct 14, 2026 03:17 UTC Read the advisory
	High	8.8	CVE-2026-96951	Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. MicrosoftMicrosoft Windows 11 version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 10 Version 1607, Microsoft Windows Server 2012 R2, Microsoft Outlook.com	NVD	KEV	Oct 13 19:22 UTC
CVE-2026-96951Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. From the advisory Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Microsoft Microsoft Windows 11 version 23H2 Microsoft Windows 11 Version 24H2 Microsoft Windows 11 Version 25H2 Microsoft Windows 11 version 26H1 Microsoft Windows 11 Version 26H2 Microsoft Windows 10 Version 1809 Microsoft Windows 10 Version 21H2 Microsoft Windows 10 Version 22H2 Microsoft Windows 10 Version 1607 Microsoft Windows Server 2012 R2 Microsoft Outlook.com NIST National Vulnerability DatabasePublished Oct 13, 2026 19:22 UTC Read the advisory
	High	8.6	CVE-2026-104935	Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands IvantiIvanti Connect Secure	NVD	KEV	Oct 13 16:17 UTC
CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands From the advisory Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior. Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Affects Ivanti Ivanti Connect Secure NIST National Vulnerability DatabasePublished Oct 13, 2026 16:17 UTC Read the advisory
	Critical	9.3	CVE-2026-21589	This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center AtlassianAtlassian Bamboo Data Center, Atlassian Bitbucket Data Center, Atlassian Confluence Data Center, Atlassian Crowd Data Center, Atlassian Crucible Data Center, Atlassian Fisheye Data Center, Atlassian Jira Service Management Data Center, Atlassian Jira Software Data Center, Atlassian Bitbucket Server, Atlassian Crowd, Atlassian Jira Data Center, Atlassian Jira Service Desk	NVD	KEV	Oct 5 22:16 UTC
CVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center From the advisory This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Atlassian Atlassian Bamboo Data Center Atlassian Bitbucket Data Center Atlassian Confluence Data Center Atlassian Crowd Data Center Atlassian Crucible Data Center Atlassian Fisheye Data Center Atlassian Jira Service Management Data Center Atlassian Jira Software Data Center Atlassian Bitbucket Server Atlassian Crowd Atlassian Jira Data Center Atlassian Jira Service Desk NIST National Vulnerability DatabasePublished Oct 5, 2026 22:16 UTC Read the advisory
	Critical	9.3	CVE-2026-105134	A flaw has been found in Ahsay AhsayCBS up to 10.3.2 AhsayAhsayCBS, Ahsay Cloud Backup Suite	NVD	KEV	Oct 4 07:16 UTC
CVE-2026-105134A flaw has been found in Ahsay AhsayCBS up to 10.3.2 From the advisory A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Ahsay AhsayCBS Ahsay Cloud Backup Suite NIST National Vulnerability DatabasePublished Oct 4, 2026 07:16 UTC Read the advisory
	Medium	5.5	CVE-2026-105133	A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2 AhsayAhsayCBS, Ahsay Cloud Backup Suite	NVD	KEV	Oct 4 07:16 UTC
CVE-2026-105133A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2 From the advisory A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Ahsay AhsayCBS Ahsay Cloud Backup Suite NIST National Vulnerability DatabasePublished Oct 4, 2026 07:16 UTC Read the advisory
	High	8.7	CVE-2026-88779	Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway:... Citrix, NetScalerCitrix Netscaler Application Delivery Controller, Citrix Netscaler Gateway, NetScaler ADC, NetScaler Gateway	NVD	KEV	Oct 4 04:16 UTC
CVE-2026-88779Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway:... From the advisory Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Citrix NetScaler Citrix Netscaler Application Delivery Controller Citrix Netscaler Gateway NetScaler ADC NetScaler Gateway NIST National Vulnerability DatabasePublished Oct 4, 2026 04:16 UTC Read the advisory
	Critical	9.8	CVE-2026-104286	An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6,... FortinetFortinet FortiMail	NVD	KEV	Oct 1 20:17 UTC
CVE-2026-104286An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6,... From the advisory An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Fortinet Fortinet FortiMail NIST National Vulnerability DatabasePublished Oct 1, 2026 20:17 UTC Read the advisory
	Critical	9.4	CVE-2026-102490	Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account... Zammad GmbH, ZammadZammad GmbH Zammad, Zammad	NVD	KEV	Sep 30 17:16 UTC
CVE-2026-102490Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account... From the advisory Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X Affects Zammad GmbH Zammad Zammad GmbH Zammad Zammad NIST National Vulnerability DatabasePublished Sep 30, 2026 17:16 UTC Read the advisory
	Critical	9.4	CVE-2026-102489	Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user Zammad GmbH, ZammadZammad GmbH Zammad, Zammad	NVD	KEV	Sep 30 17:16 UTC
CVE-2026-102489Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user From the advisory Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X Affects Zammad GmbH Zammad Zammad GmbH Zammad Zammad NIST National Vulnerability DatabasePublished Sep 30, 2026 17:16 UTC Read the advisory
	Critical	9.8	CVE-2026-76504	A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system... CiscoCisco Catalyst SD-WAN Manager	NVD	KEV	Sep 30 13:17 UTC
CVE-2026-76504A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system... From the advisory A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Cisco Cisco Catalyst SD-WAN Manager NIST National Vulnerability DatabasePublished Sep 30, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-86950	An out-of-bounds write issue was addressed with improved bounds checking AppleApple iOS and iPadOS, Apple macOS, Apple Ipados, Apple Iphone Os	NVD	KEV	Sep 28 20:17 UTC
CVE-2026-86950An out-of-bounds write issue was addressed with improved bounds checking From the advisory An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Apple Apple iOS and iPadOS Apple macOS Apple Ipados Apple Iphone Os NIST National Vulnerability DatabasePublished Sep 28, 2026 20:17 UTC Read the advisory
	Critical	9.5	CVE-2026-88772	Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before... Citrix, Citrix NetScalerCitrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Netscaler Application Delivery Controller, Citrix Netscaler Gateway	NVD	KEV	Sep 27 17:16 UTC
CVE-2026-88772Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before... From the advisory Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Citrix Citrix NetScaler Citrix NetScaler ADC Citrix NetScaler Gateway Citrix Netscaler Application Delivery Controller Citrix Netscaler Gateway NIST National Vulnerability DatabasePublished Sep 27, 2026 17:16 UTC Read the advisory
	Critical	9.5	CVE-2026-88771	Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37... Citrix, Citrix NetScalerCitrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Netscaler Application Delivery Controller, Citrix Netscaler Gateway	NVD	KEV	Sep 27 17:16 UTC
CVE-2026-88771Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37... From the advisory Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Citrix Citrix NetScaler Citrix NetScaler ADC Citrix NetScaler Gateway Citrix Netscaler Application Delivery Controller Citrix Netscaler Gateway NIST National Vulnerability DatabasePublished Sep 27, 2026 17:16 UTC Read the advisory
	Critical	9.2	CVE-2026-110447	CVE-2026-110447 added to KEV: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora, NextcloudCollabora Online – Built-in CODE Server, Collabora Online, Nextcloud Collabora Online - Built-in CODE Server, Nextcloud richdocumentscode	CISA KEV	KEV	Oct 23
CVE-2026-110447CVE-2026-110447 added to KEV: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Executive summary A command injection flaw in the Collabora Online Built-in CODE Server app for Nextcloud is being actively exploited, and attackers have planted web shells on some servers. The advisory says it is severe and tells administrators to update the app right away. Collabora itself is not affected, according to the advisory. Technical summary The flaw is an OS command injection in the richdocumentscode app, which starts Collabora through a PHP exec call. Exploitation is reported in the wild, with users finding web shells on Nextcloud servers. The advisory lists richdocumentscode v26.4.302 and older as affected and says the issue is fixed in richdocuments .303, though the exact fixed richdocumentscode version is not stated. Docker, Linux distribution packages, and hosted Collabora services are listed as not affected, and the advisory names a severity of 9.2 out of 10. No workaround is stated beyond removing the app, and a user reports that an extra file Nx_33143.php appeared in the app directory, which the integrity check flagged. Administrators should review access logs for proxy.php?status requests and hunt for unexpected PHP files, but the advisory does not give formal detection guidance, and the CVSS vector is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Collabora Nextcloud Collabora Online – Built-in CODE Server Collabora Online Nextcloud Collabora Online - Built-in CODE Server Nextcloud richdocumentscode CISA Known Exploited Vulnerabilities CatalogPublished Oct 23, 2026 Read the advisory
	Critical	9.4	CVE-2026-114625	CVE-2026-114625 added to KEV: Arista VeloCloud Orchestrator SQL Injection Vulnerability AristaArista VeloCloud Orchestrator	CISA KEV	KEV	Oct 23
CVE-2026-114625CVE-2026-114625 added to KEV: Arista VeloCloud Orchestrator SQL Injection Vulnerability Executive summary Arista's VeloCloud Orchestrator on-premises software has a SQL injection flaw that lets an authenticated user gain operator privileges and reach internal-only functions. The advisory rates it critical (CVSS v3.1 base score 9.9) and says it is known to be actively exploited. The vendor recommends upgrading to a fixed release as soon as possible, and restricting access to the orchestrator's web interface until then. Technical summary The flaw is classified as CWE-89 SQL injection and is reachable over the network through the VCO web interface. Exploitation requires a valid authenticated session, with the lowest role being Enterprise Read Only, and the advisory states there is no configuration that prevents the exposure. Affected versions are 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, and 6.4.x prior to 6.4.2.12, and fixed versions are 5.2.3.18, 6.1.3.10, and 6.4.2.12 and later in their trains. Workarounds are not stated beyond defense-in-depth controls such as restricting web interface access, monitoring for known malicious IPs (74.82.197.86 and 38.54.50.151), reviewing web access logs for unusual paths, and watching for webshells and backdoor daemons. The advisory does not state end-of-support versions, which were not assessed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Arista Arista VeloCloud Orchestrator CISA Known Exploited Vulnerabilities CatalogPublished Oct 23, 2026 Read the advisory
	High	8.4	CVE-2026-110936	CVE-2026-110936 added to KEV: Siemens Software Center Uncontrolled Search Path Element Vulnerability SiemensSiemens Software Center	CISA KEV	KEV	Oct 20
CVE-2026-110936CVE-2026-110936 added to KEV: Siemens Software Center Uncontrolled Search Path Element Vulnerability From the advisory Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal agencies must act by 2026-11-03. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Siemens Siemens Software Center CISA Known Exploited Vulnerabilities CatalogPublished Oct 20, 2026 Read the advisory
	Medium	5.3	CVE-2026-96652	CVE-2026-96652 added to KEV: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability PlexPlex Media Server	CISA KEV	KEV	Oct 20
CVE-2026-96652CVE-2026-96652 added to KEV: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability From the advisory Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal agencies must act by 2026-11-03. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Plex Plex Media Server CISA Known Exploited Vulnerabilities CatalogPublished Oct 20, 2026 Read the advisory
	Medium	6.9	CVE-2026-96654	CVE-2026-96654 added to KEV: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability PlexPlex Media Server	CISA KEV	KEV	Oct 20
CVE-2026-96654CVE-2026-96654 added to KEV: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability From the advisory Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal agencies must act by 2026-10-23. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Plex Plex Media Server CISA Known Exploited Vulnerabilities CatalogPublished Oct 20, 2026 Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Known exploited

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited