https://spectrumsec.eu/news/Aggregated from public government, CERT and community sources. SpectrumSec does not author these items — follow each link for the original.en-GBSun, 18 Oct 2026 15:59:43 +0000https://isc.sans.edu/diary/rss/33434aea64b1b41f60719Sun, 18 Oct 2026 12:59:30 +0000SANS Internet Storm CenterOrphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th) (via SANS Internet Storm Center)researchhttps://nvd.nist.gov/vuln/detail/CVE-2026-1119981e2de0b072a0e771Sun, 18 Oct 2026 12:17:11 +0000NVD Critical CVEsVanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, even… (via NVD Critical CVEs)CVECVE-2026-111998criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111911b85a2314fe5c500cSat, 17 Oct 2026 19:16:33 +0000NVD Critical CVEsphpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to regis… (via NVD Critical CVEs)CVECVE-2026-111911criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-104736d61ac0e008144db3Sat, 17 Oct 2026 04:16:47 +0000NVD Critical CVEsThe LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field()… (via NVD Critical CVEs)CVECVE-2026-104736criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-110653dda5561fd4bbefbeSat, 17 Oct 2026 03:16:28 +0000NVD Critical CVEsThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attem… (via NVD Critical CVEs)CVECVE-2026-110653criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111711d96b9dedf50bd2b7Fri, 16 Oct 2026 18:17:55 +0000NVD Critical CVEsNetcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username long… (via NVD Critical CVEs)CVECVE-2026-111711criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111704366a73b22afcf865Fri, 16 Oct 2026 18:17:54 +0000NVD Critical CVEsLangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM… (via NVD Critical CVEs)CVECVE-2026-111704criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111693bbf815469ca5cb77Fri, 16 Oct 2026 18:17:52 +0000NVD Critical CVEsDataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain… (via NVD Critical CVEs)CVECVE-2026-111693criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111690c79167e635c4ad68Fri, 16 Oct 2026 18:17:52 +0000NVD Critical CVEsSimple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId cla… (via NVD Critical CVEs)CVECVE-2026-111690criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-1116435e8b761deafdd91cFri, 16 Oct 2026 18:17:45 +0000NVD Critical CVEsMisaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32… (via NVD Critical CVEs)CVECVE-2026-111643criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111641c39c5c6bfc9f8659Fri, 16 Oct 2026 18:17:44 +0000NVD Critical CVEsFastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login toke… (via NVD Critical CVEs)CVECVE-2026-111641criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111626670ad60332194989Fri, 16 Oct 2026 18:17:42 +0000NVD Critical CVEsWebreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administ… (via NVD Critical CVEs)CVECVE-2026-111626criticalhttps://www.cisa.gov/resources-tools/resources/cyber-threat-actors-use-variety-techniques-target-election-and-campaign-officials4e525e143e8c3f3dFri, 16 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesCISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login crede… (via CISA Cybersecurity Advisories)advisoryhttps://www.cisa.gov/resources-tools/resources/key-practices-incident-readiness-and-response-super-intelligence-training-and-evaluation576634fb177ce16eFri, 16 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesThe National Institute of Standards and Technology (NIST), National Security Agency’s Super Intelligence Security Center (NSA SISC) and Cybersecurity and Infrastructure Security Agency (CISA) published Key Practices for Incident Readiness and Response in Super Intelligence Traini… (via CISA Cybersecurity Advisories)advisoryhttps://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support90ef0f2bf47ec9edFri, 16 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesCISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade fir… (via CISA Cybersecurity Advisories)CVE-2026-102764advisoryhttps://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalogae4608a27522a7cfFri, 16 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoof… (via CISA Cybersecurity Advisories)CVE-2025-61624CVE-2026-102764advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-1047305aca8a62eef02d77Fri, 16 Oct 2026 07:17:08 +0000NVD Critical CVEsThe Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers t… (via NVD Critical CVEs)CVECVE-2026-104730criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-890793a3b98ff0d9eaa0cFri, 16 Oct 2026 06:17:12 +0000NVD Critical CVEsThe Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthentic… (via NVD Critical CVEs)CVECVE-2026-89079criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-103768f71d359e8a5715a2Fri, 16 Oct 2026 06:17:03 +0000NVD Critical CVEsThe ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This… (via NVD Critical CVEs)CVECVE-2026-103768criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-1092193d88663e58833273Fri, 16 Oct 2026 05:17:29 +0000NVD Critical CVEsThe Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file nam… (via NVD Critical CVEs)CVECVE-2026-109219criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-10951599b82ff5ecf53ca0Fri, 16 Oct 2026 05:17:29 +0000NVD Critical CVEsThe MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplie… (via NVD Critical CVEs)CVECVE-2026-109515criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-10479808130000bd9504ceFri, 16 Oct 2026 05:17:28 +0000NVD Critical CVEsThe My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowin… (via NVD Critical CVEs)CVECVE-2026-104798criticalhttps://isc.sans.edu/diary/rss/334306d11cb1202f1c0c8Fri, 16 Oct 2026 00:46:35 +0000SANS Internet Storm CenterSmall Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th) (via SANS Internet Storm Center)researchhttps://nvd.nist.gov/vuln/detail/CVE-2026-102764276f399dab6bb140Fri, 16 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesThe vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. (via CISA Known Exploited Vulnerabilities)KEVCVECVE-2026-102764criticalhttps://nvd.nist.gov/vuln/detail/CVE-2025-616246725d9a3b8ee7396Fri, 16 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesFortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. (via CISA Known Exploited Vulnerabilities)KEVCVE-2025-61624https://nvd.nist.gov/vuln/detail/CVE-2026-1113298ecb07afc6e6d3dcThu, 15 Oct 2026 22:19:31 +0000NVD Critical CVEsJuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to contro… (via NVD Critical CVEs)CVECVE-2026-111329criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-1113221cf2d23080cc2af1Thu, 15 Oct 2026 22:19:30 +0000NVD Critical CVEsArchon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPe… (via NVD Critical CVEs)CVECVE-2026-111322criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-1112837f28baabd9c5804cThu, 15 Oct 2026 22:19:29 +0000NVD Critical CVEsBMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username… (via NVD Critical CVEs)CVECVE-2026-111283criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111281de412cfedc7a6fd7Thu, 15 Oct 2026 22:19:29 +0000NVD Critical CVEsJooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an a… (via NVD Critical CVEs)CVECVE-2026-111281criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-110958248a11fb326826a8Thu, 15 Oct 2026 16:17:48 +0000NVD Critical CVEsA vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be use… (via NVD Critical CVEs)CVECVE-2026-110958criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-111094dca7501d22f7d946Thu, 15 Oct 2026 16:17:48 +0000NVD Critical CVEsIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible (via NVD Critical CVEs)CVECVE-2026-111094criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-1109577f9662b97394d90eThu, 15 Oct 2026 15:17:30 +0000NVD Critical CVEsA vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initia… (via NVD Critical CVEs)CVECVE-2026-110957criticalhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01307fc48bec6b0bf9Thu, 15 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107333, CVE-2026-107362, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.08.0 () CVSS Vendor Equipment v3 8.1 CISA Malcolm 5 Vuln… (via CISA Cybersecurity Advisories)CVE-2026-107333CVE-2026-107334CVE-2026-107335CVE-2026-107336CVE-2026-107337CVE-2026-107361https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02769eb8106e41d884Thu, 15 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4.9.6 (CVE-2026-107617, CVE-2026-97858, CVE-2026-10… (via CISA Cybersecurity Advisories)CVE-2026-107617CVE-2026-97858advisoryicshttps://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-0186b82961354a0413Thu, 15 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software <=5.18 (CVE-2026-107777) CVSS Vendor Equipmen… (via CISA Cybersecurity Advisories)CVE-2026-107777advisoryhttps://www.ncsc.gov.uk/blogs/post-quantum-updates-to-our-tls-guidancecd8ef8034fa90562Thu, 15 Oct 2026 12:00:00 +0000NCSC UKThe NCSC publishes its recommendations for configuring post-quantum cryptography in TLS. Now is time to migrate. (via NCSC UK)guidancehttps://www.ncsc.gov.uk/guidance/using-tls-to-protect-datae1bfd0abf2610173Thu, 15 Oct 2026 12:00:00 +0000NCSC UKRecommended profiles to securely configure TLS for the most common versions and scenarios, with additional guidance for managing older versions. (via NCSC UK)guidancehttps://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02ea0e140b6f9eb8eaThu, 15 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The following versi… (via CISA Cybersecurity Advisories)advisoryhttps://www.cisa.gov/news-events/alerts/2026/10/15/cisa-adds-one-known-exploited-vulnerability-catalogf0618fbb3f3a2bffThu, 15 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability This type of vulnerability is a frequ… (via CISA Cybersecurity Advisories)CVE-2026-21589advisoryhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01fbd4f0423b7b4a6aThu, 15 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Ecli… (via CISA Cybersecurity Advisories)advisoryicshttps://nvd.nist.gov/vuln/detail/CVE-2026-108587145688bc2d9c6565Thu, 15 Oct 2026 05:17:02 +0000NVD Critical CVEsThe 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filter… (via NVD Critical CVEs)CVECVE-2026-108587criticalhttps://isc.sans.edu/diary/rss/33426f71fb556fb862bd9Thu, 15 Oct 2026 01:10:57 +0000SANS Internet Storm CenterPanchan's Mining Island [Guest Diary], (Wed, Oct 14th) (via SANS Internet Storm Center)researchhttps://nvd.nist.gov/vuln/detail/CVE-2026-21589a28d52db14409911Thu, 15 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesMultiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability whi… (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-21589https://nvd.nist.gov/vuln/detail/CVE-2026-11086230830763dbf9deb9Wed, 14 Oct 2026 23:17:27 +0000NVD Critical CVEsBetter Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit th… (via NVD Critical CVEs)CVECVE-2026-110862criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-1105367ac12144a0fe486bWed, 14 Oct 2026 19:17:10 +0000NVD Critical CVEsA vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The… (via NVD Critical CVEs)CVECVE-2026-110536criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-101982cedba2de4c33f5f6Wed, 14 Oct 2026 18:17:13 +0000NVD Critical CVEsA Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisement… (via NVD Critical CVEs)CVECVE-2026-101982criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-10195497fe9b9ab767e97fWed, 14 Oct 2026 18:17:11 +0000NVD Critical CVEsAn Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a… (via NVD Critical CVEs)CVECVE-2026-101954criticalhttps://nvd.nist.gov/vuln/detail/CVE-2026-76519797c37d84e415538Wed, 14 Oct 2026 17:19:10 +0000NVD Critical CVEsA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the… (via NVD Critical CVEs)KEVCVECVE-2026-76519criticalhttps://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog616ea1fba64001b4Wed, 14 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesCISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerab… (via CISA Cybersecurity Advisories)CVE-2026-0322CVE-2026-76519advisoryhttps://isc.sans.edu/diary/rss/33420ec26e3c9fb04b850Wed, 14 Oct 2026 06:49:46 +0000SANS Internet Storm CenterOrphaned VBA Projects Inside DWG Files, (Wed, Oct 14th) (via SANS Internet Storm Center)researchhttps://nvd.nist.gov/vuln/detail/CVE-2026-10513400c155ac620da522Wed, 14 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesAhsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be… (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-105134https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-013/2b733717310dddecWed, 14 Oct 2026 00:00:00 +0000CERT-FR AlertesUne vulnérabilité a été découverte dans Ivanti Connect Secure (ICS). Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la politique de sécurité. Ivanti indique que cette vulnérabilité CVE-2026-1… (via CERT-FR Alertes)FRalerthttps://nvd.nist.gov/vuln/detail/CVE-2026-03222f5fc483578596d3Wed, 14 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesPalo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-0322https://nvd.nist.gov/vuln/detail/CVE-2026-1051335c8355910c62fa69Wed, 14 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesAhsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-105133CVE-2026-105134https://isc.sans.edu/diary/rss/33422ad23861831136216Tue, 13 Oct 2026 19:25:52 +0000SANS Internet Storm CenterOctober 2026 Microsoft Patch Tuesday, (Tue, Oct 13th) (via SANS Internet Storm Center)researchhttps://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure0b5b8a5c7759b503Tue, 13 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesCISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935 , affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass… (via CISA Cybersecurity Advisories)CVE-2026-104935advisoryhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-286-020d3be6b6fae4f063Tue, 13 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SWIFI-SE2KIC firmware <=2.0.22 (CVE-2026-107605, CVE-2026-107606… (via CISA Cybersecurity Advisories)CVE-2026-107605CVE-2026-107606advisoryicshttps://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog897e03545f1ebc4dTue, 13 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96951 Microsoft Windows Command Injection Vulnerability CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnera… (via CISA Cybersecurity Advisories)CVE-2026-104935CVE-2026-96951advisoryhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-286-019a5d4539ca389a36Tue, 13 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level. The following versions of Inductive Automation Ignition Software are affected: Ignition >=8.1.0|<=8.1.54 (CVE-2026-92817) Ig… (via CISA Cybersecurity Advisories)CVE-2026-92817advisoryicshttps://nvd.nist.gov/vuln/detail/CVE-2026-1049352da9c1010cc7d8dfTue, 13 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesIvanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-104935https://nvd.nist.gov/vuln/detail/CVE-2026-969514f94f829218d8dd4Tue, 13 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesMicrosoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-96951https://www.ncsc.gov.uk/blogs/help-ncsc-understand-how-organisations-approach-external-attack-surface-riskbd329adf4cfc001eMon, 12 Oct 2026 12:00:00 +0000NCSC UKWe're looking to hear from people involved in evaluating, selecting or adopting EASM. (via NCSC UK)guidancehttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/8aaef6f507c465baMon, 12 Oct 2026 00:00:00 +0000CERT-FR AlertesLe CERT-FR a connaissance de nombreuses compromissions de Danfoss série AK-SM et AK-SC. L'exposition d'une interface de gestion sur Internet est contraire aux bonnes pratiques. Dans le cas où l’administration à distance est impérative, une première mesure temporaire peut consiste… (via CERT-FR Alertes)FRalerthttps://isc.sans.edu/diary/rss/3341422a3e2e00caf6482Sat, 10 Oct 2026 09:11:34 +0000SANS Internet Storm CenterWhy TLP should not replace your internal information classification, (Sat, Oct 10th) (via SANS Internet Storm Center)researchhttps://isc.sans.edu/diary/rss/33410ef3bdd7a7d22935aThu, 08 Oct 2026 16:52:53 +0000SANS Internet Storm CenterReconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th) (via SANS Internet Storm Center)researchhttps://www.ncsc.gov.uk/news/china-linked-actors-called-out-by-uk-and-international-partners-for-targeting-sensitive-data3550c28eb21e754bThu, 08 Oct 2026 12:00:00 +0000NCSC UKJoint advisory with international partners highlights malicious targeting of organisations from a range of sectors across the globe. (via NCSC UK)guidancehttps://www.cisa.gov/news-events/ics-advisories/icsa-26-281-034c82948f2fde3b15Thu, 08 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code. The following versions… (via CISA Cybersecurity Advisories)advisoryicshttps://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281abf1d7ae18b6dedecThu, 08 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesAdvisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat actors, enabled by the Integrity Technology… (via CISA Cybersecurity Advisories)advisoryhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01f58da9be9c2cd903Thu, 08 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to r… (via CISA Cybersecurity Advisories)advisoryicshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02fad0f7b297536f4dThu, 08 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) openPDC (Docker image) <2.9.477, <2.9.482 (CVE-2026-104629… (via CISA Cybersecurity Advisories)CVE-2026-100730CVE-2026-101022CVE-2026-104629CVE-2026-105281CVE-2026-85479advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2015-54773329164850c00ca7Thu, 08 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. (via CISA Known Exploited Vulnerabilities)KEVCVE-2015-5477https://nvd.nist.gov/vuln/detail/CVE-2023-22894643268a2ab4f71b6Thu, 08 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesStrapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are… (via CISA Known Exploited Vulnerabilities)KEVCVE-2023-22894https://nvd.nist.gov/vuln/detail/CVE-2021-31996d4b290d6194eeb4Thu, 08 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. (via CISA Known Exploited Vulnerabilities)KEVCVE-2021-3199https://nvd.nist.gov/vuln/detail/CVE-2016-3081a170cad5cf8a8376Thu, 08 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesApache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. (via CISA Known Exploited Vulnerabilities)KEVCVE-2016-3081https://nvd.nist.gov/vuln/detail/CVE-2015-3306b7b5aa464b4a6ce4Thu, 08 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. (via CISA Known Exploited Vulnerabilities)KEVCVE-2015-3306https://isc.sans.edu/diary/rss/33406394be2a0c7c952ffWed, 07 Oct 2026 14:59:33 +0000SANS Internet Storm CenterScans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th) (via SANS Internet Storm Center)CVE-2026-21589researchhttps://isc.sans.edu/diary/rss/334003a8c72da98193920Tue, 06 Oct 2026 13:16:02 +0000SANS Internet Storm CenterMore RMM Tools In the Wild, (Tue, Oct 6th) (via SANS Internet Storm Center)researchhttps://www.ncsc.gov.uk/news/incident-affecting-asos-customers0aa7163c9d2cb844Tue, 06 Oct 2026 12:00:00 +0000NCSC UKASOS has said it is investigating a cyber incident and that some customer personal information may have been accessed. (via NCSC UK)guidancehttps://www.cisa.gov/news-events/ics-advisories/icsa-26-279-0130b52d2fc768757dTue, 06 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. The following versions of Johnson Controls EasyIO FG are affected: EasyIO FG firmware <=2.0b52 (CVE-2026-27872, CVE-2026-27873) CVSS Vendor E… (via CISA Cybersecurity Advisories)CVE-2026-27872CVE-2026-27873advisoryicshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-279-043bf96eac7c2fcc85Tue, 06 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and avail… (via CISA Cybersecurity Advisories)advisoryicshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-279-054f0c5d36cee95535Tue, 06 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. Please refer to the Recommended Immedi… (via CISA Cybersecurity Advisories)advisoryicshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-279-0270be64174d6579c0Tue, 06 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client are affected: lwIP SMTP client 2.2.1 (CVE-2026-15340) CVSS Vendo… (via CISA Cybersecurity Advisories)CVE-2026-15340advisoryicshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-279-03bce52ccd711d90ffTue, 06 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality, integrity and availability impact on the prod… (via CISA Cybersecurity Advisories)advisoryicshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06db461caabe0c965bTue, 06 Oct 2026 12:00:00 +0000CISA Cybersecurity AdvisoriesView CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware versions that were developed… (via CISA Cybersecurity Advisories)advisoryicshttps://isc.sans.edu/diary/rss/33396e30c5b945143e32eMon, 05 Oct 2026 00:15:00 +0000SANS Internet Storm CenterTTY Logs and the Data it Captures, (Sun, Oct 4th) (via SANS Internet Storm Center)researchhttps://nvd.nist.gov/vuln/detail/CVE-2026-88779ef91de618747d24eSun, 04 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesCitrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-88779https://cert.europa.eu/publications/threat-intelligence/cb26-10/bd07a402cf3632a2Fri, 02 Oct 2026 17:00:00 +0000CERT-EUCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any i… (via CERT-EU)threat-intelhttps://nvd.nist.gov/vuln/detail/CVE-2026-1024890e2fce4f1a1953eeFri, 02 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesZammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-102489CVE-2026-102490https://nvd.nist.gov/vuln/detail/CVE-2026-1024906347b6bb6b0dd27fFri, 02 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesZammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-102489CVE-2026-102490https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-0132e4df0c22cff8b8Thu, 01 Oct 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary The following versions of CISA Malcolm are affected: Malcolm CVSS Vendor Equipment Vulnerabilities v3 8.8 CISA CISA Malcolm Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Special Elements used in… (via CISA ICS Advisories)icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-274-064c487f67fda0a5c1Thu, 01 Oct 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization… (via CISA ICS Advisories)icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-274-04b39ff47a9d6f32ccThu, 01 Oct 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are… (via CISA ICS Advisories)icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-274-03e6c25c75b7ceaa11Thu, 01 Oct 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files. The following versions of ABB Protection and Control IED Manager PCM600 are affected: Protection and Control IED Manager PCM600 <=2.14 (CVE-2026-1… (via CISA ICS Advisories)icshttps://nvd.nist.gov/vuln/detail/CVE-2026-104286b2eb524aefa78828Thu, 01 Oct 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesFortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-104286https://nvd.nist.gov/vuln/detail/CVE-2026-765048674d3195e6cccb0Wed, 30 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesCisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-76504https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-064325786426012c69Tue, 29 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. The following versions of MikroTik RouterOS are affected: RouterOS <7.24 (CVE-2026-84411) CVSS Vendor Equipment Vulnerabilities v… (via CISA ICS Advisories)CVE-2026-84411icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-272-036c7ec78480f96d0eTue, 29 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system. The following versions of VIVOTEK Camera Firmware are af… (via CISA ICS Advisories)icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-272-01b99a27d23f5221f3Tue, 29 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitrary code with root privileges. The following versions of Lantronix G520 Series Cellular Gateway are affected: G520 Series 2.6.0.4R6_stable (CVE-2026-84… (via CISA ICS Advisories)icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02c8fcbf0e2df6a700Tue, 29 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code. The following versions of Toptech TMS7 and TopHAT are affected: TMS7 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713… (via CISA ICS Advisories)CVE-2026-63713CVE-2026-70356CVE-2026-71379CVE-2026-72510icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-272-04ef19b502f5a8b531Tue, 29 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service condition. The following versions of Baicells Nova 430H are affected: Nova 430H eNodeB (model pBS3101SH) <=BaiBLQ_3.0.12 (CVE… (via CISA ICS Advisories)icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07faadc0b2b19a69a4Tue, 29 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform. The following versions of Viidure Dashcam Android Ap… (via CISA ICS Advisories)icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05fbfa52177ee528e6Tue, 29 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. The following versions of Anjvision YSSD-RTMP-H5 are affected: YSSD-R… (via CISA ICS Advisories)icshttps://nvd.nist.gov/vuln/detail/CVE-2026-86950973397c2ff962cf0Tue, 29 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesApple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-86950https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway7b1e1e501b33f733Mon, 28 Sep 2026 12:00:00 +0000NCSC UKThe NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited. (via NCSC UK)guidancehttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/52369fa32b06599eMon, 28 Sep 2026 00:00:00 +0000CERT-FR Alertes**[Mise à jour du 05 octobre 2026]** Le 4 octobre 2026, Citrix a publié un avis concernant une nouvelle vulnérabilité (CVE-2026-88779) permettant un déni de service à distance. La CISA indique que cette vulnérabilité est activement exploitée. **[Mise à jour du 30 septembre 2026]*… (via CERT-FR Alertes)CVE-2026-88779FRalerthttps://nvd.nist.gov/vuln/detail/CVE-2026-887725341fefad01dc143Sun, 27 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesCitrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-88772https://nvd.nist.gov/vuln/detail/CVE-2026-887717b30d9e83ece7359Sun, 27 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesCitrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-88771https://nvd.nist.gov/vuln/detail/CVE-2026-879022754cda4fe7bd868Fri, 25 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesWordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-87902https://nvd.nist.gov/vuln/detail/CVE-2026-656606c7b4a4e3da57e0fFri, 25 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesMicrosoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-65660https://nvd.nist.gov/vuln/detail/CVE-2026-67279c3ad82d8a0e4309cFri, 25 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesMikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-67279CVE-2026-86060https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-012f1910289d0ad2a2Thu, 24 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device operation. The following versi… (via CISA ICS Advisories)icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-267-027075b981cb319001Thu, 24 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code. The following versions of Eufy Omni C20, Omni X10 Pro are affected: Omni C20 <1.6.4 (CVE-2026-93289, CVE-2026-93290, CVE-2026-93291)… (via CISA ICS Advisories)CVE-2026-93289CVE-2026-93290CVE-2026-93291icshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-209-02d37255785eac8b01Thu, 24 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute. The following versions of Siemens Mendix Runtime are affected: Siemens Mendix Runtime vers:all/* (CVE-2026… (via CISA ICS Advisories)icshttps://nvd.nist.gov/vuln/detail/CVE-2026-5430976ad119a3a76047Thu, 24 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesWSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-5430https://nvd.nist.gov/vuln/detail/CVE-2026-713629ca85014a9e93eedThu, 24 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesAdobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-71362https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-031e0426abc892cecfTue, 22 Sep 2026 12:00:00 +0000CISA ICS AdvisoriesView CSAF Summary A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . This vulnerability allows an attacker to upload arbitrary files, which can lead to… (via CISA ICS Advisories)icshttps://nvd.nist.gov/vuln/detail/CVE-2026-9395201271320a5d0fd19Tue, 22 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesArista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availab… (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-93952https://nvd.nist.gov/vuln/detail/CVE-2026-941270f86d09d31f17aa5Tue, 22 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesF5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-94127https://nvd.nist.gov/vuln/detail/CVE-2026-851022e32251fa43351edTue, 22 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesCheck Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-85102https://nvd.nist.gov/vuln/detail/CVE-2026-93616ef40b60f4f9033d3Tue, 22 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesCheck Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-93616https://www.ncsc.gov.uk/blogs/one-does-not-simply-defend-agenticallyb6d406ece8bb58b3Mon, 21 Sep 2026 12:00:00 +0000NCSC UKDefenders can’t use AI in the same way attackers can, but there’s much they can do to unlock the potential of agentic cyber defence. (via NCSC UK)guidancehttps://nvd.nist.gov/vuln/detail/CVE-2026-72731d08545d4b3250bdMon, 21 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesZyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-7273https://nvd.nist.gov/vuln/detail/CVE-2025-399640c5838febe7ed5eeFri, 18 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesLinux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. (via CISA Known Exploited Vulnerabilities)KEVCVE-2025-39964https://nvd.nist.gov/vuln/detail/CVE-2026-53266614f64918c627b8cFri, 18 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesLinux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life… (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-53266https://nvd.nist.gov/vuln/detail/CVE-2025-3968278a4707821ffbabbFri, 18 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesLinux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be… (via CISA Known Exploited Vulnerabilities)KEVCVE-2025-39682https://www.ncsc.gov.uk/blogs/cyber-adversary-simulation-cyas-scheme-documents-now-availableef7e9e7f98e8de88Thu, 17 Sep 2026 12:00:00 +0000NCSC UKOur view of good cyber adversary simulation – and how assured providers can deliver it. (via NCSC UK)guidancehttps://www.ncsc.gov.uk/guidance/adversary-simulation-what-you-need-to-knowf2348092d94d0525Thu, 17 Sep 2026 12:00:00 +0000NCSC UKAdversary simulation ('red teaming') tests your ability to prevent, detect and respond to cyber attacks. (via NCSC UK)guidancehttps://nvd.nist.gov/vuln/detail/CVE-2026-7646036e3f2c48fd0d2a7Wed, 16 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesCisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based man… (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-76460https://nvd.nist.gov/vuln/detail/CVE-2026-87886961918d350a3719fWed, 16 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesAcronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-87886https://nvd.nist.gov/vuln/detail/CVE-2026-58704e71f3bce3a4506f0Wed, 16 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesGoogle Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-58704https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists1161fa9309e3d7e8Tue, 15 Sep 2026 12:00:00 +0000NCSC UKUK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware. (via NCSC UK)guidancehttps://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists30487ba77b58e874Tue, 15 Sep 2026 12:00:00 +0000NCSC UKAdvisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves. (via NCSC UK)guidancehttps://nvd.nist.gov/vuln/detail/CVE-2026-76461f79e61586ea943afMon, 14 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesCisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-76461https://nvd.nist.gov/vuln/detail/CVE-2026-8570605cb3ce947f537ebFri, 11 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesGitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-85706https://nvd.nist.gov/vuln/detail/CVE-2026-8486913c41dd8483b7a8cFri, 11 Sep 2026 00:00:00 +0000CISA Known Exploited VulnerabilitiesConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. (via CISA Known Exploited Vulnerabilities)KEVCVE-2026-84869https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-010/2c4c7d25f14c7101Thu, 10 Sep 2026 00:00:00 +0000CERT-FR AlertesLe 06 août 2026, Metabase a publié un avis de sécurité concernant une vulnérabilité critique permettant à un attaquant non authentifié de provoquer une injection SQL (SQLi) dans la base de donnée de l'application Metabase. Cette injection SQL permet d’obtenir les droits administr… (via CERT-FR Alertes)FRalerthttps://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai65b33f6caf3eb2e0Mon, 07 Sep 2026 12:00:00 +0000NCSC UKUnderstanding why staff use unapproved AI tools is key to managing the security challenges they can create. (via NCSC UK)guidancehttps://cert.europa.eu/publications/threat-intelligence/cb26-09/57397c3281d7e7d4Thu, 03 Sep 2026 14:00:00 +0000CERT-EUCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any i… (via CERT-EU)threat-intelhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/07502649e465cd57Wed, 02 Sep 2026 00:00:00 +0000CERT-FR AlertesLe 01 septembre 2026, SonicWall a publié un avis de sécurité concernant deux vulnérabilités affectant les Secure Mobile Access (SMA) 1000. La vulnérabilité critique CVE-2026-83548 permet une falsification de requêtes côté serveur (SSRF) de la part d'un attaquant non authentifié… (via CERT-FR Alertes)CVE-2026-83548FRalerthttps://www.ncsc.gov.uk/news/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devicesfb56227792f4bc87Thu, 27 Aug 2026 12:00:00 +0000NCSC UKOwners of operational technology encouraged to address avoidable vulnerabilities, and build long-term cyber resilience. (via NCSC UK)guidancehttps://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-aia5fe1c1863fc89a8Thu, 20 Aug 2026 12:00:00 +0000NCSC UKUse safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity. (via NCSC UK)guidancehttps://www.ncsc.gov.uk/blogs/how-bitlocker-pins-help-protect-your-data-and-devices7e155a93bd41d6e2Thu, 13 Aug 2026 12:00:00 +0000NCSC UKUsing a PIN mitigates many BitLocker vulnerabilities. Make sure you’re ready for the next one... (via NCSC UK)guidancehttps://www.ncsc.gov.uk/blogs/help-shape-the-future-of-resilient-private-5gc6485440726300b8Wed, 12 Aug 2026 12:00:00 +0000NCSC UKThe NCSC wants to collaborate with organisations developing technologies and approaches for secure, resilient and deployable private 5G (via NCSC UK)guidancehttps://www.ncsc.gov.uk/blogs/water-sector-example-added-to-the-ncscs-secure-connectivity-principles0711d7f3ba538207Tue, 11 Aug 2026 12:00:00 +0000NCSC UKNew guidance is the first content authored by the Industrial Control System COI to appear on ncsc.gov.uk. (via NCSC UK)guidancehttps://www.ncsc.gov.uk/news/ncsc-statement-in-response-to-recent-incidents-resulting-from-frontier-ai-evaluations3d1d6ecffa743c40Tue, 04 Aug 2026 12:00:00 +0000NCSC UKA statement from Ollie Whitehouse, Chief Technology Officer at the NCSC, on AI security following recent incidents. (via NCSC UK)guidancehttps://cert.europa.eu/publications/threat-intelligence/cb26-08/774b5397e9371a6eMon, 03 Aug 2026 17:00:00 +0000CERT-EUCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any i… (via CERT-EU)threat-intelhttps://www.ncsc.gov.uk/blogs/making-forensic-observability-the-norm-for-network-devicesfbd1206cb8010f67Wed, 29 Jul 2026 12:00:00 +0000NCSC UKProgress is being made, but too many network devices still remain difficult to investigate after compromise (via NCSC UK)guidancehttps://www.ncsc.gov.uk/blogs/when-cyber-attacks-happen-helping-organisations-recover635ff0da3d382dd7Tue, 28 Jul 2026 12:00:00 +0000NCSC UKA highly disruptive incident can feel overwhelming. New guidance provides a framework for response and recovery. (via NCSC UK)guidancehttps://www.ncsc.gov.uk/news/uk-and-partners-expose-russian-state-supported-actors-for-new-zero-click-phishing-campaign98f3a356bca73b1bThu, 23 Jul 2026 12:00:00 +0000NCSC UKGCHQ’s National Cyber Security Centre and international partners issue warning as ‘LAUNDRY BEAR’ cyber threat group exposed for targeted phishing campaign (via NCSC UK)guidancehttps://www.ncsc.gov.uk/blogs/post-quantum-cryptography-pqc-migration-workshop-reportbc780d69efa8dbe2Wed, 22 Jul 2026 12:00:00 +0000NCSC UKNo organisation can navigate the migration alone; key takeaways from our first PQC migration workshop. (via NCSC UK)guidancehttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008/bd97320296d04fceWed, 22 Jul 2026 00:00:00 +0000CERT-FR AlertesLe 14 juillet 2026, à l'occasion de sa mise à jour mensuelle, Microsoft a publié, entre autres, des correctifs pour deux vulnérabilités critiques affectant SharePoint. Les vulnérabilités CVE-2026-50522 et CVE-2026-58644 permettent à un attaquant non authentifié d'exécuter du code… (via CERT-FR Alertes)CVE-2026-50522CVE-2026-58644FRalert