{ "query": { "exploited": "1", "page": "2" }, "count": 20, "total": 1734, "page": 2, "limit": 20, "updated": { "cves": "2026-10-06T00:45:13.875Z", "kev": "2026-10-06T00:44:13.530Z", "epss": "2026-10-06T00:57:13.818Z", "breaches": "2026-10-06T00:45:13.561Z", "posts": "2026-10-06T00:45:13.875Z" }, "links": { "web": "https://spydr.io/threats?exploited=1&page=2", "next": "https://spydr.io/threats.json?exploited=1&page=3" }, "warnings": [], "results": [ { "id": "CVE-2026-85880", "url": "https://spydr.io/cve/CVE-2026-85880", "published": "2026-09-08T18:21:14.087Z", "modified": "2026-09-24T23:19:20.773Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.03616, "epss_percentile": 0.89156, "exploited": true, "kev": { "added": "2026-09-08", "due": "2026-09-22", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 21H2", "Microsoft Windows 10 Version 22H2", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows Server 2022" ], "cwes": [ "CWE-122", "CWE-908" ], "description": "Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally." }, { "id": "CVE-2026-81963", "url": "https://spydr.io/cve/CVE-2026-81963", "published": "2026-09-08T18:21:00.090Z", "modified": "2026-09-09T05:18:17.173Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.00393, "epss_percentile": 0.31187, "exploited": true, "kev": { "added": "2026-09-08", "due": "2026-09-22", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 11 version 23H2", "Microsoft Windows 11 Version 24H2", "Microsoft Windows 11 Version 25H2", "Microsoft Windows 11 version 26H1", "Microsoft Windows Server 2025", "Microsoft Windows Server 2025 (Server Core installation)" ], "cwes": [ "CWE-59", "CWE-284" ], "description": "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally." }, { "id": "CVE-2026-75650", "url": "https://spydr.io/cve/CVE-2026-75650", "published": "2026-09-07T21:17:30.863Z", "modified": "2026-09-09T05:18:07.237Z", "score": 10, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "score_source": "adobe.com", "epss": 0.03949, "epss_percentile": 0.90102, "exploited": true, "kev": { "added": "2026-09-08", "due": "2026-09-11", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Adobe" ], "products": [ "Adobe Commerce", "Adobe Commerce B2B", "Adobe Magento Open Source" ], "cwes": [ "CWE-1336" ], "description": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed." }, { "id": "CVE-2026-86218", "url": "https://spydr.io/cve/CVE-2026-86218", "published": "2026-09-06T03:17:17.373Z", "modified": "2026-09-09T05:18:19.490Z", "score": 10, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "CNA", "epss": 0.12928, "epss_percentile": 0.96206, "exploited": true, "kev": { "added": "2026-09-08", "due": "2026-09-11", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "N-able" ], "products": [ "N-able N-central" ], "cwes": [ "CWE-96" ], "description": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14." }, { "id": "CVE-2026-86060", "url": "https://spydr.io/cve/CVE-2026-86060", "published": "2026-09-05T20:17:18.703Z", "modified": "2026-09-11T12:52:16.507Z", "score": 9.2, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "cert.pl", "epss": 0.06392, "epss_percentile": 0.9347, "exploited": true, "kev": { "added": "2026-09-10", "due": "2026-09-13", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Mikrotik" ], "products": [ "Mikrotik RouterOS" ], "cwes": [ "CWE-88" ], "description": "RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)" }, { "id": "CVE-2026-67279", "url": "https://spydr.io/cve/CVE-2026-67279", "published": "2026-09-05T20:17:18.390Z", "modified": "2026-09-26T04:17:47.273Z", "score": 6.9, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "cert.pl", "epss": 0.01027, "epss_percentile": 0.6239, "exploited": true, "kev": { "added": "2026-09-25", "due": "2026-09-28", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Mikrotik" ], "products": [ "Mikrotik RouterOS" ], "cwes": [ "CWE-841" ], "description": "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)" }, { "id": "CVE-2026-67277", "url": "https://spydr.io/cve/CVE-2026-67277", "published": "2026-09-05T20:17:18.120Z", "modified": "2026-09-11T12:52:29.533Z", "score": 8.8, "severity": "high", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "cert.pl", "epss": 0.0156, "epss_percentile": 0.74384, "exploited": true, "kev": { "added": "2026-09-10", "due": "2026-09-13", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Mikrotik" ], "products": [ "Mikrotik RouterOS" ], "cwes": [ "CWE-306" ], "description": "RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)" }, { "id": "CVE-2026-85046", "url": "https://spydr.io/cve/CVE-2026-85046", "published": "2026-09-03T20:17:24.210Z", "modified": "2026-09-21T13:17:10.970Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "CISA ADP", "epss": 0.48881, "epss_percentile": 0.98847, "exploited": true, "kev": { "added": "2026-09-04", "due": "2026-09-18", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Google" ], "products": [ "Google Chrome" ], "cwes": [ "CWE-843" ], "description": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)" }, { "id": "CVE-2026-83549", "url": "https://spydr.io/cve/CVE-2026-83549", "published": "2026-09-01T22:17:13.290Z", "modified": "2026-09-21T14:17:21.703Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "CISA ADP", "epss": 0.1076, "epss_percentile": 0.95712, "exploited": true, "kev": { "added": "2026-09-02", "due": "2026-09-05", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "SonicWall" ], "products": [ "SonicWall SMA1000" ], "cwes": [ "CWE-78" ], "description": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution." }, { "id": "CVE-2026-83548", "url": "https://spydr.io/cve/CVE-2026-83548", "published": "2026-09-01T22:17:13.170Z", "modified": "2026-09-03T13:06:16.053Z", "score": 10, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "score_source": "CISA ADP", "epss": 0.08757, "epss_percentile": 0.95021, "exploited": true, "kev": { "added": "2026-09-02", "due": "2026-09-05", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "SonicWall" ], "products": [ "SonicWall SMA1000" ], "cwes": [ "CWE-441", "CWE-918" ], "description": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations." }, { "id": "CVE-2026-82329", "url": "https://spydr.io/cve/CVE-2026-82329", "published": "2026-08-28T20:20:21.293Z", "modified": "2026-09-03T13:06:15.630Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "jfrog.com", "epss": 0.14121, "epss_percentile": 0.96474, "exploited": true, "kev": { "added": "2026-09-02", "due": "2026-09-05", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "jfrog" ], "products": [ "jfrog artifactory" ], "cwes": [ "CWE-287" ], "description": "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges." }, { "id": "CVE-2026-82078", "url": "https://spydr.io/cve/CVE-2026-82078", "published": "2026-08-28T16:18:31.240Z", "modified": "2026-09-14T00:16:56.777Z", "score": 9.4, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "CNA", "epss": 0.61394, "epss_percentile": 0.99143, "exploited": true, "kev": { "added": "2026-08-31", "due": "2026-09-14", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "PaperCut" ], "products": [ "PaperCut MF/NG" ], "cwes": [ "CWE-470" ], "description": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process." }, { "id": "CVE-2026-81578", "url": "https://spydr.io/cve/CVE-2026-81578", "published": "2026-08-28T16:18:29.600Z", "modified": "2026-09-14T00:16:56.207Z", "score": 8.8, "severity": "high", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "CNA", "epss": 0.84594, "epss_percentile": 0.99699, "exploited": true, "kev": { "added": "2026-08-31", "due": "2026-09-14", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "PaperCut" ], "products": [ "PaperCut MF/NG" ], "cwes": [ "CWE-305" ], "description": "An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations." }, { "id": "CVE-2026-60004", "url": "https://spydr.io/cve/CVE-2026-60004", "published": "2026-08-26T20:17:56.010Z", "modified": "2026-08-27T11:41:19.230Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "mitre.org", "epss": 0.23988, "epss_percentile": 0.97779, "exploited": true, "kev": { "added": "2026-08-25", "due": "2026-08-28", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Gitea" ], "products": [ "Gitea" ], "cwes": [ "CWE-94" ], "description": "Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation." }, { "id": "CVE-2026-72530", "url": "https://spydr.io/cve/CVE-2026-72530", "published": "2026-08-19T17:21:01.130Z", "modified": "2026-08-21T04:18:15.903Z", "score": 9.5, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "kaspersky.com", "epss": 0.01686, "epss_percentile": 0.76229, "exploited": true, "kev": { "added": "2026-08-20", "due": "2026-09-03", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "TrueConf" ], "products": [ "TrueConf Server" ], "cwes": [ "CWE-94" ], "description": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system." }, { "id": "CVE-2026-72529", "url": "https://spydr.io/cve/CVE-2026-72529", "published": "2026-08-19T17:21:00.990Z", "modified": "2026-08-21T04:18:15.753Z", "score": 9.3, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "kaspersky.com", "epss": 0.01464, "epss_percentile": 0.72754, "exploited": true, "kev": { "added": "2026-08-20", "due": "2026-08-23", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "TrueConf" ], "products": [ "TrueConf Server" ], "cwes": [ "CWE-306" ], "description": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function." }, { "id": "CVE-2026-19490", "url": "https://spydr.io/cve/CVE-2026-19490", "published": "2026-08-19T13:17:45.000Z", "modified": "2026-09-10T12:48:10.453Z", "score": 9.3, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "CNA", "epss": 0.23158, "epss_percentile": 0.97709, "exploited": true, "kev": { "added": "2026-09-09", "due": "2026-09-12", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "NetScaler" ], "products": [ "NetScaler ADC", "NetScaler Gateway" ], "cwes": [ "CWE-288" ], "description": "Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21." }, { "id": "CVE-2026-64849", "url": "https://spydr.io/cve/CVE-2026-64849", "published": "2026-08-17T22:17:23.580Z", "modified": "2026-10-05T13:35:35.850Z", "score": 9.3, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "score_source": "github.com", "epss": 0.09839, "epss_percentile": 0.95429, "exploited": true, "kev": { "added": "2026-08-19", "due": "2026-09-02", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "mlflow" ], "products": [ "mlflow" ], "cwes": [ "CWE-918" ], "description": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0." }, { "id": "CVE-2026-73570", "url": "https://spydr.io/cve/CVE-2026-73570", "published": "2026-08-13T16:19:06.003Z", "modified": "2026-08-24T13:19:17.577Z", "score": 8.9, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L", "score_source": "mitre.org", "epss": 0.11946, "epss_percentile": 0.96006, "exploited": true, "kev": { "added": "2026-08-21", "due": "2026-08-24", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Zimbra" ], "products": [ "Zimbra Collaboration" ], "cwes": [ "CWE-78" ], "description": "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user." }, { "id": "CVE-2026-42018", "url": "https://spydr.io/cve/CVE-2026-42018", "published": "2026-08-12T18:17:29.473Z", "modified": "2026-10-01T19:17:20.413Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "jfrog.com", "epss": 0.09805, "epss_percentile": 0.95417, "exploited": true, "kev": { "added": "2026-09-11", "due": "2026-09-25", "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "jfrog" ], "products": [ "jfrog artifactory" ], "cwes": [ "CWE-287" ], "description": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources." } ], "attribution": [ { "source": "NVD", "url": "https://nvd.nist.gov", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "notice": "Known exploited vulnerabilities from the CISA KEV catalog." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss", "notice": "Exploit prediction scores from FIRST EPSS." } ] }