Tia N. List — KEV candidates https://zarguell.github.io/tia-n-list/ Exploited CVEs Tia's reporting is tracking that CISA has not listed on the KEV catalog yet (the live candidate set). en-us Wed, 14 Oct 2026 03:12:03 +0000 CVE-2026-102255: Critical SonicWall Vulnerability Exploited Days After Disclosure https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-102255/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-102255/ Mon, 12 Oct 2026 00:00:00 +0000 First reported 2026-07-15 CVE-2026-105133: (huntress.com) Exploitation of AhsayCBS Vulnerabilities Leads to Unauthenticated RCE and Cryptominin https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-105133/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-105133/ Thu, 08 Oct 2026 00:00:00 +0000 First reported 2026-10-04 CVE-2026-105134: CVE-2026-105134: Ahsay AhsayCBS critical OS command injection https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-105134/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-105134/ Thu, 08 Oct 2026 00:00:00 +0000 First reported 2026-10-04 CVE-2026-21589: Atlassian Bamboo CVE-2026-21589 critical path traversal (CVSS 9.3) https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-21589/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-21589/ Thu, 08 Oct 2026 00:00:00 +0000 First reported 2026-10-06 CVE-2026-93836: CVE-2026-93836: WooCommerce WPC Product Bundles stored XSS (CVSS 7.2, unauthenticated) https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-93836/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-93836/ Tue, 06 Oct 2026 00:00:00 +0000 First reported 2026-09-28 CVE-2026-94504: Ninja Forms plugin flaw exploited to hack WordPress sites https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-94504/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-94504/ Tue, 06 Oct 2026 00:00:00 +0000 First reported 2026-09-28 CVE-2025-53771: Warlock ransomware breach SharePoint in water, telecom operator attacks https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2025-53771/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2025-53771/ Fri, 02 Oct 2026 00:00:00 +0000 First reported 2026-10-01 CVE-2026-86131: WatchGuard patches critical Fireware OS RCE CVE-2026-86131 https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-86131/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-86131/ Thu, 01 Oct 2026 00:00:00 +0000 First reported 2026-09-30 CVE-2023-20598: Lunex Stealer Uses BYOVD with AMD Radeon Driver CVE-2023-20598 https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2023-20598/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2023-20598/ Sat, 26 Sep 2026 00:00:00 +0000 First reported 2026-09-24 CVE-2026-48842: CVE-2026-48842 Exploited Roundcube Webmail SQL Injection https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-48842/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-48842/ Thu, 24 Sep 2026 00:00:00 +0000 First reported 2026-09-24 CVE-2026-85103: Check Point VPN Gateways and Management Server Flaws Actively Exploited Check Point confirmed active https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-85103/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-85103/ Thu, 24 Sep 2026 00:00:00 +0000 First reported 2026-09-09 CVE-2026-58138: Critical Orkes Conductor Vulnerability Exploited in Attacks https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-58138/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-58138/ Fri, 18 Sep 2026 00:00:00 +0000 First reported 2026-09-18 CVE-2026-89026: Issabel PBX JWT Key Flaw Enables Unauthenticated Remote Code Execution https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-89026/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-89026/ Wed, 16 Sep 2026 00:00:00 +0000 First reported 2026-09-15 CVE-2026-27540: WooCommerce Plugin Bug Lets Remote Attackers Create Admin Accounts and Take Over Sites https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-27540/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-27540/ Tue, 15 Sep 2026 00:00:00 +0000 First reported 2026-09-14 CVE-2026-39364: Mass scanning targets exposed Vite dev servers for cloud secrets via CVE-2026-39364 https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-39364/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-39364/ Mon, 14 Sep 2026 00:00:00 +0000 First reported 2026-09-14 CVE-2026-51990: Hackers exploit Tencent app flaw to deploy GrayRabbit malware https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-51990/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-51990/ Sun, 13 Sep 2026 00:00:00 +0000 First reported 2026-09-11 CVE-2026-85638: CVE-2026-85638: Trape 2.0 authorization bypass with public exploit https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-85638/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-85638/ Wed, 09 Sep 2026 00:00:00 +0000 First reported 2026-09-09 CVE-2026-86206: N-able patches max severity N-central flaw amid ongoing attacks https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-86206/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-86206/ Mon, 07 Sep 2026 00:00:00 +0000 First reported 2026-09-07 CVE-2026-86207: N-able patches max severity N-central flaw amid ongoing attacks https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-86207/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-86207/ Mon, 07 Sep 2026 00:00:00 +0000 First reported 2026-09-07 CVE-2026-67276: Hackers Actively Exploit MikroTik RouterOS MikroTrick Flaws to Take Full Control of Routers https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-67276/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-67276/ Mon, 07 Sep 2026 00:00:00 +0000 First reported 2026-09-03 CVE-2026-6471: 12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code and Take Over Database Servers https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-6471/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-6471/ Sat, 05 Sep 2026 00:00:00 +0000 First reported 2026-09-05 CVE-2026-32475: Critical Elementor Pro flaw exploited to take over WordPress sites https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-32475/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-32475/ Thu, 03 Sep 2026 00:00:00 +0000 First reported 2026-08-20 CVE-2026-35029: Hackers Exploit LiteLLM Admin API Flaw to Turn Read-Only Access Into Full Server Takeover https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-35029/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-35029/ Wed, 02 Sep 2026 00:00:00 +0000 First reported 2026-09-02 CVE-2026-63520: Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-63520/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-63520/ Wed, 26 Aug 2026 00:00:00 +0000 First reported 2026-07-16 · Disclosed 2026-08-11 · CVSS 8.1 HIGH CVE-2026-58231: SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and s https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-58231/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-58231/ Fri, 14 Aug 2026 00:00:00 +0000 First reported 2026-07-15 · Disclosed 2026-08-11 · CVSS 10.0 CRITICAL · Automatable CVE-2026-20200: A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-20200/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-20200/ Thu, 06 Aug 2026 00:00:00 +0000 First reported 2026-08-06 · Disclosed 2026-08-05 · CVSS 8.8 HIGH CVE-2026-20272: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE So https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-20272/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-20272/ Thu, 06 Aug 2026 00:00:00 +0000 First reported 2026-08-06 · Disclosed 2026-08-05 · CVSS 9.8 CRITICAL · Automatable CVE-2026-20303: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-20303/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-20303/ Thu, 06 Aug 2026 00:00:00 +0000 First reported 2026-08-06 · Disclosed 2026-08-05 · CVSS 9.9 CRITICAL CVE-2026-43810: The issue was addressed with improved memory handling. https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-43810/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-43810/ Wed, 29 Jul 2026 00:00:00 +0000 First reported 2026-07-29 · Disclosed 2026-07-27 · CVSS 9.8 CRITICAL · Automatable CVE-2026-16723: A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-16723/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-16723/ Sun, 26 Jul 2026 00:00:00 +0000 First reported 2026-07-26 · Disclosed 2026-07-23 · CVSS 9.0 CRITICAL CVE-2026-6875: ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-6875/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-6875/ Tue, 21 Jul 2026 00:00:00 +0000 First reported 2026-07-21 · Disclosed 2026-07-13 CVE-2026-20896: Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by defaul https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-20896/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-20896/ Wed, 08 Jul 2026 00:00:00 +0000 First reported 2026-07-08 · Disclosed 2026-07-03 · CVSS 9.8 CRITICAL · Automatable CVE-2026-43456: In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in b https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-43456/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-43456/ Sun, 05 Jul 2026 00:00:00 +0000 First reported 2026-07-05 · Disclosed 2026-05-08 · CVSS 7.8 HIGH CVE-2026-8451: Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if N https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-8451/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-8451/ Fri, 03 Jul 2026 00:00:00 +0000 First reported 2026-07-01 · Disclosed 2026-06-30 · CVSS 7.5 HIGH · Automatable CVE-2026-4020: The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all version https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-4020/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-4020/ Sat, 20 Jun 2026 00:00:00 +0000 First reported 2026-06-20 · Disclosed 2026-03-31 · CVSS 7.5 HIGH · Automatable CVE-2026-39813: A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSand https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-39813/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-39813/ Tue, 16 Jun 2026 00:00:00 +0000 First reported 2026-06-16 · Disclosed 2026-04-14 · CVSS 9.8 CRITICAL · Automatable CVE-2026-10523: An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R1 https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-10523/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-10523/ Thu, 11 Jun 2026 00:00:00 +0000 First reported 2026-06-10 · Disclosed 2026-06-09 · CVSS 9.9 CRITICAL CVE-2026-8732: The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-8732/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-8732/ Mon, 01 Jun 2026 00:00:00 +0000 First reported 2026-06-01 · Disclosed 2026-05-29 · CVSS 9.8 CRITICAL · Automatable CVE-2026-41089: Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-41089/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-41089/ Mon, 01 Jun 2026 00:00:00 +0000 First reported 2026-06-01 · Disclosed 2026-05-12 · CVSS 9.8 CRITICAL · Automatable CVE-2026-26980: Ghost is a Node.js content management system. https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-26980/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-26980/ Mon, 25 May 2026 00:00:00 +0000 First reported 2026-05-25 · Disclosed 2026-02-20 · CVSS 9.4 CRITICAL · Automatable CVE-2026-42945: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-42945/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-42945/ Mon, 18 May 2026 00:00:00 +0000 First reported 2026-05-14 · Disclosed 2026-05-13 · CVSS 8.1 HIGH CVE-2026-43284: In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decryp https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-43284/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-43284/ Sat, 09 May 2026 00:00:00 +0000 First reported 2026-04-30 · Disclosed 2026-05-08 · CVSS 8.8 HIGH CVE-2026-43500: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONS https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-43500/ https://zarguell.github.io/tia-n-list/kev/candidates/CVE-2026-43500/ Sat, 09 May 2026 00:00:00 +0000 First reported 2026-05-09 · Disclosed 2026-05-11 · CVSS 7.8 HIGH