Tia N. List — KEV catalog

CVE-2026-96951: Microsoft Windows Command Injection Vulnerability

Tue, 13 Oct 2026 19:53:27 +0000

Microsoft / Windows · CVE-2026-96951 is a command-injection security feature bypass (CWE-77, CVSS 3.1 base 8.8) in Microsoft Windows Shell that lets a remote attacker evade Mark of the Web (MOTW) defenses. An attacker lures a victim into opening a specially crafted file via email or instant message; n · 3-day: yes

CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Tue, 13 Oct 2026 15:49:49 +0000

Ivanti / Connect Secure · CVE-2026-104935 is an authentication bypass by spoofing chained with remote code execution in Ivanti Connect Secure, allowing a remote unauthenticated attacker to run arbitrary commands as root (CVSS 8.6, CWE-290). Volexity caught it in the wild as a zero-day chain against fully · 3-day: yes

CVE-2015-3306: ProFTPD Improper Access Control Vulnerability

Thu, 08 Oct 2026 21:06:14 +0000

ProFTPD / ProFTPD · ProFTPD 1.3.5's mod_copy module accepts SITE CPFR/SITE CPTO from unauthenticated FTP clients, giving pre-authentication arbitrary file read and write on the server as the proftpd daemon user. Public exploits turn this into remote code execution by copying /proc/self/cmdline — who · PoC: yes · 3-day: yes

CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability

Thu, 08 Oct 2026 20:03:07 +0000

ONLYOFFICE / Docs · CVE-2021-3199 is a CWE-22 path traversal in the ONLYOFFICE Document Server image-upload handler (uploadImageFile in DocService/sources/fileuploaderservice.js) that lets an attacker who can sign session JWTs overwrite arbitrary files via an ENCRYPTED;-prefixed traversal in the upl · PoC: yes · 3-day: yes

CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability

Thu, 08 Oct 2026 20:03:07 +0000

Strapi / Strapi · Strapi before 4.8.0 (>=3.2.1) leaks private user fields — password hashes and password reset tokens — because the REST API's `filters` query parameter was applied to private columns before they were redacted from responses, letting an attacker infer values from response changes. · PoC: yes · 3-day: yes

CVE-2016-3081: Apache Struts Command Injection Vulnerability

Thu, 08 Oct 2026 21:06:14 +0000

Apache / Struts · Apache Struts 2 S2-032: unauthenticated remote code execution via OGNL passed in the method: parameter prefix when Dynamic Method Invocation is enabled in struts2-core's ActionMapper. NVD lists 2.3.19-2.3.20.2, 2.3.21-2.3.24.1 and 2.3.25-2.3.28 as affected; the advisory fixes 2.3 · PoC: yes · 3-day: yes

CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

Thu, 08 Oct 2026 20:03:07 +0000

ISC / BIND · ISC BIND's TKEY query handler (dns_tkey_processquery in lib/dns/tkey.c) fails to reset a name pointer between additional- and answer-section lookups, so a single crafted DNS query with QTYPE TKEY plus a same-named non-TKEY record in the additional section triggers a REQUIRE asser · PoC: yes · 3-day: yes

CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerabili

Mon, 05 Oct 2026 00:40:47 +0000

Citrix / NetScaler · Citrix NetScaler ADC and Gateway carry a memory buffer overflow (CWE-119, CVSS 4.0 8.7) in the SAML authentication subsystem, fixed in 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282. An appliance is exposed only when configured as a SAML SP or SAML IdP; crafted SAML requ · 3-day: yes

CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

Fri, 02 Oct 2026 17:00:33 +0000

Zammad GmbH / Zammad · Session fixation in Zammad's web session handling lets an unauthenticated network attacker hijack sessions and gain remote code execution as the zammad OS user (exploitable in Zammad 6.3.0–6.5.4; present but not exploitable in 7.0.0–7.1.3 due to environment conditions). DIVD disc · 3-day: yes

CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Fri, 02 Oct 2026 17:00:33 +0000

Zammad GmbH / Zammad · Improper privilege management (CWE-269) lets the local `zammad` service account escalate to root on Zammad hosts; DIVD lists affected versions 1.5.0 through 7.1.0-alpha (NVD: all versions including the latest alpha) and scores it 8.5 standalone (AV:L) and 9.4 when chained with CV · 3-day: yes

CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

Thu, 01 Oct 2026 20:27:42 +0000

Fortinet / FortiMail · Fortinet FortiMail is affected by a path traversal (CWE-22) combined with improper NULL-byte neutralization (CWE-158) that lets an unauthenticated attacker write arbitrary files via crafted HTTP/HTTPS requests (CVSS 9.8). Fortinet reports in-the-wild exploitation and published fi · 3-day: yes

CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Wed, 30 Sep 2026 22:47:46 +0000

Cisco / Catalyst SD-WAN Manager · Cisco Catalyst SD-WAN Manager fails to normalize hex-encoded characters in the API session login URI, letting an unauthenticated remote attacker bypass the authentication rule on j_security_check and use the API as admin (CVSS 9.8, CWE-177). Cisco PSIRT reports active exploitatio · 3-day: yes

CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability

Tue, 29 Sep 2026 14:38:30 +0000

Apple / Multiple Products · Out-of-bounds write (CWE-787) in Apple's CoreGraphics framework that may lead to arbitrary code execution when a maliciously crafted file is processed, reported by Meta Product Security. Apple released fixes on September 28, 2026 in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, and macO · 3-day: yes

CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability

Sun, 27 Sep 2026 22:20:21 +0000

Citrix / NetScaler · CVE-2026-88771 is a critical (CVSS v4 9.5) improper input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated attacker execute arbitrary commands. Citrix states all ADC and Gateway deployments are affected — 14.1 before 14.1-73.37, 13.1 befo · 3-day: yes

CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerabili

Sun, 27 Sep 2026 22:20:21 +0000

Citrix / NetScaler · Citrix NetScaler ADC and NetScaler Gateway are affected by a memory overflow (CWE-119, CVSS v4.0 9.5) in DTLS handling that an unauthenticated remote attacker can turn into code execution or a denial of service. The flaw only requires DTLS to be enabled, which is the default on G · PoC: yes · 3-day: yes

CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability

Fri, 25 Sep 2026 20:21:58 +0000

WordPress / Core · WordPress Core's get_page_template() page-template resolution in wp-includes/template.php urldecodes the pagename query variable after sanitization without re-running validate_file(), so an unauthenticated attacker can double-encode a ../ traversal and include an arbitrary readab · PoC: yes · 3-day: yes

CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability

Fri, 25 Sep 2026 15:33:33 +0000

Microsoft / SharePoint · Microsoft SharePoint Server 2016, 2019, and Subscription Edition contain a code injection vulnerability (CVSS 8.8, CWE-94) in ToolPane.GetPartPreviewAndPropertiesFromMarkup, where quote injection through Microsoft.Web.Design.RegisterDirective.GetHtml lets an attacker smuggle a se · 3-day: yes

CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

Fri, 25 Sep 2026 15:33:33 +0000

MikroTik / RouterOS · MikroTik RouterOS contains an improper enforcement of behavioral workflow flaw (CWE-841) in its SSH server: a key re-exchange requested before user authentication completes makes the server enter the connection protocol anyway, letting an unauthenticated client open a session cha · PoC: yes · 3-day: yes

CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability

Thu, 24 Sep 2026 19:40:29 +0000

Adobe / Commerce and Magento · Adobe Commerce and Magento Open Source (APSB26-92) contain an incorrect authorization flaw (CWE-863, CVSS 9.1) in the Customer Account Edit controller: a failed editPost stashes attacker-controlled customer_form_data in the session, and the subsequent GET /customer/account/edit m · PoC: yes · 3-day: yes

CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability

Thu, 24 Sep 2026 19:40:29 +0000

WSO2 / Multiple Products · WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway accept JWTs signed with algorithms outside the configured set in the carbon-apimgt JWT validation path, letting unauthenticated attackers forge administrator tokens for full account takeover (CWE-347, CVSS · PoC: yes · 3-day: yes

CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability

Tue, 22 Sep 2026 20:15:06 +0000

Check Point / Quantum Security Gateway · CVE-2026-85102 is a critical (CVSS 9.8) improper certificate validation vulnerability in Check Point Quantum Security Gateway and Spark Firewall VPN products. The flaw in the IKE daemon certificate trust validation allows an unauthenticated remote attacker to execute arbitrary co · 3-day: yes

CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability

Tue, 22 Sep 2026 20:15:06 +0000

Check Point / Multiple Products · CVE-2026-93616 is a critical pre-authentication path traversal and file upload vulnerability in the Check Point Management web service (TCP port 19009) affecting Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEve · 3-day: yes

CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

Tue, 22 Sep 2026 20:15:06 +0000

F5 / BIG-IP APM · CVE-2026-94127 is a critical heap-based buffer overflow (CWE-122, CVSS 9.8) in F5 BIG-IP APM OAuth profile processing within the TMM data plane. When a virtual server has both an APM access policy and an OAuth profile, specially crafted unauthenticated traffic corrupts heap memor · 3-day: yes

CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

Tue, 22 Sep 2026 20:15:06 +0000

Arista / VeloCloud Orchestrator · Arista VeloCloud Orchestrator (VCO) on-prem versions 5.2.3.15 and below, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below contain an improper input validation flaw (CWE-20) in the Nginx front-end request routing that enables unauthenticated remote attackers to bypass a · 3-day: yes

CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

Mon, 21 Sep 2026 19:16:29 +0000

Zyxel / GS1900 Series Switches · A stack-based buffer overflow in the CGI program of Zyxel GS1900 series switches allows a LAN-based unauthenticated attacker to execute OS commands via a crafted HTTP request. All 10 GS1900 models are affected at firmware through version 2.90 patch 1 (ABTQ.1)C0. Patched firmware · 3-day: yes

CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

Fri, 18 Sep 2026 20:49:40 +0000

Linux / Kernel · A use-after-free vulnerability in the Linux kernel's software TLS receive path (net/tls/tls_sw.c) allows a zero-length record retrieved from the rx_list to bypass recvmsg() record-type handling, causing subsequent TLS records to be processed with incorrect zero-copy assumptions a · PoC: yes · 3-day: yes

CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability

Fri, 18 Sep 2026 15:16:14 +0000

Linux / Kernel · CVE-2026-53266 is a Linux kernel memory corruption vulnerability in the netfilter bridge ebtables SNAT target (ebt_snat). The optional ARP sender hardware address rewrite calls skb_store_bits() without first ensuring the target range is writable; when the ARP SHA range resides in · 3-day: yes

CVE-2025-39964: Linux Kernel Race Condition Vulnerability

Fri, 18 Sep 2026 15:16:14 +0000

Linux / Kernel · A race condition in the Linux kernel's AF_ALG crypto user API allows concurrent writes to the same socket via af_alg_sendmsg, causing interleaved data and inconsistent internal socket state. A local attacker could crash the system or corrupt cryptographic operation results. The f · 3-day: yes

CVE-2026-87886: Acronis Backup Incorrect Default Permissions Vulnerability

Wed, 16 Sep 2026 19:53:57 +0000

Acronis / Backup · CVE-2026-87886 is an incorrect default permissions vulnerability (CWE-276) in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk on Linux. Insecure permissions on the integration files allow a local user to escalate privileges to root. Acronis a · 3-day: yes

CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Wed, 16 Sep 2026 19:24:18 +0000

Cisco / Identity Services Engine · A critical authentication bypass vulnerability in Cisco ISE REST API endpoints (CVSS 10.0, CWE-648) allows unauthenticated remote attackers to bypass the web management interface and gain root access. Cisco confirms active exploitation in the wild; the flaw was discovered via a T · 3-day: yes

CVE-2026-58704: Google Pixel Improper Authorization Vulnerability

Wed, 16 Sep 2026 14:14:38 +0000

Google / Pixel · CVE-2026-58704 is an elevation-of-privilege vulnerability in the Pixel Cellular Modem caused by a logic error that bypasses permission checks. A nearby attacker with adjacent-network access can escalate privileges without user interaction. Google's September 2026 Pixel bulletin n · 3-day: yes

CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability

Mon, 14 Sep 2026 20:10:07 +0000

Cisco / Secure Email Gateway · Cisco Secure Email Gateway contains a SQL injection vulnerability in the AsyncOS email parsing logic that allows an unauthenticated remote attacker to execute arbitrary commands with root privileges via crafted email messages. Cisco PSIRT confirmed active exploitation in Septembe · 3-day: yes

CVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

Fri, 11 Sep 2026 22:25:18 +0000

GitLab / Community Edition and Enterprise Edition · Critical unauthenticated arbitrary file read in GitLab CE/EE via path traversal in the repository commits and files API endpoints. A Workhorse route-regex bypass using percent-encoded URL path segments allows unauthenticated requests to reach Rails handlers that read attacker-sup · PoC: yes · 3-day: yes

CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability

Sat, 12 Sep 2026 00:00:00 +0000

JFrog / Artifactory · JFrog Artifactory exposes an internal anonymous-user JWT via its AWS token endpoint to unauthenticated callers even when anonymous access is disabled. Attackers chain this token leak with CVE-2026-42016 to escalate to admin scope, then create persistent accounts, deploy malicious · 3-day: yes

CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability

Fri, 11 Sep 2026 19:42:00 +0000

JFrog / Artifactory · CVE-2026-42016 is a CWE-863 Incorrect Authorization vulnerability in JFrog Artifactory Self-Hosted versions before 7.133.11. The token validation logic verifies the signature and issuer but fails to enforce scope restrictions, enabling a low-privileged authenticated user to escal · 3-day: yes

CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

Fri, 11 Sep 2026 19:26:31 +0000

ConnectWise / ScreenConnect · ConnectWise ScreenConnect versions prior to 26.6.5 contain a missing authorization vulnerability in client-side file-transfer handling that allows files to be transferred and executed through active remote sessions without Host confirmation. Active exploitation with worm-like pro · 3-day: yes

CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

Thu, 10 Sep 2026 19:09:36 +0000

MikroTik / RouterOS · MikroTik RouterOS contains a missing authentication vulnerability in the bandwidth-test (btest) service that allows unauthenticated clients to start an IPv4 UDP test before the primary session completes authentication, leaking uninitialized kernel buffer data or crashing the kern · 3-day: yes

CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

Thu, 10 Sep 2026 19:14:09 +0000

MikroTik / RouterOS · MikroTik RouterOS contains an argument injection flaw in the SSH login helper where crafted usernames (starting with a prohibited character like "-2") manipulate the policy mask to grant full admin privileges. It is actively exploited as part of the "MikroTrick" chain (CVE-2026-6 · PoC: yes · 3-day: yes

CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerabil

Wed, 09 Sep 2026 21:10:00 +0000

Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management · Critical authentication bypass (CVSS 10.0) in the Cisco Secure Firewall Management Center web interface due to an improper boot-time system process, allowing unauthenticated remote root access via crafted HTTP requests to /help/about.cgi. Actively exploited by state-sponsored and · PoC: yes · 3-day: yes

CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability

Wed, 09 Sep 2026 20:18:20 +0000

Google / Chromium V8 · CVE-2026-87491 is an out-of-bounds write in the V8 JavaScript engine of Google Chrome, patched in version 153.0.8010.36. The vulnerability is actively exploited in the wild as a zero-day, allowing remote code execution inside the sandbox via crafted HTML pages. No public proof-of · 3-day: yes

CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Wed, 09 Sep 2026 20:30:00 +0000

Fortinet / Multiple Products · CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon (CAPWAP protocol handler) of FortiOS and FortiSwitchManager, allowing unauthenticated remote code execution via crafted UDP packets to port 5246. Actively exploited in the wild since at least mid-2026 by a Russia · 3-day: yes

CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Wed, 09 Sep 2026 20:10:17 +0000

Citrix / NetScaler · Citrix NetScaler ADC and Gateway suffer a critical (CVSS 9.3) authentication bypass via an alternate path in the SAML/Gateway authentication flow. The vulnerability allows unauthenticated remote attackers to bypass login on appliances configured as Gateway or AAA virtual servers. · 3-day: yes

CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Tue, 08 Sep 2026 19:41:33 +0000

Microsoft / Windows · CVE-2026-85880 is a high-severity (CVSS 7.8) elevation of privilege vulnerability in the Windows Advanced Local Procedure Call (ALPC) subsystem affecting Windows 10 (1607+) and Windows 11. The flaw is a heap-based buffer overflow (CWE-122) combined with use of an uninitialized re · 3-day: yes

CVE-2026-86218: N-able N-central Static Code Injection Vulnerability

Tue, 08 Sep 2026 19:41:33 +0000

N-able / N-central · CVE-2026-86218 is a critical pre-authentication remote code execution vulnerability (CVSS 10.0) in N-able N-central, affecting all versions prior to 2026.3.1.14. The flaw is a static code injection vulnerability (CWE-96) that allows an unauthenticated remote attacker to execute a · 3-day: yes

CVE-2026-81963: Microsoft Windows Link Following Vulnerability

Tue, 08 Sep 2026 19:41:33 +0000

Microsoft / Windows · CVE-2026-81963 is a high-severity (CVSS 7.8) elevation of privilege vulnerability in the Windows Update Stack affecting Windows 11 23H2, 24H2, 25H2, 26H1, and Windows Server 2025. The flaw is a link following (CWE-59) issue where the Update Stack improperly resolves symbolic link · 3-day: yes

CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vul

Tue, 08 Sep 2026 19:41:33 +0000

Adobe / Commerce and Magento · CVE-2026-75650 (StyleSmuggler) is a critical CVSS 10.0 unauthenticated remote code execution vulnerability in Adobe Commerce 2.4.4–2.4.9, Adobe Commerce B2B 1.3.3–1.5.3, and Magento Open Source 2.4.6–2.4.9. The flaw exists in how Magento's template engine processes style-related · 3-day: yes

CVE-2026-85046: Google Chromium V8 Type Confusion Vulnerability

Fri, 04 Sep 2026 18:30:00 +0000

Google / Chromium V8 · A type confusion vulnerability in V8 Maglev and TurboFan JIT compilers allows remote code execution inside the Chrome renderer sandbox via crafted HTML. The flaw in TryReduceArrayPrototypeSort permits a comparator callback to switch the receiver map via Array fill, corrupting ele · 3-day: yes

CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability