SOC Cyber Wall v13 — Veille CVE

[P0] CVE-2015-5477 — ISC BIND Data Processing Errors Vulnerability [KEV | RANSOMWARE:Hive | ITW]

Wed, 07 Oct 2026 22:00:00 +0000

CVSS=7.5 EPSS=0.994 Score=269.3 | named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

[P0] CVE-2015-3306 — ProFTPD Improper Access Control Vulnerability [KEV | ITW]

Wed, 07 Oct 2026 22:00:00 +0000

CVSS=10.0 EPSS=0.995 Score=257.4 | The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

[P0] CVE-2016-3081 — Apache Struts Command Injection Vulnerability [KEV | ITW]

Wed, 07 Oct 2026 22:00:00 +0000

CVSS=8.1 EPSS=0.961 Score=238.9 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

[P0] CVE-2026-71362 — Adobe Commerce and Magento Incorrect Authorization Vulnerability [KEV | ITW]

Wed, 23 Sep 2026 22:00:00 +0000

CVSS=9.1 EPSS=0.875 Score=229.6 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

[P0] CVE-2026-104286 — Fortinet FortiMail Path Traversal Vulnerability [KEV | ITW]

Wed, 30 Sep 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.022 Score=184.4 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the

[P0] CVE-2026-88771 — Citrix NetScaler Improper Input Validation Vulnerability [KEV | ITW]

Sat, 26 Sep 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.011 Score=183.1 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated a

[P0] CVE-2026-76504 — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability [KEV | ITW]

Tue, 29 Sep 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.018 Score=179.0 | A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, wh

[P0] CVE-2026-102489 — Zammad GmbH Zammad Session Fixation Vulnerability [KEV | ITW]

Thu, 01 Oct 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.013 Score=178.3 | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

[P0] CVE-2026-86950 — Apple Multiple Products Out-of-Bounds Write Vulnerability [KEV | ITW]

Mon, 28 Sep 2026 22:00:00 +0000

CVSS=8.8 EPSS=0.012 Score=177.3 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have bee

[P0] CVE-2026-102490 — Zammad GmbH Zammad Improper Privilege Management Vulnerability [KEV | ITW]

Thu, 01 Oct 2026 22:00:00 +0000

CVSS=7.8 EPSS=0.005 Score=175.5 | Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned

[P0] CVE-2026-107406 — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway [ITW]

Sat, 10 Oct 2026 02:18:09 +0000

CVSS=9.5 EPSS=0.005 Score=170.6 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: * For the following versions: Applica

[P0] CVE-2026-88779 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability [KEV | ITW]

Sat, 03 Oct 2026 22:00:00 +0000

CVSS=7.5 EPSS=0.006 Score=168.7 | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

[P0] CVE-2026-76461 — Cisco Secure Email Gateway SQL Injection Vulnerability [KEV | ITW]

Sun, 13 Sep 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.283 Score=167.7 | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email pa

[P0] CVE-2025-39682 — Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability [KEV | RANSOMWARE:Conti | ITW]

Thu, 17 Sep 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.029 Score=167.3 | In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has alrea

[P0] CVE-2026-87902 — WordPress Core Remote File Inclusion Vulnerability [KEV | ITW]

Thu, 24 Sep 2026 22:00:00 +0000

CVSS=8.1 EPSS=0.400 Score=166.6 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

[P0] CVE-2026-93616 — Check Point Multiple Products Path Traversal Vulnerability [KEV | ITW]

Mon, 21 Sep 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.197 Score=157.4 | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

[P0] CVE-2026-105133 — OTX Pulse : Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer [ITW]

Tue, 06 Oct 2026 13:04:52 +0000

CVSS=7.3 EPSS=0.004 Score=157.3 | Beginning October 7, 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to achieve unauthenticated remote code execution on exposed systems. The attackers chained these vulnerabilities together, first bypassing authentication a

[P0] CVE-2021-3199 — ONLYOFFICE Docs Server Path Traversal Vulnerability [KEV | ITW]

Wed, 07 Oct 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.194 Score=157.0 | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

[P0] CVE-2026-76460 — Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability [KEV | ITW]

Tue, 15 Sep 2026 22:00:00 +0000

CVSS=10.0 EPSS=0.140 Score=146.8 | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted reques

[P0] CVE-2026-105134 — OTX Pulse : Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer [ITW]

Tue, 06 Oct 2026 13:04:52 +0000

CVSS=10.0 EPSS=0.018 Score=140.2 | Beginning October 7, 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to achieve unauthenticated remote code execution on exposed systems. The attackers chained these vulnerabilities together, first bypassing authentication a

[P0] CVE-2026-85102 — Check Point Multiple Products Improper Certificate Validation Vulnerability [KEV | ITW]

Mon, 21 Sep 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.075 Score=137.9 | Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

[P0] CVE-2026-93952 — Arista VeloCloud Orchestrator Improper Input Validation Vulnerability [KEV | ITW]

Mon, 21 Sep 2026 22:00:00 +0000

CVSS=10.0 EPSS=0.011 Score=136.3 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by

[P0] CVE-2026-94127 — F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability [KEV | ITW]

Mon, 21 Sep 2026 22:00:00 +0000

CVSS=9.8 EPSS=0.022 Score=131.5 | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth C

[P0] CVE-2026-5430 — WSO2 Multiple Products Path Traversal Vulnerability [KEV | ITW]

Wed, 23 Sep 2026 22:00:00 +0000

CVSS=10.0 EPSS=0.006 Score=130.7 | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vuln

[P0] CVE-2026-65660 — Microsoft SharePoint Code Injection Vulnerability [KEV | ITW]

Thu, 24 Sep 2026 22:00:00 +0000

CVSS=8.8 EPSS=0.021 Score=130.3 | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

[P0] CVE-2026-7273 — Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability [KEV | ITW]

Sun, 20 Sep 2026 22:00:00 +0000

CVSS=8.8 EPSS=0.025 Score=125.8 | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

[P0] CVE-2026-88772 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability [KEV | ITW]

Sat, 26 Sep 2026 22:00:00 +0000

CVSS=8.1 EPSS=0.013 Score=125.2 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

[P0] CVE-2026-53266 — Linux Kernel Out-of-Bounds Write Vulnerability [KEV | ITW]

Thu, 17 Sep 2026 22:00:00 +0000

CVSS=8.8 EPSS=0.008 Score=123.8 | It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114) Several s

[P0] CVE-2026-58704 — Google Pixel Improper Authorization Vulnerability [KEV | ITW]

Tue, 15 Sep 2026 22:00:00 +0000

CVSS=8.8 EPSS=0.006 Score=123.5 | In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

[P0] CVE-2025-39964 — Linux Kernel Race Condition Vulnerability [KEV | ITW]

Thu, 17 Sep 2026 22:00:00 +0000

CVSS=7.8 EPSS=0.013 Score=118.3 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsiste

[P0] CVE-2023-22894 — Strapi Cleartext Storage of Sensitive Information Vulnerability [KEV | ITW]

Wed, 07 Oct 2026 22:00:00 +0000

CVSS=7.2 EPSS=0.036 Score=117.5 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then thi

[P0] CVE-2026-87886 — Acronis Backup Incorrect Default Permissions Vulnerability [KEV | ITW]

Tue, 15 Sep 2026 22:00:00 +0000

CVSS=7.8 EPSS=0.002 Score=117.1 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2

[P0] CVE-2026-84409 — Lantronix G520 Series Cellular Gateway [RANSOMWARE:Play | ITW]

Wed, 30 Sep 2026 14:46:43 +0000

CVSS=7.5 EPSS=0.004 Score=110.5 | The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update info

[P1] CVE-2026-67279 — Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability [KEV | ITW]

Thu, 24 Sep 2026 22:00:00 +0000

CVSS=6.5 EPSS=0.010 Score=110.2 | RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creati

[P0] CVE-2026-107810 — Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applie [RANSOMWARE:Hive | ITW]

Fri, 09 Oct 2026 17:07:06 +0000

CVSS=8.1 EPSS=0.004 Score=109.0 | ### Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both `restore_nginx` and `restore_nginx_ui` are set to `false`. ### Deta

[P0] CVE-2026-107716 — Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry [RANSOMWARE:Hive | ITW]

Thu, 08 Oct 2026 22:10:07 +0000

CVSS=7.3 EPSS=0.001 Score=109.0 | ### Summary In `banks.registries.DirectoryPromptRegistry`, prompt file paths and the index file (`index.json`) do not refuse symbolic links. When a prompt directory contains or accepts untrusted files (e.g. unpacked archives, shared repositories, or multi-tenant folders), symbolic links pointing out

[P2] GHSA-p4h8-xg7f-xqrc — Duplicate Advisory: Vikunja: Denial of service via decompression bomb in the data import [RANSOMWARE:Hive | ITW]

Fri, 09 Oct 2026 20:52:46 +0000

CVSS=6.5 EPSS=0.000 Score=99.0 | ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w7jp-mf2v-8342. This link is maintained to preserve external references. ### Original Description Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause

[P2] GHSA-jmr8-r558-3jhx — Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth [RANSOMWARE:Conti | ITW]

Fri, 09 Oct 2026 20:51:11 +0000

CVSS=4.3 EPSS=0.000 Score=85.8 | ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-88f6-4rjv-x774. This link is maintained to preserve external references. ### Original Description Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/us

[P2] CVE-2026-107726 — Hazelcast allows arbitrary member memory access by low-privileged client

Thu, 08 Oct 2026 22:10:30 +0000

CVSS=9.3 EPSS=0.004 Score=71.3 | ### Impact A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to read arbitrary data in memory from any cluster member (including Java heap memory, off-heap data, and JVM process address space). Additionally, such a clien

[P2] CVE-2026-108261 — TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Fri, 09 Oct 2026 20:56:50 +0000

CVSS=9.3 EPSS=0.002 Score=66.0 | ### Summary The TinaCMS admin builds its preview `` from the `/~/*` hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash (`#/~//attacker.example/p`) becomes the protocol-relative URL `//attacker.example/p`, so the admin frames an external

[P1] CVE-2026-96587 — Viidure Dashcam Android Application

Tue, 29 Sep 2026 20:19:05 +0000

CVSS=10.0 EPSS=0.003 Score=65.4 | The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

[P1] CVE-2026-105697 — Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Fri, 09 Oct 2026 19:57:02 +0000

CVSS=9.9 EPSS=0.004 Score=64.9 | ### Summary Before **Langflow 1.10.3**, the MCP stdio transport launched whatever `command` / `args` a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in `bash -c "exec {command} ..."`. Any user able to reach the MCP server settings ("Settings → MCP Servers →

[P1] CVE-2026-100730 — Grid Protection Alliance openPDC and openHistorian

Fri, 09 Oct 2026 14:41:53 +0000

CVSS=9.8 EPSS=0.006 Score=64.5 | A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated networ

[P1] CVE-2026-15340 — Savannah lwIP SMTP client

Fri, 09 Oct 2026 15:29:33 +0000

CVSS=9.8 EPSS=0.006 Score=64.5 | lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

[P2] CVE-2026-108259 — Tina: Code injection via unescaped Git branch name in generated client source

Fri, 09 Oct 2026 20:56:53 +0000

CVSS=8.2 EPSS=0.003 Score=64.5 | ### Summary `@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client modul

[P1] CVE-2026-105278 — Grid Protection Alliance openPDC and openHistorian

Fri, 09 Oct 2026 14:41:53 +0000

CVSS=9.8 EPSS=0.003 Score=64.2 | The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.

[P1] CVE-2026-103630 — Long Term Support Channel Update for ChromeOS

Tue, 06 Oct 2026 14:22:17 +0000

CVSS=9.6 EPSS=0.003 Score=63.0 | Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

[P2] CVE-2026-107725 — Hazelcast has an authorization bypass in IMap Predicates API

Thu, 08 Oct 2026 22:09:35 +0000

CVSS=8.7 EPSS=0.004 Score=62.7 | ### Impact Missing authorization checks in the [Predicates API](https://docs.hazelcast.com/hazelcast/5.7/query/predicate-overview) may allow a malicious client to execute arbitrary code on a Hazelcast member. ### Patches Enterprise customers should upgrade to a fixed version of Hazelcast Enterpri

[P2] CVE-2026-95102 — Monta monta.app

Tue, 06 Oct 2026 13:15:48 +0000

CVSS=9.4 EPSS=0.003 Score=61.8 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to p

[P2] CVE-2026-107806 — Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Fri, 09 Oct 2026 20:45:03 +0000

CVSS=9.4 EPSS=0.003 Score=61.8 | ## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` i