| CVE-2026-102764 Known exploited | Critical 9.3 | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support Assigned by BT | Oct 15, 2026 |
| CVE-2026-0322 Known exploited | High 8.6 | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface Assigned by palo_alto | Oct 14, 2026 |
| CVE-2026-76519 Known exploited | Critical 9.8 | Cisco Secure Email Gateway Arbitrary File Write Vulnerability Assigned by cisco | Oct 14, 2026 |
| CVE-2026-96951 Known exploited | High 8.8 | Windows Shell Security Feature Bypass Vulnerability Assigned by microsoft | Oct 13, 2026 |
| CVE-2026-104935 Known exploited | High 8.6 | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. Assigned by ivanti | Oct 13, 2026 |
| CVE-2026-105134 Known exploited | Critical 10.0 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection Assigned by VulDB | Oct 4, 2026 |
| CVE-2026-105133 Known exploited | High 7.3 | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication Assigned by VulDB | Oct 4, 2026 |
| CVE-2026-88779 Known exploited | High 8.7 | Memory overflow vulnerability leading to Denial of Service Assigned by NetScaler | Oct 4, 2026 |
| CVE-2026-104286 Known exploited | Critical 9.8 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8… Assigned by fortinet | Oct 1, 2026 |
| CVE-2026-102490 Known exploited | High 8.5 | Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package Assigned by DIVD | Sep 30, 2026 |
| CVE-2026-102489 Known exploited | High 8.7 | Undisclosed RCE in Zammad v6.3 and higher Assigned by DIVD | Sep 30, 2026 |
| CVE-2026-76504 Known exploited | Critical 9.8 | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability Assigned by cisco | Sep 30, 2026 |
| CVE-2026-86950 Known exploited | High 8.8 | An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple | Sep 28, 2026 |
| CVE-2026-88772 Known exploited | Critical 9.5 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Assigned by NetScaler | Sep 27, 2026 |
| CVE-2026-88771 Known exploited | Critical 9.5 | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands Assigned by NetScaler | Sep 27, 2026 |
| CVE-2026-87902 Known exploited | High 8.1 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. Assigned by hackerone | Sep 22, 2026 |
| CVE-2026-94127 Known exploited | Critical 9.8 | BIG-IP APM OAuth vulnerability Assigned by f5 | Sep 22, 2026 |
| CVE-2026-93616 Known exploited | Critical 9.8 | Directory Traversal and File upload allows execution of arbitrary script on the Management Server Assigned by checkpoint | Sep 22, 2026 |
| CVE-2026-93952 Known exploited | Critical 10.0 | Security Advisory 0183 Assigned by Arista | Sep 22, 2026 |
| CVE-2026-87886 Known exploited | High 7.8 | Local privilege escalation due to insecure file permissions. Assigned by Acronis | Sep 17, 2026 |
| CVE-2026-76460 Known exploited | Critical 10.0 | Cisco Identity Services Engine Authentication Bypass Vulnerability Assigned by cisco | Sep 16, 2026 |
| CVE-2026-58704 Known exploited | High 8.8 | In Cellular Modem, there is a possible permission bypass due to a logic error in the code. Assigned by Google_Devices | Sep 15, 2026 |
| CVE-2026-76461 Known exploited | Critical 9.8 | Cisco Secure Email Gateway SQL Injection Vulnerability Assigned by cisco | Sep 14, 2026 |
| CVE-2026-85706 Known exploited | Critical 10.0 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab Assigned by GitLab | Sep 12, 2026 |
| CVE-2026-85102 Known exploited | Critical 9.8 | Improper Certificate Validation in Quantum Security Gateway Assigned by checkpoint | Sep 9, 2026 |
| CVE-2026-87491 Known exploited | High 8.8 | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Assigned by Chrome | Sep 9, 2026 |
| CVE-2026-84869 Known exploited | Critical 9.9 | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions Assigned by ConnectWise | Sep 8, 2026 |
| CVE-2026-81963 Known exploited | High 7.8 | Windows Update Stack Elevation of Privilege Vulnerability Assigned by microsoft | Sep 8, 2026 |
| CVE-2026-85880 Known exploited | High 7.8 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability Assigned by microsoft | Sep 8, 2026 |
| CVE-2026-75650 Known exploited | Critical 10.0 | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) Assigned by adobe | Sep 7, 2026 |
| CVE-2026-86218 Known exploited | Critical 10.0 | pre-authentication remote code execution Assigned by N-able | Sep 6, 2026 |
| CVE-2026-86060 Known exploited | Critical 9.2 | SSH session privilege manipulation via a crafted username in Mikrotik RouterOS Assigned by CERT-PL | Sep 5, 2026 |
| CVE-2026-67279 Known exploited | Medium 6.9 | SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS Assigned by CERT-PL | Sep 5, 2026 |
| CVE-2026-67277 Known exploited | High 8.8 | Kernel memory disclosure and denial of service in MikroTik RouterOS btest service Assigned by CERT-PL | Sep 5, 2026 |
| CVE-2026-85046 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Assigned by Chrome | Sep 3, 2026 |
| CVE-2026-83549 Known exploited | High 7.8 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) whic… Assigned by sonicwall | Sep 1, 2026 |
| CVE-2026-83548 Known exploited | Critical 10.0 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. Assigned by sonicwall | Sep 1, 2026 |
| CVE-2026-82329 Known exploited | Critical 9.8 | Potential authentication bypass leading to administrative access in Artifactory Assigned by JFROG | Aug 28, 2026 |
| CVE-2026-82078 Known exploited | Critical 9.4 | PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector Assigned by PaperCut | Aug 28, 2026 |
| CVE-2026-81578 Known exploited | High 8.8 | PaperCut MF/NG: Authentication Bypass Assigned by PaperCut | Aug 28, 2026 |
| CVE-2026-60004 Known exploited | Critical 9.8 | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. Assigned by mitre | Aug 26, 2026 |
| CVE-2026-72530 Known exploited | Critical 9.0 | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script t… Assigned by Kaspersky | Aug 19, 2026 |
| CVE-2026-72529 Known exploited | Critical 9.8 | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by c… Assigned by Kaspersky | Aug 19, 2026 |
| CVE-2026-19490 Known exploited | Critical 9.3 | NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 Assigned by NetScaler | Aug 19, 2026 |
| CVE-2026-64849 Known exploited | Critical 9.3 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) Assigned by GitHub_M | Aug 17, 2026 |
| CVE-2026-73570 Known exploited | High 8.9 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Assigned by mitre | Aug 13, 2026 |
| CVE-2026-42018 Known exploited | High 7.5 | Anonymous user token generation exposure in JFrog Artifactory Assigned by JFROG | Aug 12, 2026 |
| CVE-2026-66384 Known exploited | Medium 5.3 | Authenticated users may write data outside the intended Docker cache path Assigned by JFROG | Aug 12, 2026 |
| CVE-2026-71362 Known exploited | Critical 9.1 | Adobe Commerce | Incorrect Authorization (CWE-863) Assigned by adobe | Aug 11, 2026 |
| CVE-2026-20349 Known exploited | High 8.6 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability Assigned by cisco | Aug 11, 2026 |
