Critical · CVSS 10 · CISA KEV
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
Published Mar 4, 2026 · Updated Sep 16, 2026
Critical · CVSS 9.8 · CISA KEV
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Published Aug 6, 2026 · Updated Sep 14, 2026
Critical · CVSS 9.4 · CISA KEV
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
Published Aug 28, 2026 · Updated Sep 13, 2026
High · CVSS 8.8 · CISA KEV
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
Published Aug 28, 2026 · Updated Sep 13, 2026
High · CVSS 8.1 · CISA KEV
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Published Jul 27, 2026 · Updated Sep 12, 2026
Critical · CVSS 9.9 · CISA KEV
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Published Sep 8, 2026 · Updated Sep 12, 2026
Critical · CVSS 9.8 · CISA KEV
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
Published Jul 30, 2026 · Updated Sep 12, 2026
Critical · CVSS 9.2 · CISA KEV
RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Published Sep 5, 2026 · Updated Sep 11, 2026
High · CVSS 8.8 · CISA KEV
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.
This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Published Sep 5, 2026 · Updated Sep 11, 2026
Critical · CVSS 9.8 · CISA KEV
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
Published Sep 26, 2022 · Updated Sep 10, 2026
High · CVSS 7.8 · CISA KEV
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Published Sep 13, 2022 · Updated Sep 10, 2026
High · CVSS 7.8 · CISA KEV
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
Published May 11, 2016 · Updated Sep 10, 2026
High · CVSS 7.8 · CISA KEV
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Published Nov 10, 2016 · Updated Sep 10, 2026
Critical · CVSS 10 · CISA KEV
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Published Sep 7, 2026 · Updated Sep 9, 2026
Critical · CVSS 10 · CISA KEV
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
Published Sep 6, 2026 · Updated Sep 9, 2026
Critical · CVSS 9.3 · CISA KEV
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
Published Dec 19, 2025 · Updated Sep 9, 2026
Critical · CVSS 9.8 · CISA KEV
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Published Aug 26, 2026 · Updated Sep 8, 2026
High · CVSS 7.8 · CISA KEV
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().
If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.
Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.
This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.
Published Jul 22, 2025 · Updated Sep 8, 2026
Critical · CVSS 9.8 · CISA KEV
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
Published Mar 11, 2026 · Updated Sep 8, 2026
High · CVSS 8.8 · CISA KEV
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
Published Jul 8, 2026 · Updated Sep 3, 2026
Critical · CVSS 9.8 · CISA KEV
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
Published Aug 28, 2026 · Updated Sep 3, 2026
Critical · CVSS 10 · CISA KEV
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Published Sep 1, 2026 · Updated Sep 3, 2026
Critical · CVSS 9.3 · CISA KEV
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Published Jul 17, 2026 · Updated Sep 3, 2026
Critical · CVSS 10 · CISA KEV
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.
Published Jun 26, 2026 · Updated Sep 3, 2026
Medium · CVSS 6.5 · CISA KEV
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
Published May 3, 2024 · Updated Sep 2, 2026
High · CVSS 7.8 · CISA KEV
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.
An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.
The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.
The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
Published Jul 4, 2026 · Updated Aug 28, 2026
Medium · CVSS 5.3 · CISA KEV
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
Published Aug 12, 2026 · Updated Aug 28, 2026
Critical · CVSS 9.8 · CISA KEV
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
Published Nov 21, 2023 · Updated Aug 28, 2026
High · CVSS 8.6 · CISA KEV
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published Apr 11, 2026 · Updated Aug 27, 2026
High · CVSS 8.8 · CISA KEV
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Published Jul 15, 2019 · Updated Aug 27, 2026
High · CVSS 8.1 · CISA KEV
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
Published Dec 3, 2021 · Updated Aug 27, 2026
High · CVSS 7.8 · CISA KEV
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Published Dec 7, 2015 · Updated Aug 27, 2026
High · CVSS 7.8 · CISA KEV
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
Published Mar 25, 2022 · Updated Aug 27, 2026
High · CVSS 8.8 · CISA KEV
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Published Jun 30, 2026 · Updated Aug 27, 2026
Critical · CVSS 9.8 · CISA KEV
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Published Apr 11, 2018 · Updated Aug 26, 2026
Critical · CVSS 10 · CISA KEV
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Published Jan 20, 2026 · Updated Aug 25, 2026
High · CVSS 8.9 · CISA KEV
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Published Aug 13, 2026 · Updated Aug 24, 2026
High · CVSS 7.8 · CISA KEV
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Published Dec 15, 2021 · Updated Aug 22, 2026
High · CVSS 8.8 · CISA KEV
Internet Explorer Remote Code Execution Vulnerability
Published Mar 11, 2021 · Updated Aug 19, 2026
High · CVSS 7.6 · CISA KEV
Microsoft Office Remote Code Execution Vulnerability
Published Mar 11, 2021 · Updated Aug 19, 2026
High · CVSS 7.8 · CISA KEV
Microsoft Exchange Server Remote Code Execution Vulnerability
Published Mar 2, 2021 · Updated Aug 19, 2026
Critical · CVSS 9.1 · CISA KEV
Microsoft Exchange Server Remote Code Execution Vulnerability
Published Mar 2, 2021 · Updated Aug 19, 2026
High · CVSS 7.5 · CISA KEV
Active Directory Domain Services Elevation of Privilege Vulnerability
Published Nov 10, 2021 · Updated Aug 19, 2026
High · CVSS 7.8 · CISA KEV
Microsoft Excel Security Feature Bypass Vulnerability
Published Nov 10, 2021 · Updated Aug 19, 2026
High · CVSS 7.5 · CISA KEV
Active Directory Domain Services Elevation of Privilege Vulnerability
Published Nov 10, 2021 · Updated Aug 19, 2026
High · CVSS 7.8 · CISA KEV
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Published Feb 14, 2023 · Updated Aug 19, 2026
High · CVSS 7.3 · CISA KEV
Microsoft Publisher Security Feature Bypass Vulnerability
Published Feb 14, 2023 · Updated Aug 19, 2026
High · CVSS 7.8 · CISA KEV
Microsoft Management Console Remote Code Execution Vulnerability
Published Oct 8, 2024 · Updated Aug 19, 2026
High · CVSS 8.8 · CISA KEV
Microsoft Exchange Server Remote Code Execution Vulnerability
Published Nov 10, 2021 · Updated Aug 19, 2026
High · CVSS 7.8 · CISA KEV
Windows Graphics Component Remote Code Execution Vulnerability
Published Feb 14, 2023 · Updated Aug 19, 2026
