{"metadata": {"count": 5949, "page": 1, "per_page": 100}, "data": [{"uuid": "b0ee0d62-2568-426c-aa38-96881721f4fe", "vulnerability": {"vulnId": "CVE-2026-85706", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b0ee0d62-2568-426c-aa38-96881721f4fe"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T20:01:20+00:00"}, "timestamps": {"asserted_at": "2026-09-11T20:01:20+00:00", "recorded_at": "2026-09-12T21:00:01+00:00", "first_seen_at": "2026-09-11T20:01:20+00:00"}, "scope": {"notes": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | Affected: GitLab / GitLab | CVSS: 10.0 (CRITICAL) | EPSS: 0.01148 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab", "cve_id": "CVE-2026-85706", "vendor": "GitLab", "ghsa_id": "GHSA-F47W-MRG9-G9P2", "product": "GitLab", "added_date": "2026-09-11T20:01:20.727Z", "cvss_score": 10.0, "epss_score": 0.01148, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.64977, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-85706", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-85706", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85706"}, {"id": "GHSA-F47W-MRG9-G9P2", "url": "https://github.com/advisories/GHSA-F47W-MRG9-G9P2"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-85706"}]}, {"uuid": "f2bc947d-8fb2-4ddc-9288-0036759254ab", "vulnerability": {"vulnId": "CVE-2025-2636", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f2bc947d-8fb2-4ddc-9288-0036759254ab"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-12T11:00:02+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion | Affected: Instawp / InstaWP Connect \u2013 1-click WP Staging & Migration | CVSS: 8.1 (HIGH) | EPSS: 0.10422 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion", "cve_id": "CVE-2025-2636", "vendor": "Instawp", "ghsa_id": null, "product": "InstaWP Connect \u2013 1-click WP Staging & Migration", "added_date": "2026-09-11T00:00:00.000Z", "cvss_score": 8.1, "epss_score": 0.10422, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.95457, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-2636", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-2636", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2636"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-2636"}]}, {"uuid": "eb017e76-b2bc-4229-8054-27b655ca3f1c", "vulnerability": {"vulnId": "CVE-2025-29085", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "eb017e76-b2bc-4229-8054-27b655ca3f1c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-12T11:00:02+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via... | Affected: Vipshop / Saturn | CVSS: 9.8 (CRITICAL) | EPSS: 0.30686 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via...", "cve_id": "CVE-2025-29085", "vendor": "Vipshop", "ghsa_id": null, "product": "Saturn", "added_date": "2026-09-11T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.30686, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98137, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-29085", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-29085", "url": "https://www.cve.org/CVERecord?id=CVE-2025-29085"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-29085"}]}, {"uuid": "d49e8a96-ec32-415a-ae06-fe0beba70453", "vulnerability": {"vulnId": "CVE-2017-8917", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d49e8a96-ec32-415a-ae06-fe0beba70453"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-12T11:00:02+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors. | Affected: Joomla / Joomla! | CVSS: 9.8 (CRITICAL) | EPSS: 0.99826 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.", "cve_id": "CVE-2017-8917", "vendor": "Joomla", "ghsa_id": null, "product": "Joomla!", "added_date": "2026-09-11T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.99826, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.99959, "used_in_malware": "unknown", "vulnerability_id": "CVE-2017-8917", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2017-8917", "url": "https://www.cve.org/CVERecord?id=CVE-2017-8917"}, {"id": "previdian", "url": "https://previdian.com/CVE-2017-8917"}]}, {"uuid": "cfd55757-60bf-42b4-8579-b98e3aa79248", "vulnerability": {"vulnId": "CVE-2026-84869", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "cfd55757-60bf-42b4-8579-b98e3aa79248"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-11T19:00:01+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | Affected: ConnectWise / ScreenConnect | Description: ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-84869"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-269", "CWE-862"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "ScreenConnect", "due_date": "2026-09-14", "date_added": "2026-09-11", "vendorProject": "ConnectWise", "vulnerabilityName": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-84869", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869"}]}, {"uuid": "c9519166-323e-490a-9953-a332398615ad", "vulnerability": {"vulnId": "CVE-2026-42018", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "c9519166-323e-490a-9953-a332398615ad"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-11T19:00:01+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "JFrog Artifactory Improper Authentication Vulnerability | Affected: JFrog / Artifactory | Description: JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-42018"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-287"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Artifactory", "due_date": "2026-09-25", "date_added": "2026-09-11", "vendorProject": "JFrog", "vulnerabilityName": "JFrog Artifactory Improper Authentication Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-42018", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018"}]}, {"uuid": "c87a64a3-fe4b-42d0-b73f-dabdba7d4e85", "vulnerability": {"vulnId": "CVE-2018-18084", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c87a64a3-fe4b-42d0-b73f-dabdba7d4e85"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-12T11:00:02+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter. | Affected: Comsenz / Duomicms | CVSS: 9.8 (CRITICAL) | EPSS: 0.01261 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter.", "cve_id": "CVE-2018-18084", "vendor": "Comsenz", "ghsa_id": null, "product": "Duomicms", "added_date": "2026-09-11T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.01261, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.67895, "used_in_malware": "unknown", "vulnerability_id": "CVE-2018-18084", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2018-18084", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18084"}, {"id": "previdian", "url": "https://previdian.com/CVE-2018-18084"}]}, {"uuid": "b3858317-0028-4305-afb3-9242c16e2e1a", "vulnerability": {"vulnId": "CVE-2026-42016", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "b3858317-0028-4305-afb3-9242c16e2e1a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-11T19:00:01+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "JFrog Artifactory Incorrect Authorization Vulnerability | Affected: JFrog / Artifactory | Description: JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token\u2019s scope. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-42016"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-863"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Artifactory", "due_date": "2026-09-25", "date_added": "2026-09-11", "vendorProject": "JFrog", "vulnerabilityName": "JFrog Artifactory Incorrect Authorization Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-42016", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016"}]}, {"uuid": "b07d40c1-522c-40bb-8f2b-55076a002453", "vulnerability": {"vulnId": "CVE-2026-85706", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "b07d40c1-522c-40bb-8f2b-55076a002453"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-11T20:00:02+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | Affected: GitLab / Community Edition and Enterprise Edition | Description: GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85706"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-35"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Community Edition and Enterprise Edition", "due_date": "2026-09-14", "date_added": "2026-09-11", "vendorProject": "GitLab", "vulnerabilityName": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-85706", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706"}]}, {"uuid": "8a3d8b4f-f74c-4d29-b590-a6c7923038db", "vulnerability": {"vulnId": "CVE-2025-1661", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8a3d8b4f-f74c-4d29-b590-a6c7923038db"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-11T00:00:00+00:00", "recorded_at": "2026-09-12T11:00:02+00:00", "first_seen_at": "2026-09-11T00:00:00+00:00"}, "scope": {"notes": "HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion | Affected: realmag777 / HUSKY \u2013 Products Filter Professional for WooCommerce | CVSS: 9.8 (CRITICAL) | EPSS: 0.56382 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion", "cve_id": "CVE-2025-1661", "vendor": "realmag777", "ghsa_id": null, "product": "HUSKY \u2013 Products Filter Professional for WooCommerce", "added_date": "2026-09-11T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.56382, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98994, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-1661", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-1661", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1661"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-1661"}]}, {"uuid": "cca02293-7749-4ac4-9ec4-adceddd4aa0d", "vulnerability": {"vulnId": "CVE-2026-67277", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "cca02293-7749-4ac4-9ec4-adceddd4aa0d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T19:50:56+00:00"}, "timestamps": {"asserted_at": "2026-09-10T19:50:56+00:00", "recorded_at": "2026-09-11T20:00:02+00:00", "first_seen_at": "2026-09-10T19:50:56+00:00"}, "scope": {"notes": "Kernel memory disclosure and denial of service in MikroTik RouterOS btest service | Affected: Mikrotik / RouterOS | CVSS: 8.8 (HIGH) | EPSS: 0.00435 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Kernel memory disclosure and denial of service in MikroTik RouterOS btest service", "cve_id": "CVE-2026-67277", "vendor": "Mikrotik", "ghsa_id": "GHSA-6Q2X-6FHJ-R3W8", "product": "RouterOS", "added_date": "2026-09-10T19:50:56.536Z", "cvss_score": 8.8, "epss_score": 0.00435, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.36743, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-67277", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-67277", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67277"}, {"id": "GHSA-6Q2X-6FHJ-R3W8", "url": "https://github.com/advisories/GHSA-6Q2X-6FHJ-R3W8"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-67277"}]}, {"uuid": "43719310-bca4-4146-99da-52be865a9473", "vulnerability": {"vulnId": "CVE-2026-42018", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "43719310-bca4-4146-99da-52be865a9473"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T19:04:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T19:04:00+00:00", "recorded_at": "2026-09-11T20:00:02+00:00", "first_seen_at": "2026-09-10T19:04:00+00:00"}, "scope": {"notes": "Anonymous user token generation exposure in JFrog Artifactory | Affected: Jfrog / artifactory | CVSS: 7.5 (HIGH) | EPSS: 0.00349 | Used in malware: unknown | Listed 23 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Anonymous user token generation exposure in JFrog Artifactory", "cve_id": "CVE-2026-42018", "vendor": "Jfrog", "ghsa_id": "GHSA-3Q94-GPRH-7PWM", "product": "artifactory", "added_date": "2026-09-10T19:04:00.000Z", "cvss_score": 7.5, "epss_score": 0.00349, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.28044, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-42018", "ahead_of_cisa_kev": {"unit": "hour", "count": 23}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-42018", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42018"}, {"id": "GHSA-3Q94-GPRH-7PWM", "url": "https://github.com/advisories/GHSA-3Q94-GPRH-7PWM"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-42018"}]}, {"uuid": "2baa9521-973e-45a7-bbcf-f7ec1e2d5f93", "vulnerability": {"vulnId": "CVE-2026-42016", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2baa9521-973e-45a7-bbcf-f7ec1e2d5f93"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T19:04:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T19:04:00+00:00", "recorded_at": "2026-09-11T20:00:02+00:00", "first_seen_at": "2026-09-10T19:04:00+00:00"}, "scope": {"notes": "Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation | Affected: Jfrog / artifactory | CVSS: 8.1 (HIGH) | EPSS: 0.00266 | Used in malware: unknown | Listed 23 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation", "cve_id": "CVE-2026-42016", "vendor": "Jfrog", "ghsa_id": null, "product": "artifactory", "added_date": "2026-09-10T19:04:00.000Z", "cvss_score": 8.1, "epss_score": 0.00266, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.184, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-42016", "ahead_of_cisa_kev": {"unit": "hour", "count": 23}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-42016", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42016"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-42016"}]}, {"uuid": "d968d049-8443-4223-8b8b-daa472001bc7", "vulnerability": {"vulnId": "CVE-2026-86060", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d968d049-8443-4223-8b8b-daa472001bc7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T16:26:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T16:26:00+00:00", "recorded_at": "2026-09-11T17:00:02+00:00", "first_seen_at": "2026-09-10T16:26:00+00:00"}, "scope": {"notes": "SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | Affected: Mikrotik / RouterOS | CVSS: 9.2 (CRITICAL) | EPSS: 0.00401 | Used in malware: unknown | Listed 3 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SSH session privilege manipulation via a crafted username in Mikrotik RouterOS", "cve_id": "CVE-2026-86060", "vendor": "Mikrotik", "ghsa_id": "GHSA-6425-CJXV-52GP", "product": "RouterOS", "added_date": "2026-09-10T16:26:00.000Z", "cvss_score": 9.2, "epss_score": 0.00401, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.33627, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-86060", "ahead_of_cisa_kev": {"unit": "hour", "count": 3}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-86060", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86060"}, {"id": "GHSA-6425-CJXV-52GP", "url": "https://github.com/advisories/GHSA-6425-CJXV-52GP"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-86060"}]}, {"uuid": "a610db47-5a3a-46a5-8676-cb616c68aaf9", "vulnerability": {"vulnId": "CVE-2026-67276", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a610db47-5a3a-46a5-8676-cb616c68aaf9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T16:25:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T16:25:00+00:00", "recorded_at": "2026-09-11T17:00:02+00:00", "first_seen_at": "2026-09-10T16:25:00+00:00"}, "scope": {"notes": "SSH user impersonation possible in Mikrotik RouterOS | Affected: Mikrotik / RouterOS | CVSS: 9.2 (CRITICAL) | EPSS: 0.00243 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SSH user impersonation possible in Mikrotik RouterOS", "cve_id": "CVE-2026-67276", "vendor": "Mikrotik", "ghsa_id": null, "product": "RouterOS", "added_date": "2026-09-10T16:25:00.000Z", "cvss_score": 9.2, "epss_score": 0.00243, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.15479, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-67276", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-67276", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67276"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-67276"}]}, {"uuid": "8dce610f-d498-42b4-8529-efc9073923ac", "vulnerability": {"vulnId": "CVE-2026-42031", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8dce610f-d498-42b4-8529-efc9073923ac"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T09:03:59+00:00"}, "timestamps": {"asserted_at": "2026-09-10T09:03:59+00:00", "recorded_at": "2026-09-11T10:00:01+00:00", "first_seen_at": "2026-09-10T09:03:59+00:00"}, "scope": {"notes": "CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` | Affected: Ckan / ckan | CVSS: 8.3 (HIGH) | EPSS: 0.01817 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`", "cve_id": "CVE-2026-42031", "vendor": "Ckan", "ghsa_id": null, "product": "ckan", "added_date": "2026-09-10T09:03:59.303Z", "cvss_score": 8.3, "epss_score": 0.01817, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.77418, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-42031", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-42031", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42031"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-42031"}]}, {"uuid": "ac041c27-50bd-43dd-ad90-377593198745", "vulnerability": {"vulnId": "CVE-2026-86206", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ac041c27-50bd-43dd-ad90-377593198745"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T06:32:55+00:00"}, "timestamps": {"asserted_at": "2026-09-10T06:32:55+00:00", "recorded_at": "2026-09-11T07:00:01+00:00", "first_seen_at": "2026-09-10T06:32:55+00:00"}, "scope": {"notes": "Access control filter bypass allows unauthorised access to APIs | Affected: N-able / N-central | CVSS: 6.9 (MEDIUM) | EPSS: 0.00676 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Access control filter bypass allows unauthorised access to APIs", "cve_id": "CVE-2026-86206", "vendor": "N-able", "ghsa_id": null, "product": "N-central", "added_date": "2026-09-10T06:32:55.151Z", "cvss_score": 6.9, "epss_score": 0.00676, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.50174, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-86206", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-86206", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86206"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-86206"}]}, {"uuid": "6b7bd2a2-fbd3-4488-9df3-e705ed74c6fd", "vulnerability": {"vulnId": "CVE-2026-71362", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "6b7bd2a2-fbd3-4488-9df3-e705ed74c6fd"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T06:31:29+00:00"}, "timestamps": {"asserted_at": "2026-09-10T06:31:29+00:00", "recorded_at": "2026-09-11T07:00:01+00:00", "first_seen_at": "2026-09-10T06:31:29+00:00"}, "scope": {"notes": "Adobe Commerce | Incorrect Authorization (CWE-863) | Affected: Adobe / Adobe Commerce, Adobe Commerce B2B, Magento Open Source | CVSS: 9.1 (CRITICAL) | EPSS: 0.25136 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Adobe Commerce | Incorrect Authorization (CWE-863)", "cve_id": "CVE-2026-71362", "vendor": "Adobe", "ghsa_id": null, "product": "Adobe Commerce, Adobe Commerce B2B, Magento Open Source", "added_date": "2026-09-10T06:31:29.169Z", "cvss_score": 9.1, "epss_score": 0.25136, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.97799, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-71362", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-71362", "url": "https://www.cve.org/CVERecord?id=CVE-2026-71362"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-71362"}]}, {"uuid": "e7c25c61-277b-479a-ad87-5916a893ab5f", "vulnerability": {"vulnId": "CVE-2022-1057", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e7c25c61-277b-479a-ad87-5916a893ab5f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-11T11:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "Pricing Deals for WooCommerce <= 2.0.2.02 - Unauthenticated SQLi | Affected: Varktech / Pricing Deals for WooCommerce | CVSS: 9.8 (CRITICAL) | EPSS: 0.08111 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Pricing Deals for WooCommerce <= 2.0.2.02 - Unauthenticated SQLi", "cve_id": "CVE-2022-1057", "vendor": "Varktech", "ghsa_id": null, "product": "Pricing Deals for WooCommerce", "added_date": "2026-09-10T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.08111, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.94484, "used_in_malware": "unknown", "vulnerability_id": "CVE-2022-1057", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-1057", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1057"}, {"id": "previdian", "url": "https://previdian.com/CVE-2022-1057"}]}, {"uuid": "db24582b-4837-4ebe-bffb-0852f51b470a", "vulnerability": {"vulnId": "CVE-2024-31982", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "db24582b-4837-4ebe-bffb-0852f51b470a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-11T11:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "XWiki Platform: Remote code execution as guest via DatabaseSearch | Affected: Xwiki / xwiki-platform | CVSS: 10.0 (CRITICAL) | EPSS: 0.3428 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "XWiki Platform: Remote code execution as guest via DatabaseSearch", "cve_id": "CVE-2024-31982", "vendor": "Xwiki", "ghsa_id": null, "product": "xwiki-platform", "added_date": "2026-09-10T00:00:00.000Z", "cvss_score": 10.0, "epss_score": 0.3428, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98307, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-31982", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-31982", "url": "https://www.cve.org/CVERecord?id=CVE-2024-31982"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-31982"}]}, {"uuid": "bb0ee1ae-defa-495f-8b5a-7242b86d5ccb", "vulnerability": {"vulnId": "CVE-2026-67277", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "bb0ee1ae-defa-495f-8b5a-7242b86d5ccb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-10T20:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | Affected: MikroTik / RouterOS | Description: MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://mikrotik.com/supportsec/september-2026-vulnerability/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67277"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-306"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "RouterOS", "due_date": "2026-09-13", "date_added": "2026-09-10", "vendorProject": "MikroTik", "vulnerabilityName": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-67277", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277"}]}, {"uuid": "a83b6a53-5e9e-4401-83ac-acff9bf2ef48", "vulnerability": {"vulnId": "CVE-2026-86060", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "a83b6a53-5e9e-4401-83ac-acff9bf2ef48"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-10T20:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | Affected: MikroTik / RouterOS | Description: MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV):  ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86060"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-88"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "RouterOS", "due_date": "2026-09-13", "date_added": "2026-09-10", "vendorProject": "MikroTik", "vulnerabilityName": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-86060", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060"}]}, {"uuid": "8ea2a80a-1360-4f9d-9d68-df0efe68e803", "vulnerability": {"vulnId": "CVE-2022-0169", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8ea2a80a-1360-4f9d-9d68-df0efe68e803"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-11T11:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection | Affected: 10Web / Photo Gallery | EPSS: 0.74615 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection", "cve_id": "CVE-2022-0169", "vendor": "10Web", "ghsa_id": null, "product": "Photo Gallery", "added_date": "2026-09-10T00:00:00.000Z", "cvss_score": null, "epss_score": 0.74615, "previous_ids": [], "cvss_severity": null, "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.99466, "used_in_malware": "unknown", "vulnerability_id": "CVE-2022-0169", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-0169", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0169"}, {"id": "previdian", "url": "https://previdian.com/CVE-2022-0169"}]}, {"uuid": "84284bc6-6c26-4cb6-8ca4-2c70c58af4dc", "vulnerability": {"vulnId": "CVE-2024-5276", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "84284bc6-6c26-4cb6-8ca4-2c70c58af4dc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-11T11:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier) | Affected: Fortra / FileCatalyst Workflow | CVSS: 9.8 (CRITICAL) | EPSS: 0.90067 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)", "cve_id": "CVE-2024-5276", "vendor": "Fortra", "ghsa_id": null, "product": "FileCatalyst Workflow", "added_date": "2026-09-10T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.90067, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.99787, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-5276", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-5276", "url": "https://www.cve.org/CVERecord?id=CVE-2024-5276"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-5276"}]}, {"uuid": "7ae70118-bb20-4e14-a01c-cfb2d14d7491", "vulnerability": {"vulnId": "CVE-2026-45695", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7ae70118-bb20-4e14-a01c-cfb2d14d7491"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-11T11:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used | Affected: Kopia / kopia | CVSS: 9.8 (CRITICAL) | EPSS: 0.0161 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used", "cve_id": "CVE-2026-45695", "vendor": "Kopia", "ghsa_id": null, "product": "kopia", "added_date": "2026-09-10T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.0161, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.74492, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-45695", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-45695", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45695"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-45695"}]}, {"uuid": "737d80a1-2c10-486f-9282-3d667451f149", "vulnerability": {"vulnId": "CVE-2024-50340", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "737d80a1-2c10-486f-9282-3d667451f149"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-11T11:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "Ability to change environment from query in symfony/runtime | Affected: Symfony / symfony | CVSS: 7.3 (HIGH) | EPSS: 0.64429 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Ability to change environment from query in symfony/runtime", "cve_id": "CVE-2024-50340", "vendor": "Symfony", "ghsa_id": null, "product": "symfony", "added_date": "2026-09-10T00:00:00.000Z", "cvss_score": 7.3, "epss_score": 0.64429, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.99185, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-50340", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-50340", "url": "https://www.cve.org/CVERecord?id=CVE-2024-50340"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-50340"}]}, {"uuid": "43b7b690-a419-4337-b08b-d700f8ddd6d8", "vulnerability": {"vulnId": "CVE-2019-10232", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "43b7b690-a419-4337-b08b-d700f8ddd6d8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-11T11:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "Teclib GLPI through 9.3.3 has SQL injection via the \"cycle\" parameter in /scripts/unlock_tasks.php. | Affected: Teclib-edition / Gestionnaire Libre DE Parc Informatique | CVSS: 9.8 (CRITICAL) | EPSS: 0.23211 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Teclib GLPI through 9.3.3 has SQL injection via the \"cycle\" parameter in /scripts/unlock_tasks.php.", "cve_id": "CVE-2019-10232", "vendor": "Teclib-edition", "ghsa_id": null, "product": "Gestionnaire Libre DE Parc Informatique", "added_date": "2026-09-10T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.23211, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.97633, "used_in_malware": "unknown", "vulnerability_id": "CVE-2019-10232", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2019-10232", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10232"}, {"id": "previdian", "url": "https://previdian.com/CVE-2019-10232"}]}, {"uuid": "28542180-9162-4694-9297-5891f2a7a392", "vulnerability": {"vulnId": "CVE-2024-36412", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "28542180-9162-4694-9297-5891f2a7a392"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-10T00:00:00+00:00", "recorded_at": "2026-09-11T11:00:01+00:00", "first_seen_at": "2026-09-10T00:00:00+00:00"}, "scope": {"notes": "SuiteCRM unauthenticated SQL Injection | Affected: Salesagility / SuiteCRM | CVSS: 10.0 (CRITICAL) | EPSS: 0.05692 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SuiteCRM unauthenticated SQL Injection", "cve_id": "CVE-2024-36412", "vendor": "Salesagility", "ghsa_id": null, "product": "SuiteCRM", "added_date": "2026-09-10T00:00:00.000Z", "cvss_score": 10.0, "epss_score": 0.05692, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.92549, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-36412", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-36412", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36412"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-36412"}]}, {"uuid": "5b74aac8-cd90-4795-8070-f991dc6120df", "vulnerability": {"vulnId": "CVE-2026-20079", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "5b74aac8-cd90-4795-8070-f991dc6120df"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T16:08:59+00:00"}, "timestamps": {"asserted_at": "2026-09-09T16:08:59+00:00", "recorded_at": "2026-09-10T21:00:01+00:00", "first_seen_at": "2026-09-09T16:08:59+00:00"}, "scope": {"notes": "Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability | Affected: Cisco / Cisco Secure Firewall Management Center (FMC) | CVSS: 10.0 (CRITICAL) | EPSS: 0.35946 | Used in malware: unknown | Listed 3 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability", "cve_id": "CVE-2026-20079", "vendor": "Cisco", "ghsa_id": "GHSA-MV8W-C2QV-CGRG", "product": "Cisco Secure Firewall Management Center (FMC)", "added_date": "2026-09-09T16:08:59.000Z", "cvss_score": 10.0, "epss_score": 0.35946, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98374, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-20079", "ahead_of_cisa_kev": {"unit": "hour", "count": 3}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-20079", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20079"}, {"id": "GHSA-MV8W-C2QV-CGRG", "url": "https://github.com/advisories/GHSA-MV8W-C2QV-CGRG"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-20079"}]}, {"uuid": "07fde58d-065c-4f29-a7bd-2021f9430de4", "vulnerability": {"vulnId": "CVE-2026-87827", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "07fde58d-065c-4f29-a7bd-2021f9430de4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T11:01:06+00:00"}, "timestamps": {"asserted_at": "2026-09-09T11:01:06+00:00", "recorded_at": "2026-09-10T12:00:01+00:00", "first_seen_at": "2026-09-09T11:01:06+00:00"}, "scope": {"notes": "KGUARD DVR unauthenticated remote command execution vulnerability | Affected: KGUARD / KGUARD_firmware | CVSS: 10.0 (CRITICAL) | Used in malware: yes | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "confirmed_compromise", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "KGUARD DVR unauthenticated remote command execution vulnerability", "cve_id": "CVE-2026-87827", "vendor": "KGUARD", "ghsa_id": "GHSA-MXWW-3QMJ-G8P3", "product": "KGUARD_firmware", "added_date": "2026-09-09T11:01:06.386Z", "cvss_score": 10.0, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "yes", "vulnerability_id": "CVE-2026-87827", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-87827", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87827"}, {"id": "GHSA-MXWW-3QMJ-G8P3", "url": "https://github.com/advisories/GHSA-MXWW-3QMJ-G8P3"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-87827"}]}, {"uuid": "5391d078-3b34-4be8-ba3f-f7f829fa073c", "vulnerability": {"vulnId": "GCVE-1-2026-20026", "altId": []}, "gcve": {"origin_uuid": "1a89b78e-f703-45f3-bb86-59eb712668bd", "gna": 1, "object_uuid": "5391d078-3b34-4be8-ba3f-f7f829fa073c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T10:39:13+00:00"}, "characteristics": {"severity": 100.0, "local_access_required": false, "remote_code_execution": true, "authentication_required": false}, "timestamps": {"asserted_at": "2026-09-09T10:39:13+00:00", "last_seen_at": "2026-09-09T10:39:13+00:00", "first_seen_at": "2026-09-09T10:39:13+00:00"}, "scope": {"notes": "Older firmware"}, "evidence": []}, {"uuid": "2185e47b-f812-47b3-bbdf-ece52ef1e638", "vulnerability": {"vulnId": "CVE-2026-87491", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2185e47b-f812-47b3-bbdf-ece52ef1e638"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T08:00:59+00:00"}, "timestamps": {"asserted_at": "2026-09-09T08:00:59+00:00", "recorded_at": "2026-09-10T08:17:59+00:00", "first_seen_at": "2026-09-09T08:00:59+00:00"}, "scope": {"notes": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a... | Affected: Google / Chrome | CVSS: 8.8 (HIGH) | EPSS: 0.00291 | Used in malware: unknown | Listed 11 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a...", "cve_id": "CVE-2026-87491", "vendor": "Google", "ghsa_id": "GHSA-8X3P-8G9V-XC7M", "product": "Chrome", "added_date": "2026-09-09T08:00:59.000Z", "cvss_score": 8.8, "epss_score": 0.00291, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.21438, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-87491", "ahead_of_cisa_kev": {"unit": "hour", "count": 11}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-87491", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87491"}, {"id": "GHSA-8X3P-8G9V-XC7M", "url": "https://github.com/advisories/GHSA-8X3P-8G9V-XC7M"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-87491"}]}, {"uuid": "d7a8bc6e-5be5-42b0-8c11-40aa62eb3960", "vulnerability": {"vulnId": "CVE-2026-86207", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d7a8bc6e-5be5-42b0-8c11-40aa62eb3960"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T07:56:22+00:00"}, "timestamps": {"asserted_at": "2026-09-09T07:56:22+00:00", "recorded_at": "2026-09-10T08:00:01+00:00", "first_seen_at": "2026-09-09T07:56:22+00:00"}, "scope": {"notes": "Authentication bypass leads to unauthorised access to N-central | Affected: N-able / N-central | CVSS: 7.7 (HIGH) | EPSS: 0.00734 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Authentication bypass leads to unauthorised access to N-central", "vendor": "N-able", "product": "N-central", "added_date": "2026-09-09T07:56:22.822Z", "cvss_score": 7.7, "epss_score": 0.00734, "cvss_severity": "HIGH", "epss_percentile": 0.52282, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-86207", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86207"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-86207"}]}, {"uuid": "8c0c15ad-9774-4257-a684-261787a40b66", "vulnerability": {"vulnId": "CVE-2026-84869", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8c0c15ad-9774-4257-a684-261787a40b66"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T07:51:00+00:00"}, "timestamps": {"asserted_at": "2026-09-09T07:51:00+00:00", "recorded_at": "2026-09-10T08:00:01+00:00", "first_seen_at": "2026-09-09T07:51:00+00:00"}, "scope": {"notes": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | Affected: ConnectWise / ScreenConnect | CVSS: 9.9 (CRITICAL) | EPSS: 0.00382 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions", "vendor": "ConnectWise", "product": "ScreenConnect", "added_date": "2026-09-09T07:51:00.000Z", "cvss_score": 9.9, "epss_score": 0.00382, "cvss_severity": "CRITICAL", "epss_percentile": 0.31599, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-84869", "url": "https://www.cve.org/CVERecord?id=CVE-2026-84869"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-84869"}]}, {"uuid": "84cfbccf-e121-41d0-a049-074a83e946f7", "vulnerability": {"vulnId": "CVE-2026-20079", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "84cfbccf-e121-41d0-a049-074a83e946f7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-09-09T20:00:01+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | Affected: Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Description: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20079"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-288"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management", "due_date": "2026-09-12", "date_added": "2026-09-09", "vendorProject": "Cisco", "vulnerabilityName": "Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-20079", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079"}]}, {"uuid": "76235c89-e484-4042-96ad-26f9515fbf7e", "vulnerability": {"vulnId": "CVE-2025-25249", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "76235c89-e484-4042-96ad-26f9515fbf7e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-09-09T20:00:01+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | Affected: Fortinet / Multiple Products | Description: Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://fortiguard.fortinet.com/psirt/FG-IR-25-084 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-25249"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-122", "CWE-787"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Multiple Products", "due_date": "2026-09-12", "date_added": "2026-09-09", "vendorProject": "Fortinet", "vulnerabilityName": "Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2025-25249", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249"}]}, {"uuid": "64394a9a-b4a1-4a61-ba7b-af896277501e", "vulnerability": {"vulnId": "CVE-2024-2851", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "64394a9a-b4a1-4a61-ba7b-af896277501e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-09-10T11:00:02+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Tenda AC15 setsambacfg formSetSambaConf os command injection | Affected: Tenda / AC15 | CVSS: 6.3 (MEDIUM) | EPSS: 0.04009 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Tenda AC15 setsambacfg formSetSambaConf os command injection", "cve_id": "CVE-2024-2851", "vendor": "Tenda", "ghsa_id": null, "product": "AC15", "added_date": "2026-09-09T00:00:00.000Z", "cvss_score": 6.3, "epss_score": 0.04009, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.89933, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-2851", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-2851", "url": "https://www.cve.org/CVERecord?id=CVE-2024-2851"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-2851"}]}, {"uuid": "4a2197ee-574d-4238-a771-79344c84b722", "vulnerability": {"vulnId": "CVE-2026-20079", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "4a2197ee-574d-4238-a771-79344c84b722"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-09-10T17:00:01+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Secure Firewall Management Center (FMC) | Description: Vulnerability in the web interface could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. EU victimology was confirmed. Comprehensive hardening scheduled (Week of September 14th) | Patched since: 2026/08/05 | Exploitation type: ransomware | CWEs: CWE-288 | Origin source: ENISA | Notes: https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": ["CWE-288"], "euvd": "EUVD-2026-9438", "notes": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Cisco Secure Firewall Management Center (FMC)", "dateReported": "2026/09/09", "originSource": "ENISA", "patchedSince": "2026/08/05", "vendorProject": "Cisco", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-20079", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20079"}, {"id": "EUVD-2026-9438", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9438"}, {"id": "source", "url": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]}, {"uuid": "3641ff59-fcf5-4d2b-ae10-e57aa0a324e3", "vulnerability": {"vulnId": "CVE-2026-20316", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "3641ff59-fcf5-4d2b-ae10-e57aa0a324e3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-09-10T17:00:01+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Secure Firewall Management Center (FMC) | Description: Vulnerability in the web interface could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. EU victimology was confirmed. Comprehensive hardening scheduled (Week of September 14th). | Patched since: 2026/08/05 | Exploitation type: ransomware | CWEs: CWE-259 | Origin source: ENISA | Notes: https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "confirmed_compromise", "confidence": 0.75, "details": {"cwes": ["CWE-259"], "euvd": "EUVD-2026-50404", "notes": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "Cisco Secure Firewall Management Center (FMC)", "dateReported": "2026/09/09", "originSource": "ENISA", "patchedSince": "2026/08/05", "vendorProject": "Cisco", "exploitationType": ["ransomware"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-20316", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20316"}, {"id": "EUVD-2026-50404", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50404"}, {"id": "source", "url": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]}, {"uuid": "29c4e748-68a3-4760-9212-bdb34a5a73ac", "vulnerability": {"vulnId": "CVE-2026-19490", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "29c4e748-68a3-4760-9212-bdb34a5a73ac"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-09-09T20:00:01+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | Affected: Citrix / NetScaler | Description: Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-19490"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-288"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "NetScaler", "due_date": "2026-09-12", "date_added": "2026-09-09", "vendorProject": "Citrix", "vulnerabilityName": "Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-19490", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490"}]}, {"uuid": "0a37c372-acc3-4022-9d5f-11bdf31cccbc", "vulnerability": {"vulnId": "CVE-2026-87491", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "0a37c372-acc3-4022-9d5f-11bdf31cccbc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-09T00:00:00+00:00", "recorded_at": "2026-09-09T20:00:01+00:00", "first_seen_at": "2026-09-09T00:00:00+00:00"}, "scope": {"notes": "Google Chromium V8 Out of Bounds Write Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-23 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87491 "}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-787"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Chromium V8", "due_date": "2026-09-23", "date_added": "2026-09-09", "vendorProject": "Google", "vulnerabilityName": "Google Chromium V8 Out of Bounds Write Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-87491", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491"}]}, {"uuid": "64f2d211-92cd-4826-92a9-c4f61659b1fb", "vulnerability": {"vulnId": "CVE-2025-25249", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "64f2d211-92cd-4826-92a9-c4f61659b1fb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T15:03:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T15:03:00+00:00", "recorded_at": "2026-09-09T16:00:01+00:00", "first_seen_at": "2026-09-08T15:03:00+00:00"}, "scope": {"notes": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11,... | Affected: Fortinet / FortiSwitchManager, FortiOS | CVSS: 8.1 (HIGH) | EPSS: 0.00759 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11,...", "vendor": "Fortinet", "product": "FortiSwitchManager, FortiOS", "added_date": "2026-09-08T15:03:00.000Z", "cvss_score": 8.1, "epss_score": 0.00759, "cvss_severity": "HIGH", "epss_percentile": 0.52946, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-25249", "url": "https://www.cve.org/CVERecord?id=CVE-2025-25249"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-25249"}]}, {"uuid": "87df996f-d392-4a84-a8ce-59565a65625f", "vulnerability": {"vulnId": "GHSA-6V53-HR58-556R", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "87df996f-d392-4a84-a8ce-59565a65625f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T07:53:59+00:00"}, "timestamps": {"asserted_at": "2026-09-08T07:53:59+00:00", "recorded_at": "2026-09-10T08:17:59+00:00", "first_seen_at": "2026-09-08T07:53:59+00:00"}, "scope": {"notes": "Unauthenticated Arbitrary File Read can lead to RCE | CVSS: 9.8 (critical) | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Unauthenticated Arbitrary File Read can lead to RCE", "cve_id": null, "vendor": null, "ghsa_id": "GHSA-6V53-HR58-556R", "product": null, "added_date": "2026-09-08T07:53:59.654Z", "cvss_score": 9.8, "epss_score": null, "previous_ids": [], "cvss_severity": "critical", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "GHSA-6V53-HR58-556R", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "GHSA-6V53-HR58-556R", "url": "https://github.com/advisories/GHSA-6V53-HR58-556R"}, {"id": "previdian", "url": "https://previdian.com/GHSA-6V53-HR58-556R"}]}, {"uuid": "67a434d0-13fb-4575-919e-d58492f0b1fa", "vulnerability": {"vulnId": "CVE-2026-81963", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "67a434d0-13fb-4575-919e-d58492f0b1fa"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T07:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T07:00:00+00:00", "recorded_at": "2026-09-09T07:00:01+00:00", "first_seen_at": "2026-09-08T07:00:00+00:00"}, "scope": {"notes": "Windows Update Stack Elevation of Privilege Vulnerability | Affected: Microsoft / Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2025, Windows Server 2025 (Server Core installation) | CVSS: 7.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Windows Update Stack Elevation of Privilege Vulnerability", "vendor": "Microsoft", "product": "Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2025, Windows Server 2025 (Server Core installation)", "added_date": "2026-09-08T07:00:00.000Z", "cvss_score": 7.8, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "hour", "count": 12}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-81963", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81963"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-81963"}]}, {"uuid": "6756a1a8-ae4c-4e2f-9bd4-984e5d5c3c4a", "vulnerability": {"vulnId": "CVE-2026-85880", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "6756a1a8-ae4c-4e2f-9bd4-984e5d5c3c4a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T07:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T07:00:00+00:00", "recorded_at": "2026-09-09T07:00:01+00:00", "first_seen_at": "2026-09-08T07:00:00+00:00"}, "scope": {"notes": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Affected: Microsoft / Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022 | CVSS: 7.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability", "vendor": "Microsoft", "product": "Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022", "added_date": "2026-09-08T07:00:00.000Z", "cvss_score": 7.8, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "hour", "count": 12}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-85880", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85880"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-85880"}]}, {"uuid": "7e7a2825-4dba-45d0-927b-fd4508779676", "vulnerability": {"vulnId": "CVE-2023-37462", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7e7a2825-4dba-45d0-927b-fd4508779676"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T00:00:00+00:00", "recorded_at": "2026-09-09T11:00:02+00:00", "first_seen_at": "2026-09-08T00:00:00+00:00"}, "scope": {"notes": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui | Affected: Xwiki / xwiki-platform | CVSS: 9.9 (CRITICAL) | EPSS: 0.91492 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui", "vendor": "Xwiki", "product": "xwiki-platform", "added_date": "2026-09-08T00:00:00.000Z", "cvss_score": 9.9, "epss_score": 0.91492, "cvss_severity": "CRITICAL", "epss_percentile": 0.99804, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-37462", "url": "https://www.cve.org/CVERecord?id=CVE-2023-37462"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-37462"}]}, {"uuid": "53d13cb4-7c65-48e9-a42f-495df58de1a0", "vulnerability": {"vulnId": "CVE-2026-75650", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "53d13cb4-7c65-48e9-a42f-495df58de1a0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T00:00:00+00:00", "recorded_at": "2026-09-08T19:00:01+00:00", "first_seen_at": "2026-09-08T00:00:00+00:00"}, "scope": {"notes": "Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | Affected: Adobe / Commerce and Magento | Description: Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-11 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://helpx.adobe.com/security/products/magento/apsb26-146.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-75650"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-1336"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Commerce and Magento", "due_date": "2026-09-11", "date_added": "2026-09-08", "vendorProject": "Adobe", "vulnerabilityName": "Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-75650", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650"}]}, {"uuid": "3349178b-3aef-4022-9ba4-1d064da9c487", "vulnerability": {"vulnId": "CVE-2026-85880", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "3349178b-3aef-4022-9ba4-1d064da9c487"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T00:00:00+00:00", "recorded_at": "2026-09-08T19:00:01+00:00", "first_seen_at": "2026-09-08T00:00:00+00:00"}, "scope": {"notes": "Microsoft Windows Heap-Based Buffer Overflow Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85880"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-122", "CWE-908"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Windows", "due_date": "2026-09-22", "date_added": "2026-09-08", "vendorProject": "Microsoft", "vulnerabilityName": "Microsoft Windows Heap-Based Buffer Overflow Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-85880", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85880"}]}, {"uuid": "25f2b2d4-35a6-46c5-82c0-07e78979660d", "vulnerability": {"vulnId": "CVE-2026-86218", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "25f2b2d4-35a6-46c5-82c0-07e78979660d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T00:00:00+00:00", "recorded_at": "2026-09-08T19:00:01+00:00", "first_seen_at": "2026-09-08T00:00:00+00:00"}, "scope": {"notes": "N-able N-central Static Code Injection Vulnerability | Affected: N-able / N-central | Description: N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-11 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/ ; https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86218"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-96"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "N-central", "due_date": "2026-09-11", "date_added": "2026-09-08", "vendorProject": "N-able", "vulnerabilityName": "N-able N-central Static Code Injection Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-86218", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218"}]}, {"uuid": "12f9f445-6d31-4897-a6bb-5520c97a620c", "vulnerability": {"vulnId": "CVE-2018-17254", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "12f9f445-6d31-4897-a6bb-5520c97a620c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T00:00:00+00:00", "recorded_at": "2026-09-09T11:00:02+00:00", "first_seen_at": "2026-09-08T00:00:00+00:00"}, "scope": {"notes": "The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. | Affected: n/a | CVSS: 9.8 (CRITICAL) | EPSS: 0.82976 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.", "vendor": null, "product": "n/a", "added_date": "2026-09-08T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.82976, "cvss_severity": "CRITICAL", "epss_percentile": 0.99651, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2018-17254", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17254"}, {"id": "previdian", "url": "https://previdian.com/CVE-2018-17254"}]}, {"uuid": "09991baa-5ae1-426a-8367-a5205a9ff1b1", "vulnerability": {"vulnId": "CVE-2026-81963", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "09991baa-5ae1-426a-8367-a5205a9ff1b1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-08T00:00:00+00:00", "recorded_at": "2026-09-08T19:00:01+00:00", "first_seen_at": "2026-09-08T00:00:00+00:00"}, "scope": {"notes": "Microsoft Windows Link Following Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81963"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-59", "CWE-284"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Windows", "due_date": "2026-09-22", "date_added": "2026-09-08", "vendorProject": "Microsoft", "vulnerabilityName": "Microsoft Windows Link Following Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-81963", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81963"}]}, {"uuid": "3dc7d7d7-4402-4941-8b1f-b3fc7fe5825a", "vulnerability": {"vulnId": "CVE-2026-58457", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "3dc7d7d7-4402-4941-8b1f-b3fc7fe5825a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T23:39:32+00:00"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-09-07T23:39:32+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T23:39:32+00:00", "first_seen_at": "2026-09-07T23:39:32+00:00"}, "scope": {"notes": "Affected: Shenzhen Aitemi / M300 Wi-Fi Repeater | Class: router | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Shenzhen Aitemi", "30d_avg": 0, "90d_avg": 0, "product": "M300 Wi-Fi Repeater", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-58457", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58457"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b07c53ad-5807-43e8-9c44-f55cc8d29f1c", "vulnerability": {"vulnId": "CVE-2025-14208", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b07c53ad-5807-43e8-9c44-f55cc8d29f1c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T11:08:02+00:00"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-09-07T11:08:02+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T11:08:02+00:00", "first_seen_at": "2026-09-07T11:08:02+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-823X | Class: router | Severity: Medium (CVSS 6.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 33", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-823X", "cisa_kev": "no", "connections": 33, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-14208", "url": "https://www.cve.org/CVERecord?id=CVE-2025-14208"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "fabd18ee-baa2-4b2b-bb33-f5b7a1a73529", "vulnerability": {"vulnId": "CVE-2025-60687", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "fabd18ee-baa2-4b2b-bb33-f5b7a1a73529"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:07:34+00:00"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2026-09-07T00:07:34+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:07:34+00:00", "first_seen_at": "2026-09-07T00:07:34+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink LR1200GB | Class: router | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink LR1200GB", "cisa_kev": "no", "connections": 4, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-60687", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60687"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ac655f60-5a8c-4442-8e94-1d02568e6e04", "vulnerability": {"vulnId": "CVE-2023-37569", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ac655f60-5a8c-4442-8e94-1d02568e6e04"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:07:34+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-09-07T00:07:34+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:07:34+00:00", "first_seen_at": "2026-09-07T00:07:34+00:00"}, "scope": {"notes": "Affected: ESDS / Emagic Data Center Management Suite | Class: device-management-platform | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "ESDS", "30d_avg": 0, "90d_avg": 0, "product": "Emagic Data Center Management Suite", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-37569", "url": "https://www.cve.org/CVERecord?id=CVE-2023-37569"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "072fa52e-a6c9-4f09-ad2f-cae0b04ffd22", "vulnerability": {"vulnId": "CVE-2025-6068", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "072fa52e-a6c9-4f09-ad2f-cae0b04ffd22"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:07:33+00:00"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2026-09-07T00:07:33+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:07:33+00:00", "first_seen_at": "2026-09-07T00:07:33+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A720R | Class: router | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A720R", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-6068", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6068"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "bd89af6a-2650-4475-946f-13314367add4", "vulnerability": {"vulnId": "CVE-2025-6068", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "bd89af6a-2650-4475-946f-13314367add4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-07T00:00:00+00:00", "recorded_at": "2026-09-08T11:00:01+00:00", "first_seen_at": "2026-09-07T00:00:00+00:00"}, "scope": {"notes": "FooGallery \u2013 Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting | Affected: Bradvin / FooGallery \u2013 Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel | CVSS: 6.4 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "FooGallery \u2013 Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting", "vendor": "Bradvin", "product": "FooGallery \u2013 Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel", "added_date": "2026-09-07T00:00:00.000Z", "cvss_score": 6.4, "epss_score": null, "cvss_severity": "MEDIUM", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-6068", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6068"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-6068"}]}, {"uuid": "80d75a83-4aac-4637-aae0-5a1fce957eb8", "vulnerability": {"vulnId": "CVE-2023-37569", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "80d75a83-4aac-4637-aae0-5a1fce957eb8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-07T00:00:00+00:00", "recorded_at": "2026-09-08T11:00:01+00:00", "first_seen_at": "2026-09-07T00:00:00+00:00"}, "scope": {"notes": "OS Command Injection Vulnerability in Emagic Data Center Management Suite | Affected: ESDS / Emagic Data Center Management Suite | CVSS: 8.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "OS Command Injection Vulnerability in Emagic Data Center Management Suite", "vendor": "ESDS", "product": "Emagic Data Center Management Suite", "added_date": "2026-09-07T00:00:00.000Z", "cvss_score": 8.8, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-37569", "url": "https://www.cve.org/CVERecord?id=CVE-2023-37569"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-37569"}]}, {"uuid": "437cac9c-4bc9-40fe-88ae-bdee99fc00e2", "vulnerability": {"vulnId": "CVE-2025-60687", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "437cac9c-4bc9-40fe-88ae-bdee99fc00e2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-07T00:00:00+00:00", "recorded_at": "2026-09-08T11:00:01+00:00", "first_seen_at": "2026-09-07T00:00:00+00:00"}, "scope": {"notes": "An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi... | Affected: ToToLink / LR1200GB Router | CVSS: 6.5 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi...", "vendor": "ToToLink", "product": "LR1200GB Router", "added_date": "2026-09-07T00:00:00.000Z", "cvss_score": 6.5, "epss_score": null, "cvss_severity": "MEDIUM", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-60687", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60687"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-60687"}]}, {"uuid": "12253a70-6b5a-44ad-b30d-9849e4011cb8", "vulnerability": {"vulnId": "CVE-2025-14208", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "12253a70-6b5a-44ad-b30d-9849e4011cb8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-07T00:00:00+00:00", "recorded_at": "2026-09-08T11:00:01+00:00", "first_seen_at": "2026-09-07T00:00:00+00:00"}, "scope": {"notes": "D-Link DIR-823X set_wan_settings sub_415028 command injection | Affected: D-Link / DIR-823X | CVSS: 5.3 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "D-Link DIR-823X set_wan_settings sub_415028 command injection", "vendor": "D-Link", "product": "DIR-823X", "added_date": "2026-09-07T00:00:00.000Z", "cvss_score": 5.3, "epss_score": null, "cvss_severity": "MEDIUM", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-14208", "url": "https://www.cve.org/CVERecord?id=CVE-2025-14208"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-14208"}]}, {"uuid": "412de4b2-4657-43f2-bd7b-2596fc9174aa", "vulnerability": {"vulnId": "CVE-2025-4008", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "412de4b2-4657-43f2-bd7b-2596fc9174aa"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T09:51:52+00:00"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2026-09-06T09:51:52+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T09:51:52+00:00", "first_seen_at": "2026-09-06T09:51:52+00:00"}, "scope": {"notes": "Affected: Smartbedded / MeteoBridge | Class: embedded-system | Severity: High (CVSS 8.7) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 36", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "Smartbedded", "30d_avg": 0, "90d_avg": 0, "product": "MeteoBridge", "cisa_kev": "yes", "connections": 36, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-4008", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4008"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "48679692-5264-44cc-acde-02dc7f7b229a", "vulnerability": {"vulnId": "CVE-2026-86218", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "48679692-5264-44cc-acde-02dc7f7b229a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T04:15:00+00:00"}, "timestamps": {"asserted_at": "2026-09-06T04:15:00+00:00", "recorded_at": "2026-09-07T11:00:02+00:00", "first_seen_at": "2026-09-06T04:15:00+00:00"}, "scope": {"notes": "pre-authentication remote code execution | Affected: N-able / N-central | CVSS: 10.0 (CRITICAL) | EPSS: 0.00411 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "pre-authentication remote code execution", "vendor": "N-able", "product": "N-central", "added_date": "2026-09-06T04:15:00.000Z", "cvss_score": 10.0, "epss_score": 0.00411, "cvss_severity": "CRITICAL", "epss_percentile": 0.3432, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-86218", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86218"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-86218"}]}, {"uuid": "9485787d-5ab2-44b7-a11d-d0dd66427606", "vulnerability": {"vulnId": "CVE-2025-60698", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "9485787d-5ab2-44b7-a11d-d0dd66427606"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2026-09-05T16:20:48+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-05T16:20:48+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-882 | Class: router | Severity: High (CVSS 7.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-882", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-60698", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60698"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f980a061-7bb8-490b-ab20-3a039e8543cb", "vulnerability": {"vulnId": "CVE-2026-75650", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f980a061-7bb8-490b-ab20-3a039e8543cb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T12:44:00+00:00"}, "timestamps": {"asserted_at": "2026-09-05T12:44:00+00:00", "recorded_at": "2026-09-10T07:09:50+00:00", "first_seen_at": "2026-09-05T12:44:00+00:00"}, "scope": {"notes": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Affected: Adobe / Adobe Commerce, Adobe Commerce B2B, Magento Open Source | CVSS: 10.0 (CRITICAL) | EPSS: 0.02148 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "vendor": "Adobe", "product": "Adobe Commerce, Adobe Commerce B2B, Magento Open Source", "added_date": "2026-09-05T12:44:00.000Z", "cvss_score": 10.0, "epss_score": 0.02148, "cvss_severity": "CRITICAL", "epss_percentile": 0.8102, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "day", "count": 3}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-75650", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75650"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-75650"}]}, {"uuid": "4dad5054-27d2-428b-8fc0-829ceb08f56b", "vulnerability": {"vulnId": "CVE-2026-86060", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "4dad5054-27d2-428b-8fc0-829ceb08f56b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-05T00:00:00+00:00", "recorded_at": "2026-09-05T22:00:01+00:00", "first_seen_at": "2026-09-05T00:00:00+00:00"}, "scope": {"notes": "MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-88 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-88"], "euvd": "EUVD-2026-72029", "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "RouterOS", "dateReported": "2026/09/05", "originSource": "CERT.PL", "patchedSince": "2026/09/03", "vendorProject": "MikroTik", "exploitationType": ["unknown"], "vulnerabilityName": "MikroTrick", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-86060", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86060"}, {"id": "EUVD-2026-72029", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72029"}, {"id": "source", "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]}, {"uuid": "4974c0db-04af-472f-a69e-78bc275e7d1b", "vulnerability": {"vulnId": "CVE-2026-67276", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "4974c0db-04af-472f-a69e-78bc275e7d1b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-05T00:00:00+00:00", "recorded_at": "2026-09-05T22:00:01+00:00", "first_seen_at": "2026-09-05T00:00:00+00:00"}, "scope": {"notes": "MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-347 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-347"], "euvd": "EUVD-2026-72024", "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "RouterOS", "dateReported": "2026/09/05", "originSource": "CERT.PL", "patchedSince": "2026/09/03", "vendorProject": "MikroTik", "exploitationType": ["unknown"], "vulnerabilityName": "MikroTrick", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-67276", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67276"}, {"id": "EUVD-2026-72024", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72024"}, {"id": "source", "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]}, {"uuid": "1d9ea784-c941-41ec-aa5f-c1cb172bcb68", "vulnerability": {"vulnId": "CVE-2026-67277", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "1d9ea784-c941-41ec-aa5f-c1cb172bcb68"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-05T00:00:00+00:00", "recorded_at": "2026-09-05T22:00:01+00:00", "first_seen_at": "2026-09-05T00:00:00+00:00"}, "scope": {"notes": "MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS accepts a 'related' btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With 'random-data=false', the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-306 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-306"], "euvd": "EUVD-2026-72025", "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "RouterOS", "dateReported": "2026/09/05", "originSource": "CERT.PL", "patchedSince": "2026/09/03", "vendorProject": "MikroTik", "exploitationType": ["unknown"], "vulnerabilityName": "MikroTrick", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-67277", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67277"}, {"id": "EUVD-2026-72025", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72025"}, {"id": "source", "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}]}, {"uuid": "0b423154-e35d-4d55-b4c1-d539e76167da", "vulnerability": {"vulnId": "CVE-2025-60698", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0b423154-e35d-4d55-b4c1-d539e76167da"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-05T00:00:00+00:00", "recorded_at": "2026-09-06T11:00:01+00:00", "first_seen_at": "2026-09-05T00:00:00+00:00"}, "scope": {"notes": "A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The... | Affected: D-Link / DIR-882 Router | CVSS: 7.3 (HIGH) | EPSS: 0.03929 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The...", "vendor": "D-Link", "product": "DIR-882 Router", "added_date": "2026-09-05T00:00:00.000Z", "cvss_score": 7.3, "epss_score": 0.03929, "cvss_severity": "HIGH", "epss_percentile": 0.89693, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-60698", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60698"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-60698"}]}, {"uuid": "3728a227-1873-4466-9e2b-f17600951034", "vulnerability": {"vulnId": "CVE-2026-9586", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "3728a227-1873-4466-9e2b-f17600951034"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-09-04T20:34:27+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-04T20:34:27+00:00"}, "scope": {"notes": "Affected: Sangoma / Sangoma Switchvox | Class: voip | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Sangoma", "30d_avg": 0, "90d_avg": 0, "product": "Sangoma Switchvox", "cisa_kev": "no", "connections": 2, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-9586", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9586"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "9ca79fa9-7df5-424d-9576-bf58d5f74196", "vulnerability": {"vulnId": "CVE-2019-10655", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "9ca79fa9-7df5-424d-9576-bf58d5f74196"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-09-04T19:37:32+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-04T19:37:32+00:00"}, "scope": {"notes": "Affected: Grandstream / GXV3240/GXP2200 | Class: voip | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Grandstream", "30d_avg": 0, "90d_avg": 0, "product": "GXV3240/GXP2200", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-10655", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10655"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c59f5e6e-9bb1-40f4-84c7-3619b7b61f71", "vulnerability": {"vulnId": "CVE-2026-58457", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c59f5e6e-9bb1-40f4-84c7-3619b7b61f71"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T15:31:49+00:00"}, "timestamps": {"asserted_at": "2026-09-04T15:31:49+00:00", "recorded_at": "2026-09-05T16:00:02+00:00", "first_seen_at": "2026-09-04T15:31:49+00:00"}, "scope": {"notes": "Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp | Affected: Shenzhen Aitemi E Commerce / M300 Wi-Fi Repeater | CVSS: 9.3 (CRITICAL) | EPSS: 0.02939 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp", "vendor": "Shenzhen Aitemi E Commerce", "product": "M300 Wi-Fi Repeater", "added_date": "2026-09-04T15:31:49.181Z", "cvss_score": 9.3, "epss_score": 0.02939, "cvss_severity": "CRITICAL", "epss_percentile": 0.86185, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-58457", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58457"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-58457"}]}, {"uuid": "2c41abe6-6af3-4176-9784-e7ef20f86a57", "vulnerability": {"vulnId": "CVE-2026-14894", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2c41abe6-6af3-4176-9784-e7ef20f86a57"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T11:40:31+00:00"}, "timestamps": {"asserted_at": "2026-09-04T11:40:31+00:00", "recorded_at": "2026-09-05T12:00:01+00:00", "first_seen_at": "2026-09-04T11:40:31+00:00"}, "scope": {"notes": "Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) | Affected: WebRehab / Super Forms \u2013 Drag & Drop Form Builder | CVSS: 9.8 (CRITICAL) | EPSS: 0.05265 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)", "vendor": "WebRehab", "product": "Super Forms \u2013 Drag & Drop Form Builder", "added_date": "2026-09-04T11:40:31.759Z", "cvss_score": 9.8, "epss_score": 0.05265, "cvss_severity": "CRITICAL", "epss_percentile": 0.91997, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-14894", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14894"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-14894"}]}, {"uuid": "715cfc4a-3c8b-423f-a55b-e36c58140446", "vulnerability": {"vulnId": "CVE-2026-85046", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "715cfc4a-3c8b-423f-a55b-e36c58140446"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T07:18:47+00:00"}, "timestamps": {"asserted_at": "2026-09-04T07:18:47+00:00", "recorded_at": "2026-09-05T08:00:01+00:00", "first_seen_at": "2026-09-04T07:18:47+00:00"}, "scope": {"notes": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted... | Affected: Google / Chrome | CVSS: 8.8 (HIGH) | EPSS: 0.00462 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted...", "vendor": "Google", "product": "Chrome", "added_date": "2026-09-04T07:18:47.000Z", "cvss_score": 8.8, "epss_score": 0.00462, "cvss_severity": "HIGH", "epss_percentile": 0.38423, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "hour", "count": 10}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-85046", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85046"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-85046"}]}, {"uuid": "e5d32dc7-385f-4984-8323-22b146ed898b", "vulnerability": {"vulnId": "CVE-2019-10655", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e5d32dc7-385f-4984-8323-22b146ed898b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-04T00:00:00+00:00", "recorded_at": "2026-09-05T11:00:01+00:00", "first_seen_at": "2026-09-04T00:00:00+00:00"}, "scope": {"notes": "Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow... | Affected: Grandstream / GAC2500 | CVSS: 9.8 (CRITICAL) | EPSS: 0.15475 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow...", "vendor": "Grandstream", "product": "GAC2500", "added_date": "2026-09-04T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.15475, "cvss_severity": "CRITICAL", "epss_percentile": 0.96564, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2019-10655", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10655"}, {"id": "previdian", "url": "https://previdian.com/CVE-2019-10655"}]}, {"uuid": "6c7e1d1a-bf91-46a3-992d-50caf3208c7a", "vulnerability": {"vulnId": "CVE-2026-85046", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "6c7e1d1a-bf91-46a3-992d-50caf3208c7a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-04T00:00:00+00:00", "recorded_at": "2026-09-04T18:00:01+00:00", "first_seen_at": "2026-09-04T00:00:00+00:00"}, "scope": {"notes": "Google Chromium V8 Type Confusion Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85046"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-843"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Chromium V8", "due_date": "2026-09-18", "date_added": "2026-09-04", "vendorProject": "Google", "vulnerabilityName": "Google Chromium V8 Type Confusion Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-85046", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046"}]}, {"uuid": "d2a96374-0326-48a3-8d7d-ad148aa72408", "vulnerability": {"vulnId": "CVE-2026-19490", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d2a96374-0326-48a3-8d7d-ad148aa72408"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-03T11:43:49+00:00"}, "timestamps": {"asserted_at": "2026-09-03T11:43:49+00:00", "recorded_at": "2026-09-04T12:00:01+00:00", "first_seen_at": "2026-09-03T11:43:49+00:00"}, "scope": {"notes": "NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 | Affected: NetScaler / ADC, Gateway | CVSS: 9.3 (CRITICAL) | EPSS: 0.03372 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490", "vendor": "NetScaler", "product": "ADC, Gateway", "added_date": "2026-09-03T11:43:49.815Z", "cvss_score": 9.3, "epss_score": 0.03372, "cvss_severity": "CRITICAL", "epss_percentile": 0.87926, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-19490", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19490"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-19490"}]}, {"uuid": "f52c9ba0-0237-473d-a3ab-91e318fdbf87", "vulnerability": {"vulnId": "CVE-2021-44228", "altId": []}, "gcve": {"origin_uuid": "1a89b78e-f703-45f3-bb86-59eb712668bd", "gna": 1, "object_uuid": "f52c9ba0-0237-473d-a3ab-91e318fdbf87"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-06-03T09:49:45+00:00"}, "characteristics": {"local_access_required": false, "remote_code_execution": true, "authentication_required": false}, "timestamps": {"asserted_at": "2026-09-03T09:49:45+00:00", "last_seen_at": "2026-09-03T09:49:45+00:00", "first_seen_at": "2026-09-03T09:49:45+00:00"}, "evidence": []}, {"uuid": "d4117ee6-f48c-4831-98ef-068fc12340f1", "vulnerability": {"vulnId": "CVE-2014-3704", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d4117ee6-f48c-4831-98ef-068fc12340f1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-03T06:41:00+00:00"}, "timestamps": {"asserted_at": "2026-09-03T06:41:00+00:00", "recorded_at": "2026-09-04T07:00:01+00:00", "first_seen_at": "2026-09-03T06:41:00+00:00"}, "scope": {"notes": "The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which... | Affected: Drupal / Drupal | CVSS: 7.5 (HIGH) | EPSS: 0.99974 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which...", "vendor": "Drupal", "product": "Drupal", "added_date": "2026-09-03T06:41:00.665Z", "cvss_score": 7.5, "epss_score": 0.99974, "cvss_severity": "HIGH", "epss_percentile": 0.99977, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2014-3704", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3704"}, {"id": "previdian", "url": "https://previdian.com/CVE-2014-3704"}]}, {"uuid": "e8759eae-7c56-40c5-a594-d6c77d172beb", "vulnerability": {"vulnId": "CVE-2026-49869", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e8759eae-7c56-40c5-a594-d6c77d172beb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T17:31:03+00:00"}, "timestamps": {"asserted_at": "2026-09-02T17:31:03+00:00", "recorded_at": "2026-09-03T18:00:01+00:00", "first_seen_at": "2026-09-02T17:31:03+00:00"}, "scope": {"notes": "Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` | Affected: Kestra-io / kestra | CVSS: 10.0 (CRITICAL) | EPSS: 0.00991 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`", "vendor": "Kestra-io", "product": "kestra", "added_date": "2026-09-02T17:31:03.121Z", "cvss_score": 10.0, "epss_score": 0.00991, "cvss_severity": "CRITICAL", "epss_percentile": 0.60153, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-49869", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49869"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-49869"}]}, {"uuid": "0ae77e06-8eea-4b3c-935d-a00f99b05c75", "vulnerability": {"vulnId": "CVE-2026-48710", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0ae77e06-8eea-4b3c-935d-a00f99b05c75"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T17:31:02+00:00"}, "timestamps": {"asserted_at": "2026-09-02T17:31:02+00:00", "recorded_at": "2026-09-03T18:00:01+00:00", "first_seen_at": "2026-09-02T17:31:02+00:00"}, "scope": {"notes": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks | Affected: Kludex / starlette | CVSS: 6.5 (MEDIUM) | EPSS: 0.02099 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks", "vendor": "Kludex", "product": "starlette", "added_date": "2026-09-02T17:31:02.748Z", "cvss_score": 6.5, "epss_score": 0.02099, "cvss_severity": "MEDIUM", "epss_percentile": 0.80418, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-48710", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-48710"}]}, {"uuid": "1cb21f7a-02be-413e-88ea-fb6775aeabde", "vulnerability": {"vulnId": "CVE-2026-59822", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "1cb21f7a-02be-413e-88ea-fb6775aeabde"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T17:31:01+00:00"}, "timestamps": {"asserted_at": "2026-09-02T17:31:01+00:00", "recorded_at": "2026-09-03T18:00:01+00:00", "first_seen_at": "2026-09-02T17:31:01+00:00"}, "scope": {"notes": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | Affected: BerriAI / litellm | CVSS: 8.8 (HIGH) | EPSS: 0.00516 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback", "vendor": "BerriAI", "product": "litellm", "added_date": "2026-09-02T17:31:01.269Z", "cvss_score": 8.8, "epss_score": 0.00516, "cvss_severity": "HIGH", "epss_percentile": 0.41918, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-59822", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59822"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-59822"}]}, {"uuid": "54cbf441-e9c4-4a27-813b-08ea31a6bd16", "vulnerability": {"vulnId": "CVE-2026-32475", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "54cbf441-e9c4-4a27-813b-08ea31a6bd16"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T15:07:36+00:00"}, "timestamps": {"asserted_at": "2026-09-02T15:07:36+00:00", "recorded_at": "2026-09-03T16:00:01+00:00", "first_seen_at": "2026-09-02T15:07:36+00:00"}, "scope": {"notes": "WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability | Affected: Elementor / Elementor Pro | CVSS: 9.0 (CRITICAL) | EPSS: 0.02374 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability", "vendor": "Elementor", "product": "Elementor Pro", "added_date": "2026-09-02T15:07:36.000Z", "cvss_score": 9.0, "epss_score": 0.02374, "cvss_severity": "CRITICAL", "epss_percentile": 0.82711, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-32475", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32475"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-32475"}]}, {"uuid": "fd4012f9-6a61-4a70-ae94-10a548c0536f", "vulnerability": {"vulnId": "CVE-2026-82329", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "fd4012f9-6a61-4a70-ae94-10a548c0536f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-02T18:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "JFrog Artifactory Improper Authentication Vulnerability | Affected: JFrog / Artifactory | Description: JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.  | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-05 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-287"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Artifactory", "due_date": "2026-09-05", "date_added": "2026-09-02", "vendorProject": "JFrog", "vulnerabilityName": "JFrog Artifactory Improper Authentication Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-82329", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329"}]}, {"uuid": "c35b7361-b19f-4856-b966-3809c4a93ad6", "vulnerability": {"vulnId": "CVE-2026-49869", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "c35b7361-b19f-4856-b966-3809c4a93ad6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-02T18:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "Kestra OSS OS Command Injection Vulnerability | Affected: Kestra / Kestra OSS | Description: Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-05 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-78", "CWE-184", "CWE-287", "CWE-918"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Kestra OSS", "due_date": "2026-09-05", "date_added": "2026-09-02", "vendorProject": "Kestra", "vulnerabilityName": "Kestra OSS OS Command Injection Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-49869", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869"}]}, {"uuid": "b4b52e5f-1b26-464a-ae40-bf8709145368", "vulnerability": {"vulnId": "CVE-2026-9586", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "b4b52e5f-1b26-464a-ae40-bf8709145368"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-02T18:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "Sangoma Switchvox SQL Injection Vulnerability | Affected: Sangoma / Switchvox | Description: Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-05 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-89"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Switchvox", "due_date": "2026-09-05", "date_added": "2026-09-02", "vendorProject": "Sangoma", "vulnerabilityName": "Sangoma Switchvox SQL Injection Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-9586", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586"}]}, {"uuid": "b2e0c044-08c5-41bb-baab-bb5cd2619d20", "vulnerability": {"vulnId": "CVE-2026-59822", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "b2e0c044-08c5-41bb-baab-bb5cd2619d20"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-02T18:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "BerriAI LiteLLM Improper Authentication Vulnerability | Affected: BerriAI / LiteLLM | Description: BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-287", "CWE-306"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "LiteLLM", "due_date": "2026-09-16", "date_added": "2026-09-02", "vendorProject": "BerriAI", "vulnerabilityName": "BerriAI LiteLLM Improper Authentication Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-59822", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822"}]}, {"uuid": "87f4e206-8c3a-4734-a0b3-0cb2874ce257", "vulnerability": {"vulnId": "CVE-2026-48710", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "87f4e206-8c3a-4734-a0b3-0cb2874ce257"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-02T18:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "Kludex Starlette HTTP Request/Response Smuggling Vulnerability | Affected: Kludex / Starlette | Description: Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL\u2019s path. This vulnerability could be chaned with CVE-2026-42271. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-444"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Starlette", "due_date": "2026-09-16", "date_added": "2026-09-02", "vendorProject": "Kludex", "vulnerabilityName": "Kludex Starlette HTTP Request/Response Smuggling Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-48710", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710"}]}, {"uuid": "6cbe7f45-6ec1-4ccf-a3fb-f7c2c79d294c", "vulnerability": {"vulnId": "CVE-2026-58400", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "6cbe7f45-6ec1-4ccf-a3fb-f7c2c79d294c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-04T07:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "Affected: geonetwork / core-geonetwork | Description: Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter. | Patched since: 2026/07/08 | Exploitation type: unknown | CWEs: CWE-94, CWE-470 | Origin source: CNW | Notes: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-94", "CWE-470"], "euvd": "EUVD-2026-70645", "notes": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "core-geonetwork", "dateReported": "2026/09/02", "originSource": "CNW", "patchedSince": "2026/07/08", "vendorProject": "geonetwork", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-58400", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58400"}, {"id": "EUVD-2026-70645", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70645"}, {"id": "source", "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r"}]}, {"uuid": "4e6e0a66-af53-4db2-a33d-fab986c2c116", "vulnerability": {"vulnId": "CVE-2026-63219", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "4e6e0a66-af53-4db2-a33d-fab986c2c116"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-04T07:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "Affected: geonetwork / core-geonetwork | Description: Unauthenticated file upload via missing authorization on formatter upload endpoint. | Patched since: 2026/07/08 | Exploitation type: unknown | CWEs: CWE-862 | Origin source: CNW | Notes: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-862"], "euvd": "EUVD-2026-70647", "notes": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "core-geonetwork", "dateReported": "2026/09/02", "originSource": "CNW", "patchedSince": "2026/07/08", "vendorProject": "geonetwork", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-63219", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63219"}, {"id": "EUVD-2026-70647", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70647"}, {"id": "source", "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42"}]}, {"uuid": "300a00f0-a093-48eb-a8c6-db9f1e6680bf", "vulnerability": {"vulnId": "CVE-2026-83548", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "300a00f0-a093-48eb-a8c6-db9f1e6680bf"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-02T18:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | Affected: SonicWall / SMA1000 Appliances | Description: SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-05 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-918", "CWE-441"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "SMA1000 Appliances", "due_date": "2026-09-05", "date_added": "2026-09-02", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-83548", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548"}]}, {"uuid": "106b930f-4683-4444-9294-4ecc2e72b435", "vulnerability": {"vulnId": "CVE-2026-83549", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "106b930f-4683-4444-9294-4ecc2e72b435"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-02T00:00:00+00:00", "recorded_at": "2026-09-02T18:00:01+00:00", "first_seen_at": "2026-09-02T00:00:00+00:00"}, "scope": {"notes": "SonicWall SMA1000 Appliances OS Command Injection Vulnerability | Affected: SonicWall / SMA1000 Appliances | Description: SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-05 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-78"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "SMA1000 Appliances", "due_date": "2026-09-05", "date_added": "2026-09-02", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances OS Command Injection Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-83549", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549"}]}, {"uuid": "ce52882c-0d61-41c3-9434-ec6938f4d139", "vulnerability": {"vulnId": "CVE-2023-54391", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ce52882c-0d61-41c3-9434-ec6938f4d139"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-01T20:57:00+00:00"}, "timestamps": {"asserted_at": "2026-09-01T20:57:00+00:00", "recorded_at": "2026-09-02T21:00:01+00:00", "first_seen_at": "2026-09-01T20:57:00+00:00"}, "scope": {"notes": "Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter | Affected: Proxmox Server Solutions / Proxmox Virtual Environment (VE) | CVSS: 9.3 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter", "vendor": "Proxmox Server Solutions", "product": "Proxmox Virtual Environment (VE)", "added_date": "2026-09-01T20:57:00.000Z", "cvss_score": 9.3, "epss_score": null, "cvss_severity": "CRITICAL", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-54391", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54391"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-54391"}]}, {"uuid": "6701a3fe-0836-46a0-9862-641aaddec085", "vulnerability": {"vulnId": "CVE-2026-83549", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "6701a3fe-0836-46a0-9862-641aaddec085"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-01T20:21:00+00:00"}, "timestamps": {"asserted_at": "2026-09-01T20:21:00+00:00", "recorded_at": "2026-09-02T21:00:01+00:00", "first_seen_at": "2026-09-01T20:21:00+00:00"}, "scope": {"notes": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in... | Affected: SonicWall / SMA1000 | CVSS: 7.8 (HIGH) | EPSS: 0.00917 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in...", "vendor": "SonicWall", "product": "SMA1000", "added_date": "2026-09-01T20:21:00.000Z", "cvss_score": 7.8, "epss_score": 0.00917, "cvss_severity": "HIGH", "epss_percentile": 0.57798, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "hour", "count": 21}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-83549", "url": "https://www.cve.org/CVERecord?id=CVE-2026-83549"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-83549"}]}, {"uuid": "eac69f1f-e80f-47d4-8cd2-0b7faaf47fdf", "vulnerability": {"vulnId": "CVE-2026-83548", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "eac69f1f-e80f-47d4-8cd2-0b7faaf47fdf"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-01T20:19:00+00:00"}, "timestamps": {"asserted_at": "2026-09-01T20:19:00+00:00", "recorded_at": "2026-09-02T21:00:01+00:00", "first_seen_at": "2026-09-01T20:19:00+00:00"}, "scope": {"notes": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote... | Affected: SonicWall / SMA1000 | CVSS: 10.0 (CRITICAL) | EPSS: 0.00266 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote...", "vendor": "SonicWall", "product": "SMA1000", "added_date": "2026-09-01T20:19:00.000Z", "cvss_score": 10.0, "epss_score": 0.00266, "cvss_severity": "CRITICAL", "epss_percentile": 0.18174, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "hour", "count": 21}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-83548", "url": "https://www.cve.org/CVERecord?id=CVE-2026-83548"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-83548"}]}, {"uuid": "821aef61-1ba1-42d3-a1a7-13399ed7eaa1", "vulnerability": {"vulnId": "CVE-2026-1547", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "821aef61-1ba1-42d3-a1a7-13399ed7eaa1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-09-01T16:27:16+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-01T16:27:16+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A7000R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A7000R", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-1547", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1547"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "5aca7a60-f1ea-45ea-bde1-cd1589f19d67", "vulnerability": {"vulnId": "CVE-2025-60702", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "5aca7a60-f1ea-45ea-bde1-cd1589f19d67"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2026-09-01T16:27:15+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-01T16:27:15+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A950RG | Class: router | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A950RG", "cisa_kev": "no", "connections": 4, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}], "references": [{"id": "CVE-2025-60702", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60702"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "da338150-f2de-40d4-b0bb-4a8c7870a47d", "vulnerability": {"vulnId": "CVE-2026-78141", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "da338150-f2de-40d4-b0bb-4a8c7870a47d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 74}, "timestamps": {"asserted_at": "2026-09-01T16:27:10+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-01T16:27:10+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda CH22 | Class: router | Severity: High (CVSS 7.4) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda CH22", "cisa_kev": "no", "connections": 4, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 7.4, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-78141", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78141"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "39d58eaa-94ed-4cf5-a009-17b4bf73f021", "vulnerability": {"vulnId": "CVE-2026-0257", "altId": []}, "gcve": {"origin_uuid": "1a89b78e-f703-45f3-bb86-59eb712668bd", "gna": 1, "object_uuid": "39d58eaa-94ed-4cf5-a009-17b4bf73f021"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-01T15:43:46+00:00"}, "characteristics": {"severity": 100.0, "local_access_required": false, "remote_code_execution": true, "authentication_required": false}, "timestamps": {"asserted_at": "2026-09-01T15:43:46+00:00", "last_seen_at": "2026-09-01T15:43:46+00:00", "first_seen_at": "2026-09-01T15:43:46+00:00"}, "evidence": [{"type": "incident_response", "source": "CIRCL incident response", "signal": "confirmed_compromise", "details": {"note": "Ransomware case."}}]}, {"uuid": "cc91554a-e029-4319-90ea-c2f22563c4c8", "vulnerability": {"vulnId": "CVE-2026-5153", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "cc91554a-e029-4319-90ea-c2f22563c4c8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-09-01T15:42:51+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-01T15:42:51+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda CH22 | Class: router | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda CH22", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-5153", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5153"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2684ce79-c02a-4032-8a2c-adcdb14b3dec", "vulnerability": {"vulnId": "CVE-2025-40553", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2684ce79-c02a-4032-8a2c-adcdb14b3dec"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-01T12:15:41+00:00"}, "timestamps": {"asserted_at": "2026-09-01T12:15:41+00:00", "recorded_at": "2026-09-02T13:00:02+00:00", "first_seen_at": "2026-09-01T12:15:41+00:00"}, "scope": {"notes": "SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | Affected: SolarWinds / Web Help Desk | CVSS: 9.8 (CRITICAL) | EPSS: 0.6039 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability", "vendor": "SolarWinds", "product": "Web Help Desk", "added_date": "2026-09-01T12:15:41.982Z", "cvss_score": 9.8, "epss_score": 0.6039, "cvss_severity": "CRITICAL", "epss_percentile": 0.99076, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-40553", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40553"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-40553"}]}]}