{"metadata": {"count": 6472, "page": 1, "per_page": 100}, "data": [{"uuid": "4bd80451-6654-4d59-80ba-d7db2841159d", "vulnerability": {"vulnId": "CVE-2026-107441", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "4bd80451-6654-4d59-80ba-d7db2841159d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-04T11:48:00+00:00"}, "timestamps": {"asserted_at": "2026-11-04T11:48:00+00:00", "recorded_at": "2026-11-05T12:00:01+00:00", "first_seen_at": "2026-11-04T11:48:00+00:00"}, "scope": {"notes": "An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated... | Affected: Zyxel / GS1900-24E firmware, GS1900-8 firmware, GS1900-8HP firmware, GS1900-10HP firmware, GS1900-16 firmware, GS1900-24 firmware, GS1900-24EP firmware, GS1900-HPv2 firmware, GS1900-48 firmware, GS1900-48HPv2 firmware | CVSS: 8.8 (HIGH) | EPSS: 0.00293 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated...", "cve_id": "CVE-2026-107441", "vendor": "Zyxel", "ghsa_id": null, "product": "GS1900-24E firmware, GS1900-8 firmware, GS1900-8HP firmware, GS1900-10HP firmware, GS1900-16 firmware, GS1900-24 firmware, GS1900-24EP firmware, GS1900-HPv2 firmware, GS1900-48 firmware, GS1900-48HPv2 firmware", "added_date": "2026-11-04T11:48:00.000Z", "cvss_score": 8.8, "epss_score": 0.00293, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.22027, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-107441", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-107441", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107441"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-107441"}]}, {"uuid": "a8307961-699b-452f-87dc-9ad274e99816", "vulnerability": {"vulnId": "CVE-2024-27834", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "a8307961-699b-452f-87dc-9ad274e99816"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-04T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-11-04T00:00:00+00:00", "recorded_at": "2026-11-04T21:00:01+00:00", "first_seen_at": "2026-11-04T00:00:00+00:00"}, "scope": {"notes": "Apple Multiple Products Improper Authentication Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/120896 ; https://support.apple.com/en-us/120898 ; https://support.apple.com/en-us/120901 ; https://support.apple.com/en-us/120902 ; https://support.apple.com/en-us/120903 ; https://support.apple.com/en-us/120905 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2024-27834"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-287"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Multiple Products", "due_date": "2026-11-18", "date_added": "2026-11-04", "vendorProject": "Apple", "vulnerabilityName": "Apple Multiple Products Improper Authentication Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2024-27834", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27834"}]}, {"uuid": "90c7ad23-e226-4bc1-8a56-58152d88bf02", "vulnerability": {"vulnId": "CVE-2019-17538", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "90c7ad23-e226-4bc1-8a56-58152d88bf02"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T22:53:10+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-11-03T22:53:10+00:00", "recorded_at": "2026-11-05T01:00:01+00:00", "last_seen_at": "2026-11-03T22:53:10+00:00", "first_seen_at": "2026-11-03T22:53:10+00:00"}, "scope": {"notes": "Affected: Jnoj / Jiangnan Online Judge | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-03: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Jnoj", "30d_avg": 0, "90d_avg": 0, "product": "Jiangnan Online Judge", "cisa_kev": "no", "connections": 5, "observation_date": "2026-11-03", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2019-17538", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17538"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "7aa56889-7d6d-46a8-9273-9ad6a0850be4", "vulnerability": {"vulnId": "CVE-2026-112313", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7aa56889-7d6d-46a8-9273-9ad6a0850be4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T15:30:32+00:00"}, "timestamps": {"asserted_at": "2026-11-03T15:30:32+00:00", "recorded_at": "2026-11-04T13:22:08+00:00", "first_seen_at": "2026-11-03T15:30:32+00:00"}, "scope": {"notes": "WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability | Affected: ACF Extended / ACF Extended | CVSS: 7.1 (HIGH) | EPSS: 0.0019 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability", "cve_id": "CVE-2026-112313", "vendor": "ACF Extended", "ghsa_id": null, "product": "ACF Extended", "added_date": "2026-11-03T15:30:32.939Z", "cvss_score": 7.1, "epss_score": 0.0019, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.08722, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-112313", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-112313", "url": "https://www.cve.org/CVERecord?id=CVE-2026-112313"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-112313"}]}, {"uuid": "da855938-98bb-4e7c-91f7-246d5a15b6f5", "vulnerability": {"vulnId": "CVE-2026-102764", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "da855938-98bb-4e7c-91f7-246d5a15b6f5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T11:56:47+00:00"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-11-03T11:56:47+00:00", "recorded_at": "2026-11-05T01:00:01+00:00", "last_seen_at": "2026-11-03T11:56:47+00:00", "first_seen_at": "2026-11-03T11:56:47+00:00"}, "scope": {"notes": "Affected: BeyondTrust / Remote Support | Class: remote-access | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-11-03: 33", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "11", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "remote-access", "7d_avg": 1, "vendor": "BeyondTrust", "30d_avg": 0, "90d_avg": 0, "product": "Remote Support", "cisa_kev": "yes", "connections": 33, "observation_date": "2026-11-03", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-102764", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102764"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c13a62e7-9000-4684-8c6d-c387aa83475a", "vulnerability": {"vulnId": "CVE-2026-4035", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c13a62e7-9000-4684-8c6d-c387aa83475a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T09:11:07+00:00"}, "timestamps": {"asserted_at": "2026-11-03T09:11:07+00:00", "recorded_at": "2026-11-04T10:00:01+00:00", "first_seen_at": "2026-11-03T09:11:07+00:00"}, "scope": {"notes": "Environment Variable Resolution Vulnerability in mlflow/mlflow | Affected: Mlflow / mlflow/mlflow | CVSS: 7.7 (HIGH) | EPSS: 0.00521 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Environment Variable Resolution Vulnerability in mlflow/mlflow", "cve_id": "CVE-2026-4035", "vendor": "Mlflow", "ghsa_id": null, "product": "mlflow/mlflow", "added_date": "2026-11-03T09:11:07.347Z", "cvss_score": 7.7, "epss_score": 0.00521, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.44283, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-4035", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-4035", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4035"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-4035"}]}, {"uuid": "6db5dbcd-874a-4c5f-8958-b5f45b0967bf", "vulnerability": {"vulnId": "CVE-2026-81648", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "6db5dbcd-874a-4c5f-8958-b5f45b0967bf"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T08:11:52+00:00"}, "timestamps": {"asserted_at": "2026-11-03T08:11:52+00:00", "recorded_at": "2026-11-04T09:00:01+00:00", "first_seen_at": "2026-11-03T08:11:52+00:00"}, "scope": {"notes": "CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router | Affected: CryptoPayment Gateway / CryptoPayment Gateway | CVSS: 10.0 (CRITICAL) | EPSS: 0.00502 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router", "cve_id": "CVE-2026-81648", "vendor": "CryptoPayment Gateway", "ghsa_id": "GHSA-9R3Q-6QW8-8PM7", "product": "CryptoPayment Gateway", "added_date": "2026-11-03T08:11:52.574Z", "cvss_score": 10.0, "epss_score": 0.00502, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.43043, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-81648", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-81648", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81648"}, {"id": "GHSA-9R3Q-6QW8-8PM7", "url": "https://github.com/advisories/GHSA-9R3Q-6QW8-8PM7"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-81648"}]}, {"uuid": "73504b63-4d46-46b7-86ac-681210ae8220", "vulnerability": {"vulnId": "CVE-2026-58115", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "73504b63-4d46-46b7-86ac-681210ae8220"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T08:11:27+00:00"}, "timestamps": {"asserted_at": "2026-11-03T08:11:27+00:00", "recorded_at": "2026-11-04T19:00:01+00:00", "first_seen_at": "2026-11-03T08:11:27+00:00"}, "scope": {"notes": "A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED... | Affected: Siemens / SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) | CVSS: 10.0 (CRITICAL) | EPSS: 0.0089 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED...", "cve_id": "CVE-2026-58115", "vendor": "Siemens", "ghsa_id": "GHSA-MMH6-F99Q-64FH", "product": "SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2), SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2), SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2)", "added_date": "2026-11-03T08:11:27.490Z", "cvss_score": 10.0, "epss_score": 0.0089, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.59407, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-58115", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-58115", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58115"}, {"id": "GHSA-MMH6-F99Q-64FH", "url": "https://github.com/advisories/GHSA-MMH6-F99Q-64FH"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-58115"}]}, {"uuid": "e853bd92-4e83-4b31-a830-0930f4bde026", "vulnerability": {"vulnId": "CVE-2026-119977", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "e853bd92-4e83-4b31-a830-0930f4bde026"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-11-03T00:00:00+00:00", "recorded_at": "2026-11-03T21:00:01+00:00", "first_seen_at": "2026-11-03T00:00:00+00:00"}, "scope": {"notes": "WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | Affected: WordPress / WordPress Core | Description: WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://wordpress.org/news/2026/10/wordpress-7-1-4 ; https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-119977"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-367"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "WordPress Core", "due_date": "2026-11-06", "date_added": "2026-11-03", "vendorProject": "WordPress", "vulnerabilityName": "WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-119977", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-119977"}]}, {"uuid": "6de87cdf-659d-42e2-8f63-c488e14c4ec5", "vulnerability": {"vulnId": "CVE-2026-81799", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "6de87cdf-659d-42e2-8f63-c488e14c4ec5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-02T07:01:06+00:00"}, "timestamps": {"asserted_at": "2026-11-02T07:01:06+00:00", "recorded_at": "2026-11-03T08:00:01+00:00", "first_seen_at": "2026-11-02T07:01:06+00:00"}, "scope": {"notes": "WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability | Affected: WP Swings / Return Refund and Exchange For WooCommerce | CVSS: 7.5 (HIGH) | EPSS: 0.00346 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability", "cve_id": "CVE-2026-81799", "vendor": "WP Swings", "ghsa_id": "GHSA-W59F-G372-95CG", "product": "Return Refund and Exchange For WooCommerce", "added_date": "2026-11-02T07:01:06.649Z", "cvss_score": 7.5, "epss_score": 0.00346, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.28238, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-81799", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-81799", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81799"}, {"id": "GHSA-W59F-G372-95CG", "url": "https://github.com/advisories/GHSA-W59F-G372-95CG"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-81799"}]}, {"uuid": "3fbc254c-f01f-49e7-9b9a-53e009b94ef1", "vulnerability": {"vulnId": "CVE-2026-28160", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3fbc254c-f01f-49e7-9b9a-53e009b94ef1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-02T06:50:25+00:00"}, "timestamps": {"asserted_at": "2026-11-02T06:50:25+00:00", "recorded_at": "2026-11-03T07:00:01+00:00", "first_seen_at": "2026-11-02T06:50:25+00:00"}, "scope": {"notes": "WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability | Affected: e4jvikwp / VikRentCar | CVSS: 7.1 (HIGH) | EPSS: 0.00228 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability", "cve_id": "CVE-2026-28160", "vendor": "e4jvikwp", "ghsa_id": null, "product": "VikRentCar", "added_date": "2026-11-02T06:50:25.874Z", "cvss_score": 7.1, "epss_score": 0.00228, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.13649, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-28160", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-28160", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28160"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-28160"}]}, {"uuid": "2e25573d-3963-4c28-9df1-09f7aaf31259", "vulnerability": {"vulnId": "CVE-2021-24472", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "2e25573d-3963-4c28-9df1-09f7aaf31259"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-02T03:13:11+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-11-02T03:13:11+00:00", "recorded_at": "2026-11-04T01:00:02+00:00", "last_seen_at": "2026-11-02T03:13:11+00:00", "first_seen_at": "2026-11-02T03:13:11+00:00"}, "scope": {"notes": "Affected: Onair2 / Onair2 WordPress Plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-02: 6", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Onair2", "30d_avg": 0, "90d_avg": 0, "product": "Onair2 WordPress Plugin", "cisa_kev": "no", "connections": 6, "observation_date": "2026-11-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-24472", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24472"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "fb07e122-b5b6-44e6-9e33-0d5fe05fff66", "vulnerability": {"vulnId": "CVE-2026-39738", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "fb07e122-b5b6-44e6-9e33-0d5fe05fff66"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T10:40:28+00:00"}, "timestamps": {"asserted_at": "2026-11-01T10:40:28+00:00", "recorded_at": "2026-11-02T11:00:01+00:00", "first_seen_at": "2026-11-01T10:40:28+00:00"}, "scope": {"notes": "WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability | Affected: Aman / FunnelKit Automations | CVSS: 9.8 (CRITICAL) | EPSS: 0.00408 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability", "cve_id": "CVE-2026-39738", "vendor": "Aman", "ghsa_id": null, "product": "FunnelKit Automations", "added_date": "2026-11-01T10:40:28.232Z", "cvss_score": 9.8, "epss_score": 0.00408, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.35069, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-39738", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-39738", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39738"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-39738"}]}, {"uuid": "d94c4193-4331-4ac0-bce9-48e7bbc35080", "vulnerability": {"vulnId": "CVE-2019-9618", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "d94c4193-4331-4ac0-bce9-48e7bbc35080"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T09:07:22+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-11-01T09:07:22+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T09:07:22+00:00", "first_seen_at": "2026-11-01T09:07:22+00:00"}, "scope": {"notes": "Affected: GraceMedia Media Player / GraceMedia Media Player WordPress Plugin | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GraceMedia Media Player", "30d_avg": 0, "90d_avg": 0, "product": "GraceMedia Media Player WordPress Plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-9618", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9618"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "50342896-0146-4e65-aff6-abec9f16a05e", "vulnerability": {"vulnId": "CVE-2018-9118", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "50342896-0146-4e65-aff6-abec9f16a05e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T08:31:34+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-11-01T08:31:34+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T08:31:34+00:00", "first_seen_at": "2026-11-01T08:31:34+00:00"}, "scope": {"notes": "Affected: DraftPress  / WP Background Takeover Advertisements WordPress Plugin | Class: web-server | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "DraftPress ", "30d_avg": 0, "90d_avg": 0, "product": "WP Background Takeover Advertisements WordPress Plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2018-9118", "url": "https://www.cve.org/CVERecord?id=CVE-2018-9118"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b0a36081-44f5-4773-ad17-9ba6330b58ce", "vulnerability": {"vulnId": "CVE-2016-10924", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b0a36081-44f5-4773-ad17-9ba6330b58ce"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T07:58:35+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-11-01T07:58:35+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T07:58:35+00:00", "first_seen_at": "2026-11-01T07:58:35+00:00"}, "scope": {"notes": "Affected: Zedna eBook download Project / Zedna eBook download WordPress Plugin | Class: web-app-framework | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Zedna eBook download Project", "30d_avg": 0, "90d_avg": 0, "product": "Zedna eBook download WordPress Plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2016-10924", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10924"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "7baea662-083d-46b0-9ec0-8c59f878f0d2", "vulnerability": {"vulnId": "CVE-2025-58179", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "7baea662-083d-46b0-9ec0-8c59f878f0d2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T07:50:21+00:00"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-11-01T07:50:21+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T07:50:21+00:00", "first_seen_at": "2026-11-01T07:50:21+00:00"}, "scope": {"notes": "Affected: Astro / Astro | Class: other-software | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Astro", "30d_avg": 0, "90d_avg": 0, "product": "Astro", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-58179", "url": "https://www.cve.org/CVERecord?id=CVE-2025-58179"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "26816ed4-4d27-4ad8-8178-1a4c1980b07c", "vulnerability": {"vulnId": "CVE-2018-1207", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "26816ed4-4d27-4ad8-8178-1a4c1980b07c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-02T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-11-01T07:50:02+00:00", "recorded_at": "2026-11-04T01:00:02+00:00", "last_seen_at": "2026-11-02T00:00:00+00:00", "first_seen_at": "2026-11-01T07:50:02+00:00"}, "scope": {"notes": "Affected: Dell / EMC iDrac | Class: web-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-02: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Dell", "30d_avg": 0, "90d_avg": 0, "product": "EMC iDrac", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2018-1207", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1207"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "02377ab3-cf24-490f-8e84-b742047dfaec", "vulnerability": {"vulnId": "CVE-2019-8982", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "02377ab3-cf24-490f-8e84-b742047dfaec"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T07:35:07+00:00"}, "characteristics": {"severity": 96}, "timestamps": {"asserted_at": "2026-11-01T07:35:07+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T07:35:07+00:00", "first_seen_at": "2026-11-01T07:35:07+00:00"}, "scope": {"notes": "Affected: Wavemaker / Wavemaker Studio | Class: other-software | Severity: Critical (CVSS 9.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Wavemaker", "30d_avg": 0, "90d_avg": 0, "product": "Wavemaker Studio", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.6, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-8982", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8982"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b303a8ba-b4a2-4a4b-b1bc-afa99badbdce", "vulnerability": {"vulnId": "CVE-2016-2389", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b303a8ba-b4a2-4a4b-b1bc-afa99badbdce"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T07:15:25+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-11-01T07:15:25+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T07:15:25+00:00", "first_seen_at": "2026-11-01T07:15:25+00:00"}, "scope": {"notes": "Affected: SAP / NetWeaver | Class: app-server | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "SAP", "30d_avg": 0, "90d_avg": 0, "product": "NetWeaver", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2016-2389", "url": "https://www.cve.org/CVERecord?id=CVE-2016-2389"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d9cb9e8b-b9be-495a-bf8b-f5670757da91", "vulnerability": {"vulnId": "CVE-2017-11512", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "d9cb9e8b-b9be-495a-bf8b-f5670757da91"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T07:14:22+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-11-01T07:14:22+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T07:14:22+00:00", "first_seen_at": "2026-11-01T07:14:22+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine ServiceDesk | Class: web-server | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Zoho", "30d_avg": 0, "90d_avg": 0, "product": "ManageEngine ServiceDesk", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2017-11512", "url": "https://www.cve.org/CVERecord?id=CVE-2017-11512"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b0c68bab-5eb4-4900-ad96-1d80ba5a0170", "vulnerability": {"vulnId": "CVE-2016-4977", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b0c68bab-5eb4-4900-ad96-1d80ba5a0170"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T07:12:59+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-11-01T07:12:59+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T07:12:59+00:00", "first_seen_at": "2026-11-01T07:12:59+00:00"}, "scope": {"notes": "Affected: Pivotal / Spring Security OAuth | Class: web-app-framework | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Pivotal", "30d_avg": 0, "90d_avg": 0, "product": "Spring Security OAuth", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2016-4977", "url": "https://www.cve.org/CVERecord?id=CVE-2016-4977"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "eacd7dfb-0e2b-4c2a-af05-d844872b61ca", "vulnerability": {"vulnId": "CVE-2025-31704", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "eacd7dfb-0e2b-4c2a-af05-d844872b61ca"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T05:58:37+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-11-01T05:58:37+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T05:58:37+00:00", "first_seen_at": "2026-11-01T05:58:37+00:00"}, "scope": {"notes": "Affected: Dahua / Intelligent Connection Center | Class: router | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Dahua", "30d_avg": 0, "90d_avg": 0, "product": "Intelligent Connection Center", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-31704", "url": "https://www.cve.org/CVERecord?id=CVE-2025-31704"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c91250cd-0ac5-4eb2-bd58-8cbcc4add620", "vulnerability": {"vulnId": "CVE-2025-58179", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c91250cd-0ac5-4eb2-bd58-8cbcc4add620"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-11-01T00:00:00+00:00", "recorded_at": "2026-11-02T11:00:01+00:00", "first_seen_at": "2026-11-01T00:00:00+00:00"}, "scope": {"notes": "Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint | Affected: Withastro / astro | CVSS: 7.2 (HIGH) | EPSS: 0.0087 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint", "cve_id": "CVE-2025-58179", "vendor": "Withastro", "ghsa_id": null, "product": "astro", "added_date": "2026-11-01T00:00:00.000Z", "cvss_score": 7.2, "epss_score": 0.0087, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.58804, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-58179", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-58179", "url": "https://www.cve.org/CVERecord?id=CVE-2025-58179"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-58179"}]}, {"uuid": "b1d0d0b9-8e9a-4c3b-9e29-56784d7e8f89", "vulnerability": {"vulnId": "CVE-2025-31704", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b1d0d0b9-8e9a-4c3b-9e29-56784d7e8f89"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-11-01T00:00:00+00:00", "recorded_at": "2026-11-02T11:00:01+00:00", "first_seen_at": "2026-11-01T00:00:00+00:00"}, "scope": {"notes": "Dahua Intelligent Connection Center command injection | Affected: Dahua / Intelligent Connection Center | CVSS: 9.8 (CRITICAL) | EPSS: 0.01364 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Dahua Intelligent Connection Center command injection", "cve_id": "CVE-2025-31704", "vendor": "Dahua", "ghsa_id": null, "product": "Intelligent Connection Center", "added_date": "2026-11-01T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.01364, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.71805, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-31704", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-31704", "url": "https://www.cve.org/CVERecord?id=CVE-2025-31704"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-31704"}]}, {"uuid": "ae00e78e-a24c-4aa1-b6ed-12005e2a5b11", "vulnerability": {"vulnId": "CVE-2018-16670", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ae00e78e-a24c-4aa1-b6ed-12005e2a5b11"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T00:00:00+00:00"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-10-31T18:38:52+00:00", "recorded_at": "2026-11-05T01:00:01+00:00", "last_seen_at": "2026-11-03T00:00:00+00:00", "first_seen_at": "2026-10-31T18:38:52+00:00"}, "scope": {"notes": "Affected: Circontrol / CirCarLife SCADA | Class: device-management-platform | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-03: 138", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Circontrol", "30d_avg": 0, "90d_avg": 0, "product": "CirCarLife SCADA", "cisa_kev": "no", "connections": 138, "observation_date": "2026-11-03", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2018-16670", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16670"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2ece92e5-2561-43ca-a310-0c86da5e459f", "vulnerability": {"vulnId": "CVE-2024-2863", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "2ece92e5-2561-43ca-a310-0c86da5e459f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-02T00:00:00+00:00"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-10-31T16:36:37+00:00", "recorded_at": "2026-11-04T01:00:02+00:00", "last_seen_at": "2026-11-02T00:00:00+00:00", "first_seen_at": "2026-10-31T16:36:37+00:00"}, "scope": {"notes": "Affected: LG / LED Assistant | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-02: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "LG", "30d_avg": 0, "90d_avg": 0, "product": "LED Assistant", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-02", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2024-2863", "url": "https://www.cve.org/CVERecord?id=CVE-2024-2863"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "9489dcce-d976-4f90-9775-ed13c521834b", "vulnerability": {"vulnId": "CVE-2026-42589", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "9489dcce-d976-4f90-9775-ed13c521834b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-01T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-10-31T14:13:52+00:00", "recorded_at": "2026-11-03T01:00:01+00:00", "last_seen_at": "2026-11-01T00:00:00+00:00", "first_seen_at": "2026-10-31T14:13:52+00:00"}, "scope": {"notes": "Affected: gotenberg / gotenberg | Class: web-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-01: 22", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "gotenberg", "30d_avg": 0, "90d_avg": 0, "product": "gotenberg", "cisa_kev": "no", "connections": 22, "observation_date": "2026-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-42589", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42589"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "dd9cdeea-2300-43da-9ffd-2cbdcd9870d3", "vulnerability": {"vulnId": "CVE-2026-34892", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "dd9cdeea-2300-43da-9ffd-2cbdcd9870d3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-31T08:01:03+00:00"}, "timestamps": {"asserted_at": "2026-10-31T08:01:03+00:00", "recorded_at": "2026-11-01T09:00:01+00:00", "first_seen_at": "2026-10-31T08:01:03+00:00"}, "scope": {"notes": "WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability | Affected: Rank Math SEO / Rank Math SEO | CVSS: 6.5 (MEDIUM) | EPSS: 0.00295 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability", "cve_id": "CVE-2026-34892", "vendor": "Rank Math SEO", "ghsa_id": "GHSA-3H4W-PPP7-MR7F", "product": "Rank Math SEO", "added_date": "2026-10-31T08:01:03.111Z", "cvss_score": 6.5, "epss_score": 0.00295, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.22244, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-34892", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-34892", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34892"}, {"id": "GHSA-3H4W-PPP7-MR7F", "url": "https://github.com/advisories/GHSA-3H4W-PPP7-MR7F"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-34892"}]}, {"uuid": "2b26057c-406f-4f97-9889-f30893b0b106", "vulnerability": {"vulnId": "CVE-2026-42589", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2b26057c-406f-4f97-9889-f30893b0b106"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-31T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-31T00:00:00+00:00", "recorded_at": "2026-11-01T12:00:01+00:00", "first_seen_at": "2026-10-31T00:00:00+00:00"}, "scope": {"notes": "Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection | Affected: Gotenberg / gotenberg | CVSS: 9.8 (CRITICAL) | EPSS: 0.03013 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection", "cve_id": "CVE-2026-42589", "vendor": "Gotenberg", "ghsa_id": null, "product": "gotenberg", "added_date": "2026-10-31T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.03013, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.87417, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-42589", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-42589", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42589"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-42589"}]}, {"uuid": "ff84f26d-dcee-4977-b4c9-904f7c855b37", "vulnerability": {"vulnId": "CVE-2026-118527", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ff84f26d-dcee-4977-b4c9-904f7c855b37"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-30T17:50:53+00:00"}, "timestamps": {"asserted_at": "2026-10-30T17:50:53+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-30T17:50:53+00:00"}, "scope": {"notes": "Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files... | Affected: Ivanti / Connect Secure | CVSS: 4.3 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files...", "cve_id": "CVE-2026-118527", "vendor": "Ivanti", "ghsa_id": null, "product": "Connect Secure", "added_date": "2026-10-30T17:50:53.742Z", "cvss_score": 4.3, "epss_score": null, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-118527", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-118527", "url": "https://www.cve.org/CVERecord?id=CVE-2026-118527"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-118527"}]}, {"uuid": "b36b312c-7a46-4505-8d83-d75c83e8993b", "vulnerability": {"vulnId": "CVE-2023-2356", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b36b312c-7a46-4505-8d83-d75c83e8993b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-02T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-10-30T16:09:01+00:00", "recorded_at": "2026-11-04T01:00:02+00:00", "last_seen_at": "2026-11-02T00:00:00+00:00", "first_seen_at": "2026-10-30T16:09:01+00:00"}, "scope": {"notes": "Affected: MLflow / MLflow | Class: ai-system | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-02: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "MLflow", "30d_avg": 0, "90d_avg": 0, "product": "MLflow", "cisa_kev": "no", "connections": 2, "observation_date": "2026-11-02", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-2356", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2356"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f4bd0480-c9e9-40ed-80d1-1613c920111b", "vulnerability": {"vulnId": "CVE-2015-20130", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f4bd0480-c9e9-40ed-80d1-1613c920111b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-30T14:50:30+00:00"}, "timestamps": {"asserted_at": "2026-10-30T14:50:30+00:00", "recorded_at": "2026-10-31T15:00:01+00:00", "first_seen_at": "2026-10-30T14:50:30+00:00"}, "scope": {"notes": "Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php | Affected: Netsweeper / Netsweeper | CVSS: 5.1 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php", "cve_id": "CVE-2015-20130", "vendor": "Netsweeper", "ghsa_id": null, "product": "Netsweeper", "added_date": "2026-10-30T14:50:30.526Z", "cvss_score": 5.1, "epss_score": null, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2015-20130", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2015-20130", "url": "https://www.cve.org/CVERecord?id=CVE-2015-20130"}, {"id": "previdian", "url": "https://previdian.com/CVE-2015-20130"}]}, {"uuid": "e72e531f-475c-4283-969e-1d571e2a640f", "vulnerability": {"vulnId": "CVE-2010-20125", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e72e531f-475c-4283-969e-1d571e2a640f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-30T14:50:29+00:00"}, "timestamps": {"asserted_at": "2026-10-30T14:50:29+00:00", "recorded_at": "2026-10-31T15:00:01+00:00", "first_seen_at": "2026-10-30T14:50:29+00:00"}, "scope": {"notes": "DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php | Affected: DedeCMS / DedeCMS | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php", "cve_id": "CVE-2010-20125", "vendor": "DedeCMS", "ghsa_id": null, "product": "DedeCMS", "added_date": "2026-10-30T14:50:29.473Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2010-20125", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2010-20125", "url": "https://www.cve.org/CVERecord?id=CVE-2010-20125"}, {"id": "previdian", "url": "https://previdian.com/CVE-2010-20125"}]}, {"uuid": "b9d449e9-b812-4c4a-84dd-6db767013f66", "vulnerability": {"vulnId": "CVE-2026-119977", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b9d449e9-b812-4c4a-84dd-6db767013f66"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-30T14:28:50+00:00"}, "timestamps": {"asserted_at": "2026-10-30T14:28:50+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-30T14:28:50+00:00"}, "scope": {"notes": "WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution | Affected: WordPress / WordPress | CVSS: 8.1 (HIGH) | EPSS: 0.006 | Used in malware: unknown | Listed 4 days ahead of CISA KEV | Not yet in CISA KEV: False | Previously: VULN-2026-0005"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution", "cve_id": "CVE-2026-119977", "vendor": "WordPress", "ghsa_id": null, "product": "WordPress", "added_date": "2026-10-30T14:28:50.619Z", "cvss_score": 8.1, "epss_score": 0.006, "previous_ids": ["VULN-2026-0005"], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.48751, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-119977", "ahead_of_cisa_kev": {"unit": "day", "count": 4}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-119977", "url": "https://www.cve.org/CVERecord?id=CVE-2026-119977"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-119977"}]}, {"uuid": "478ccd28-7226-4ec7-9124-1f2f3fd7820d", "vulnerability": {"vulnId": "CVE-2026-111357", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "478ccd28-7226-4ec7-9124-1f2f3fd7820d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-30T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-30T00:00:00+00:00", "recorded_at": "2026-10-30T18:00:01+00:00", "first_seen_at": "2026-10-30T00:00:00+00:00"}, "scope": {"notes": "Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | Affected: Ivanti / Connect Secure | Description: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US ; https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111357"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-306", "CWE-862", "CWE-345"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Connect Secure", "due_date": "2026-11-02", "date_added": "2026-10-30", "vendorProject": "Ivanti", "vulnerabilityName": "Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-111357", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111357"}]}, {"uuid": "3b341b0e-06fe-4799-8528-8fb2e487a0a4", "vulnerability": {"vulnId": "CVE-2026-118527", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "3b341b0e-06fe-4799-8528-8fb2e487a0a4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-30T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-30T00:00:00+00:00", "recorded_at": "2026-10-30T18:00:01+00:00", "first_seen_at": "2026-10-30T00:00:00+00:00"}, "scope": {"notes": "Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Affected: Ivanti / Connect Secure | Description: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-118527"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-340"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Connect Secure", "due_date": "2026-11-13", "date_added": "2026-10-30", "vendorProject": "Ivanti", "vulnerabilityName": "Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-118527", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527"}]}, {"uuid": "d0467039-e2c9-4517-8a12-6e19866aa546", "vulnerability": {"vulnId": "CVE-2026-97229", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d0467039-e2c9-4517-8a12-6e19866aa546"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T20:01:36+00:00"}, "timestamps": {"asserted_at": "2026-10-29T20:01:36+00:00", "recorded_at": "2026-10-30T21:00:01+00:00", "first_seen_at": "2026-10-29T20:01:36+00:00"}, "scope": {"notes": "Integer Overflow or Wraparound in GitLab | Affected: GitLab / GitLab | CVSS: 10.0 (CRITICAL) | EPSS: 0.18427 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Integer Overflow or Wraparound in GitLab", "cve_id": "CVE-2026-97229", "vendor": "GitLab", "ghsa_id": null, "product": "GitLab", "added_date": "2026-10-29T20:01:36.241Z", "cvss_score": 10.0, "epss_score": 0.18427, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.97229, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-97229", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-97229", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97229"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-97229"}]}, {"uuid": "91a6aa37-f722-4700-9bce-a87b48908d48", "vulnerability": {"vulnId": "CVE-2025-70795", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "91a6aa37-f722-4700-9bce-a87b48908d48"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T19:51:29+00:00"}, "timestamps": {"asserted_at": "2026-10-29T19:51:29+00:00", "recorded_at": "2026-10-30T20:00:01+00:00", "first_seen_at": "2026-10-29T19:51:29+00:00"}, "scope": {"notes": "STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate... | Affected: Safetica / STProcessMonitor | CVSS: 5.5 (MEDIUM) | EPSS: 0.00261 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate...", "cve_id": "CVE-2025-70795", "vendor": "Safetica", "ghsa_id": null, "product": "STProcessMonitor", "added_date": "2026-10-29T19:51:29.689Z", "cvss_score": 5.5, "epss_score": 0.00261, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.17835, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-70795", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-70795", "url": "https://www.cve.org/CVERecord?id=CVE-2025-70795"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-70795"}]}, {"uuid": "a154293a-2583-42ce-b464-c0c108db52f1", "vulnerability": {"vulnId": "CVE-2019-9041", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "a154293a-2583-42ce-b464-c0c108db52f1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T00:00:00+00:00"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-10-29T13:45:18+00:00", "recorded_at": "2026-11-05T01:00:01+00:00", "last_seen_at": "2026-11-03T00:00:00+00:00", "first_seen_at": "2026-10-29T13:45:18+00:00"}, "scope": {"notes": "Affected: ZZZCMS / ZZZPHP | Class: cms | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-03: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "ZZZCMS", "30d_avg": 0, "90d_avg": 0, "product": "ZZZPHP", "cisa_kev": "no", "connections": 4, "observation_date": "2026-11-03", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2019-9041", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9041"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "48f3e7fb-ad91-42ee-b5d5-1080d6d83083", "vulnerability": {"vulnId": "CVE-2026-115886", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "48f3e7fb-ad91-42ee-b5d5-1080d6d83083"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T12:20:29+00:00"}, "timestamps": {"asserted_at": "2026-10-29T12:20:29+00:00", "recorded_at": "2026-10-30T13:00:02+00:00", "first_seen_at": "2026-10-29T12:20:29+00:00"}, "scope": {"notes": "MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | Affected: Mlflow / mlflow | CVSS: 6.5 (MEDIUM) | EPSS: 0.00676 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints", "cve_id": "CVE-2026-115886", "vendor": "Mlflow", "ghsa_id": "GHSA-2WQP-Q3C6-CCJ5", "product": "mlflow", "added_date": "2026-10-29T12:20:29.795Z", "cvss_score": 6.5, "epss_score": 0.00676, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.52148, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-115886", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-115886", "url": "https://www.cve.org/CVERecord?id=CVE-2026-115886"}, {"id": "GHSA-2WQP-Q3C6-CCJ5", "url": "https://github.com/advisories/GHSA-2WQP-Q3C6-CCJ5"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-115886"}]}, {"uuid": "47cb469a-6f93-4f54-9f52-3dfd367cec48", "vulnerability": {"vulnId": "CVE-2021-35941", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "47cb469a-6f93-4f54-9f52-3dfd367cec48"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T10:59:54+00:00"}, "timestamps": {"asserted_at": "2026-10-29T10:59:54+00:00", "recorded_at": "2026-10-30T11:00:01+00:00", "first_seen_at": "2026-10-29T10:59:54+00:00"}, "scope": {"notes": "Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory... | Affected: Western Digital / WD My Book Live, WD My Book Live Duo | CVSS: 7.5 (HIGH) | EPSS: 0.1271 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory...", "cve_id": "CVE-2021-35941", "vendor": "Western Digital", "ghsa_id": null, "product": "WD My Book Live, WD My Book Live Duo", "added_date": "2026-10-29T10:59:54.015Z", "cvss_score": 7.5, "epss_score": 0.1271, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.96255, "used_in_malware": "unknown", "vulnerability_id": "CVE-2021-35941", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-35941", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35941"}, {"id": "previdian", "url": "https://previdian.com/CVE-2021-35941"}]}, {"uuid": "a2c15db3-2eee-4d91-9628-a19e54a7020e", "vulnerability": {"vulnId": "CVE-2021-3006", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a2c15db3-2eee-4d91-9628-a19e54a7020e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T10:59:36+00:00"}, "timestamps": {"asserted_at": "2026-10-29T10:59:36+00:00", "recorded_at": "2026-10-30T11:00:01+00:00", "first_seen_at": "2026-10-29T10:59:36+00:00"}, "scope": {"notes": "The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows... | Affected: Seal Finance / Seal | CVSS: 7.5 (HIGH) | EPSS: 0.01276 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows...", "cve_id": "CVE-2021-3006", "vendor": "Seal Finance", "ghsa_id": null, "product": "Seal", "added_date": "2026-10-29T10:59:36.737Z", "cvss_score": 7.5, "epss_score": 0.01276, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.69877, "used_in_malware": "unknown", "vulnerability_id": "CVE-2021-3006", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-3006", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3006"}, {"id": "previdian", "url": "https://previdian.com/CVE-2021-3006"}]}, {"uuid": "1286d748-c55d-4b64-9e6b-983c3110b800", "vulnerability": {"vulnId": "CVE-2026-32557", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "1286d748-c55d-4b64-9e6b-983c3110b800"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T07:30:41+00:00"}, "timestamps": {"asserted_at": "2026-10-29T07:30:41+00:00", "recorded_at": "2026-10-30T08:00:01+00:00", "first_seen_at": "2026-10-29T07:30:41+00:00"}, "scope": {"notes": "WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability | Affected: BookingWP / WooCommerce Appointments | CVSS: 9.3 (CRITICAL) | EPSS: 0.00372 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability", "cve_id": "CVE-2026-32557", "vendor": "BookingWP", "ghsa_id": null, "product": "WooCommerce Appointments", "added_date": "2026-10-29T07:30:41.783Z", "cvss_score": 9.3, "epss_score": 0.00372, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.311, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-32557", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-32557", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32557"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-32557"}]}, {"uuid": "c00e3f8b-d015-45e1-8af3-f59f18e341bb", "vulnerability": {"vulnId": "CVE-2026-97229", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "c00e3f8b-d015-45e1-8af3-f59f18e341bb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-29T00:00:00+00:00", "recorded_at": "2026-10-29T20:00:01+00:00", "first_seen_at": "2026-10-29T00:00:00+00:00"}, "scope": {"notes": "GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | Affected: GitLab / Community Edition and Enterprise Edition | Description: GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue in CI/CD Regular Expression Compiler. For more information please see: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves ; https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-97229"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-190"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Community Edition and Enterprise Edition", "due_date": "2026-11-01", "date_added": "2026-10-29", "vendorProject": "GitLab", "vulnerabilityName": "GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-97229", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-97229"}]}, {"uuid": "59f5cef5-7296-4153-8903-cf02fcef7612", "vulnerability": {"vulnId": "CVE-2026-76418", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "59f5cef5-7296-4153-8903-cf02fcef7612"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-29T00:00:00+00:00", "recorded_at": "2026-10-29T20:00:01+00:00", "first_seen_at": "2026-10-29T00:00:00+00:00"}, "scope": {"notes": "Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | Affected: Cisco / Secure Firewall ASA Software and Cisco Secure FTD Software | Description: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76418"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-690"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Secure Firewall ASA Software and Cisco Secure FTD Software", "due_date": "2026-11-01", "date_added": "2026-10-29", "vendorProject": "Cisco", "vulnerabilityName": "Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-76418", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76418"}]}, {"uuid": "46a2a883-149c-4b66-b54f-6a0e6a08d88e", "vulnerability": {"vulnId": "CVE-2026-76418", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "46a2a883-149c-4b66-b54f-6a0e6a08d88e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T19:44:49+00:00"}, "timestamps": {"asserted_at": "2026-10-28T19:44:49+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-28T19:44:49+00:00"}, "scope": {"notes": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability | Affected: Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software | CVSS: 8.6 (HIGH) | EPSS: 0.00821 | Used in malware: unknown | Listed 1 day ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability", "cve_id": "CVE-2026-76418", "vendor": "Cisco", "ghsa_id": null, "product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software", "added_date": "2026-10-28T19:44:49.450Z", "cvss_score": 8.6, "epss_score": 0.00821, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.57342, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-76418", "ahead_of_cisa_kev": {"unit": "day", "count": 1}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-76418", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76418"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-76418"}]}, {"uuid": "699c5250-88ca-41a6-83f1-a6d71416173d", "vulnerability": {"vulnId": "CVE-2026-46300", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "699c5250-88ca-41a6-83f1-a6d71416173d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T17:26:00+00:00"}, "timestamps": {"asserted_at": "2026-10-28T17:26:00+00:00", "recorded_at": "2026-10-29T18:00:01+00:00", "first_seen_at": "2026-10-28T17:26:00+00:00"}, "scope": {"notes": "net: skbuff: preserve shared-frag marker during coalescing | Affected: Linux / Linux | CVSS: 7.8 (HIGH) | EPSS: 0.10192 | Used in malware: unknown | Listed 2 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "net: skbuff: preserve shared-frag marker during coalescing", "cve_id": "CVE-2026-46300", "vendor": "Linux", "ghsa_id": null, "product": "Linux", "added_date": "2026-10-28T17:26:00.000Z", "cvss_score": 7.8, "epss_score": 0.10192, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.95651, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-46300", "ahead_of_cisa_kev": {"unit": "hour", "count": 2}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-46300", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46300"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-46300"}]}, {"uuid": "1729a5c7-7f00-4006-a3d8-9ab3ee27c8b9", "vulnerability": {"vulnId": "CVE-2026-118539", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "1729a5c7-7f00-4006-a3d8-9ab3ee27c8b9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T17:11:14+00:00"}, "timestamps": {"asserted_at": "2026-10-28T17:11:14+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-28T17:11:14+00:00"}, "scope": {"notes": "Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 | Affected: Drupal / Commerce Core | CVSS: 6.5 (MEDIUM) | EPSS: 0.00305 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254", "cve_id": "CVE-2026-118539", "vendor": "Drupal", "ghsa_id": null, "product": "Commerce Core", "added_date": "2026-10-28T17:11:14.139Z", "cvss_score": 6.5, "epss_score": 0.00305, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.23406, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-118539", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-118539", "url": "https://www.cve.org/CVERecord?id=CVE-2026-118539"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-118539"}]}, {"uuid": "3a426512-36ee-40b5-907e-7290f9b0b1be", "vulnerability": {"vulnId": "CVE-2025-54988", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3a426512-36ee-40b5-907e-7290f9b0b1be"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T16:18:18+00:00"}, "timestamps": {"asserted_at": "2026-10-28T16:18:18+00:00", "recorded_at": "2026-10-29T17:00:02+00:00", "first_seen_at": "2026-10-28T16:18:18+00:00"}, "scope": {"notes": "Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA | Affected: Apache / Apache Tika PDF parser module | CVSS: 8.4 (HIGH) | EPSS: 0.47948 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA", "cve_id": "CVE-2025-54988", "vendor": "Apache", "ghsa_id": null, "product": "Apache Tika PDF parser module", "added_date": "2026-10-28T16:18:18.975Z", "cvss_score": 8.4, "epss_score": 0.47948, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.9885, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-54988", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-54988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54988"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-54988"}]}, {"uuid": "d7c812a5-80d2-4ad8-8609-8b2379bd02b1", "vulnerability": {"vulnId": "CVE-2026-112357", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d7c812a5-80d2-4ad8-8609-8b2379bd02b1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T15:40:38+00:00"}, "timestamps": {"asserted_at": "2026-10-28T15:40:38+00:00", "recorded_at": "2026-10-29T16:00:01+00:00", "first_seen_at": "2026-10-28T15:40:38+00:00"}, "scope": {"notes": "GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation | Affected: GFI USA / GFI KerioConnect | CVSS: 8.5 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation", "cve_id": "CVE-2026-112357", "vendor": "GFI USA", "ghsa_id": null, "product": "GFI KerioConnect", "added_date": "2026-10-28T15:40:38.946Z", "cvss_score": 8.5, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-112357", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-112357", "url": "https://www.cve.org/CVERecord?id=CVE-2026-112357"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-112357"}]}, {"uuid": "521a44e1-44c6-4703-9af7-6f53bbd4c2c1", "vulnerability": {"vulnId": "CVE-2026-112356", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "521a44e1-44c6-4703-9af7-6f53bbd4c2c1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T15:31:10+00:00"}, "timestamps": {"asserted_at": "2026-10-28T15:31:10+00:00", "recorded_at": "2026-10-29T16:00:01+00:00", "first_seen_at": "2026-10-28T15:31:10+00:00"}, "scope": {"notes": "GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter | Affected: GFI USA / GFI KerioConnect | CVSS: 5.1 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter", "cve_id": "CVE-2026-112356", "vendor": "GFI USA", "ghsa_id": null, "product": "GFI KerioConnect", "added_date": "2026-10-28T15:31:10.969Z", "cvss_score": 5.1, "epss_score": null, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-112356", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-112356", "url": "https://www.cve.org/CVERecord?id=CVE-2026-112356"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-112356"}]}, {"uuid": "3d88c7b7-6fd7-4e71-a6a7-b8a63f53354b", "vulnerability": {"vulnId": "CVE-2026-41709", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3d88c7b7-6fd7-4e71-a6a7-b8a63f53354b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T15:24:00+00:00"}, "timestamps": {"asserted_at": "2026-10-28T15:24:00+00:00", "recorded_at": "2026-10-29T16:00:01+00:00", "first_seen_at": "2026-10-28T15:24:00+00:00"}, "scope": {"notes": "ESX insufficient logging vulnerability | Affected: VMware / Cloud Foundation, vSphere Foundation, ESX, Telco Cloud Platform | CVSS: 2.7 (LOW) | EPSS: 0.00297 | Used in malware: unknown | Listed 4 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "ESX insufficient logging vulnerability", "cve_id": "CVE-2026-41709", "vendor": "VMware", "ghsa_id": null, "product": "Cloud Foundation, vSphere Foundation, ESX, Telco Cloud Platform", "added_date": "2026-10-28T15:24:00.000Z", "cvss_score": 2.7, "epss_score": 0.00297, "previous_ids": [], "cvss_severity": "LOW", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.22291, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-41709", "ahead_of_cisa_kev": {"unit": "hour", "count": 4}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-41709", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41709"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-41709"}]}, {"uuid": "8c30da3f-cab4-45f7-8b85-c99cfab8956c", "vulnerability": {"vulnId": "CVE-2026-85688", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "8c30da3f-cab4-45f7-8b85-c99cfab8956c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T09:17:11+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-10-28T09:17:11+00:00", "recorded_at": "2026-10-30T01:00:01+00:00", "last_seen_at": "2026-10-28T09:17:11+00:00", "first_seen_at": "2026-10-28T09:17:11+00:00"}, "scope": {"notes": "Affected: TEN Framework / TEN Framework TMAN Designer | Class: ai-system | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-10-28: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "TEN Framework", "30d_avg": 0, "90d_avg": 0, "product": "TEN Framework TMAN Designer", "cisa_kev": "no", "connections": 2, "observation_date": "2026-10-28", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-85688", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85688"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ceab6862-9431-4fcf-8c7c-3edc348720f2", "vulnerability": {"vulnId": "CVE-2024-9234", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ceab6862-9431-4fcf-8c7c-3edc348720f2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T08:41:32+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-10-28T08:41:32+00:00", "recorded_at": "2026-10-30T01:00:01+00:00", "last_seen_at": "2026-10-28T08:41:32+00:00", "first_seen_at": "2026-10-28T08:41:32+00:00"}, "scope": {"notes": "Affected: GutenKit / GutenKit WordPress Plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-10-28: 17", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "GutenKit", "30d_avg": 0, "90d_avg": 0, "product": "GutenKit WordPress Plugin", "cisa_kev": "no", "connections": 17, "observation_date": "2026-10-28", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2024-9234", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9234"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b8e2429c-0b82-4867-b41c-b4fc1f01a2b7", "vulnerability": {"vulnId": "CVE-2026-116690", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b8e2429c-0b82-4867-b41c-b4fc1f01a2b7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T08:14:32+00:00"}, "timestamps": {"asserted_at": "2026-10-28T08:14:32+00:00", "recorded_at": "2026-10-29T09:00:01+00:00", "first_seen_at": "2026-10-28T08:14:32+00:00"}, "scope": {"notes": "MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source | Affected: Mlflow / mlflow | CVSS: 7.5 (HIGH) | EPSS: 0.00559 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source", "cve_id": "CVE-2026-116690", "vendor": "Mlflow", "ghsa_id": "GHSA-M65P-9J7Q-6W33", "product": "mlflow", "added_date": "2026-10-28T08:14:32.228Z", "cvss_score": 7.5, "epss_score": 0.00559, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": true, "cvss_estimated": false, "epss_percentile": 0.46444, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-116690", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-116690", "url": "https://www.cve.org/CVERecord?id=CVE-2026-116690"}, {"id": "GHSA-M65P-9J7Q-6W33", "url": "https://github.com/advisories/GHSA-M65P-9J7Q-6W33"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-116690"}]}, {"uuid": "c8c3e410-ede5-4105-a689-51e28db3f35b", "vulnerability": {"vulnId": "CVE-2019-7139", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "c8c3e410-ede5-4105-a689-51e28db3f35b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-10-28T02:55:22+00:00", "recorded_at": "2026-10-31T01:00:02+00:00", "last_seen_at": "2026-10-29T00:00:00+00:00", "first_seen_at": "2026-10-28T02:55:22+00:00"}, "scope": {"notes": "Affected: Magento / Magento Commerce | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-10-29: 8", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Magento", "30d_avg": 0, "90d_avg": 0, "product": "Magento Commerce", "cisa_kev": "no", "connections": 8, "observation_date": "2026-10-29", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-7139", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7139"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "85773f41-6dae-48fa-91e6-7e48eccbc647", "vulnerability": {"vulnId": "CVE-2026-85688", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "85773f41-6dae-48fa-91e6-7e48eccbc647"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-28T00:00:00+00:00", "recorded_at": "2026-10-29T11:00:01+00:00", "first_seen_at": "2026-10-28T00:00:00+00:00"}, "scope": {"notes": "TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer | Affected: TEN-framework / ten-framework | CVSS: 9.3 (CRITICAL) | EPSS: 0.02641 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer", "cve_id": "CVE-2026-85688", "vendor": "TEN-framework", "ghsa_id": null, "product": "ten-framework", "added_date": "2026-10-28T00:00:00.000Z", "cvss_score": 9.3, "epss_score": 0.02641, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.85528, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-85688", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-85688", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85688"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-85688"}]}, {"uuid": "65c3f943-4374-48b3-9045-6beb33693c1e", "vulnerability": {"vulnId": "CVE-2026-41709", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "65c3f943-4374-48b3-9045-6beb33693c1e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-28T00:00:00+00:00", "recorded_at": "2026-10-28T20:00:01+00:00", "first_seen_at": "2026-10-28T00:00:00+00:00"}, "scope": {"notes": "Broadcom VMWare ESX Insufficient Logging Vulnerability | Affected: Broadcom / VMware ESX | Description: Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-11 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-41709"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-778"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "VMware ESX", "due_date": "2026-11-11", "date_added": "2026-10-28", "vendorProject": "Broadcom", "vulnerabilityName": "Broadcom VMWare ESX Insufficient Logging Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-41709", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41709"}]}, {"uuid": "64913718-7230-46d3-b449-962fa5c3641e", "vulnerability": {"vulnId": "CVE-2026-46300", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "64913718-7230-46d3-b449-962fa5c3641e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-28T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-28T00:00:00+00:00", "recorded_at": "2026-10-28T20:00:01+00:00", "first_seen_at": "2026-10-28T00:00:00+00:00"}, "scope": {"notes": "Linux Kernel Missing Initialization of a Variable Vulnerability | Affected: Linux / Kernel | Description: Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-31 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 ; https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c ; https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 ; https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 ; https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e ; https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a ; https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 ; https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-46300"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-456"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Kernel", "due_date": "2026-10-31", "date_added": "2026-10-28", "vendorProject": "Linux", "vulnerabilityName": "Linux Kernel Missing Initialization of a Variable Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-46300", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46300"}]}, {"uuid": "20ce279c-31bf-4e45-b3d1-17a840f49b7e", "vulnerability": {"vulnId": "CVE-2026-102785", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "20ce279c-31bf-4e45-b3d1-17a840f49b7e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T21:53:30+00:00"}, "timestamps": {"asserted_at": "2026-10-27T21:53:30+00:00", "recorded_at": "2026-10-28T22:00:01+00:00", "first_seen_at": "2026-10-27T21:53:30+00:00"}, "scope": {"notes": "Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 | Affected: Yootheme.com / YOOtheme Pro extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.00699 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52", "cve_id": "CVE-2026-102785", "vendor": "Yootheme.com", "ghsa_id": null, "product": "YOOtheme Pro extension for Joomla", "added_date": "2026-10-27T21:53:30.209Z", "cvss_score": 10.0, "epss_score": 0.00699, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.52938, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-102785", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-102785", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102785"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-102785"}]}, {"uuid": "552ab7d3-2843-4c10-836b-574d0d18403a", "vulnerability": {"vulnId": "CVE-2024-3848", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "552ab7d3-2843-4c10-836b-574d0d18403a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T20:53:56+00:00"}, "timestamps": {"asserted_at": "2026-10-27T20:53:56+00:00", "recorded_at": "2026-10-28T21:00:01+00:00", "first_seen_at": "2026-10-27T20:53:56+00:00"}, "scope": {"notes": "Path Traversal Bypass in mlflow/mlflow | Affected: Mlflow / mlflow/mlflow | CVSS: 7.5 (HIGH) | EPSS: 0.43284 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Path Traversal Bypass in mlflow/mlflow", "cve_id": "CVE-2024-3848", "vendor": "Mlflow", "ghsa_id": null, "product": "mlflow/mlflow", "added_date": "2026-10-27T20:53:56.461Z", "cvss_score": 7.5, "epss_score": 0.43284, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": true, "cvss_estimated": false, "epss_percentile": 0.98721, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-3848", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-3848", "url": "https://www.cve.org/CVERecord?id=CVE-2024-3848"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-3848"}]}, {"uuid": "de9d3dd6-2935-4870-8395-e8beb61a2dd7", "vulnerability": {"vulnId": "CVE-2026-105133", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "de9d3dd6-2935-4870-8395-e8beb61a2dd7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T00:00:00+00:00"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2026-10-27T20:21:26+00:00", "recorded_at": "2026-10-31T01:00:02+00:00", "last_seen_at": "2026-10-29T00:00:00+00:00", "first_seen_at": "2026-10-27T20:21:26+00:00"}, "scope": {"notes": "Affected: Ahsay / AhsayCBS | Class: backup | Severity: High (CVSS 7.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-10-29: 22", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "backup", "7d_avg": 0, "vendor": "Ahsay", "30d_avg": 0, "90d_avg": 0, "product": "AhsayCBS", "cisa_kev": "yes", "connections": 22, "observation_date": "2026-10-29", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-105133", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105133"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "5e391e1f-e4c6-4180-8825-14998c1c2429", "vulnerability": {"vulnId": "CVE-2026-111497", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "5e391e1f-e4c6-4180-8825-14998c1c2429"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T20:05:08+00:00"}, "timestamps": {"asserted_at": "2026-10-27T20:05:08+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-27T20:05:08+00:00"}, "scope": {"notes": "Out-of-Bounds Write in Google Brotli Decoder | Affected: Google / Brotli | CVSS: 9.2 (CRITICAL) | EPSS: 0.82641 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Out-of-Bounds Write in Google Brotli Decoder", "cve_id": "CVE-2026-111497", "vendor": "Google", "ghsa_id": "GHSA-9V8H-QQGM-4M35", "product": "Brotli", "added_date": "2026-10-27T20:05:08.466Z", "cvss_score": 9.2, "epss_score": 0.82641, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.99667, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-111497", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-111497", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111497"}, {"id": "GHSA-9V8H-QQGM-4M35", "url": "https://github.com/advisories/GHSA-9V8H-QQGM-4M35"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-111497"}]}, {"uuid": "beba3015-09e3-4e53-8171-0094c4b96c71", "vulnerability": {"vulnId": "CVE-2026-48356", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "beba3015-09e3-4e53-8171-0094c4b96c71"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T20:01:36+00:00"}, "timestamps": {"asserted_at": "2026-10-27T20:01:36+00:00", "recorded_at": "2026-10-28T21:00:01+00:00", "first_seen_at": "2026-10-27T20:01:36+00:00"}, "scope": {"notes": "Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) | Affected: Adobe / Adobe Commerce, Adobe Commerce B2B, Magento Open Source, Adobe Commerce Events | CVSS: 9.3 (CRITICAL) | EPSS: 0.30582 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)", "cve_id": "CVE-2026-48356", "vendor": "Adobe", "ghsa_id": null, "product": "Adobe Commerce, Adobe Commerce B2B, Magento Open Source, Adobe Commerce Events", "added_date": "2026-10-27T20:01:36.935Z", "cvss_score": 9.3, "epss_score": 0.30582, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98231, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-48356", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-48356", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48356"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-48356"}]}, {"uuid": "80af5090-93ee-4cd0-af39-c561f758c56c", "vulnerability": {"vulnId": "CVE-2026-101767", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "80af5090-93ee-4cd0-af39-c561f758c56c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T16:31:18+00:00"}, "timestamps": {"asserted_at": "2026-10-27T16:31:18+00:00", "recorded_at": "2026-10-28T17:00:01+00:00", "first_seen_at": "2026-10-27T16:31:18+00:00"}, "scope": {"notes": "Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected... | Affected: Oracle / Oracle Application Object Library | CVSS: 9.8 (CRITICAL) | EPSS: 0.00614 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected...", "cve_id": "CVE-2026-101767", "vendor": "Oracle", "ghsa_id": null, "product": "Oracle Application Object Library", "added_date": "2026-10-27T16:31:18.738Z", "cvss_score": 9.8, "epss_score": 0.00614, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.49198, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-101767", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-101767", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101767"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-101767"}]}, {"uuid": "fb71f63e-64df-4951-9e8e-8bf3c1cbaa39", "vulnerability": {"vulnId": "CVE-2026-112353", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "fb71f63e-64df-4951-9e8e-8bf3c1cbaa39"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T16:30:41+00:00"}, "timestamps": {"asserted_at": "2026-10-27T16:30:41+00:00", "recorded_at": "2026-10-28T17:00:01+00:00", "first_seen_at": "2026-10-27T16:30:41+00:00"}, "scope": {"notes": "GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment | Affected: GFI USA / GFI KerioConnect | CVSS: 6.2 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment", "cve_id": "CVE-2026-112353", "vendor": "GFI USA", "ghsa_id": null, "product": "GFI KerioConnect", "added_date": "2026-10-27T16:30:41.039Z", "cvss_score": 6.2, "epss_score": null, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-112353", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-112353", "url": "https://www.cve.org/CVERecord?id=CVE-2026-112353"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-112353"}]}, {"uuid": "bb03f5ed-afaa-430a-9094-546e1d51aaac", "vulnerability": {"vulnId": "CVE-2026-114509", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "bb03f5ed-afaa-430a-9094-546e1d51aaac"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T15:20:31+00:00"}, "timestamps": {"asserted_at": "2026-10-27T15:20:31+00:00", "recorded_at": "2026-10-28T16:00:01+00:00", "first_seen_at": "2026-10-27T15:20:31+00:00"}, "scope": {"notes": "Laravel TokenGuard authentication bypass through non-string API credentials | Affected: Laravel / framework | CVSS: 9.2 (CRITICAL) | EPSS: 0.00696 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Laravel TokenGuard authentication bypass through non-string API credentials", "cve_id": "CVE-2026-114509", "vendor": "Laravel", "ghsa_id": "GHSA-F9X3-7VQ9-CPH6", "product": "framework", "added_date": "2026-10-27T15:20:31.851Z", "cvss_score": 9.2, "epss_score": 0.00696, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.52828, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-114509", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-114509", "url": "https://www.cve.org/CVERecord?id=CVE-2026-114509"}, {"id": "GHSA-F9X3-7VQ9-CPH6", "url": "https://github.com/advisories/GHSA-F9X3-7VQ9-CPH6"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-114509"}]}, {"uuid": "651aa9cd-9c62-4041-8a35-c83d1a432115", "vulnerability": {"vulnId": "CVE-2026-28167", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "651aa9cd-9c62-4041-8a35-c83d1a432115"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T15:01:13+00:00"}, "timestamps": {"asserted_at": "2026-10-27T15:01:13+00:00", "recorded_at": "2026-10-28T16:00:01+00:00", "first_seen_at": "2026-10-27T15:01:13+00:00"}, "scope": {"notes": "WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability | Affected: WebRehab / Super Forms | CVSS: 7.5 (HIGH) | EPSS: 0.00503 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability", "cve_id": "CVE-2026-28167", "vendor": "WebRehab", "ghsa_id": "GHSA-2R89-PXPW-MWF2", "product": "Super Forms", "added_date": "2026-10-27T15:01:13.873Z", "cvss_score": 7.5, "epss_score": 0.00503, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.42807, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-28167", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-28167", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28167"}, {"id": "GHSA-2R89-PXPW-MWF2", "url": "https://github.com/advisories/GHSA-2R89-PXPW-MWF2"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-28167"}]}, {"uuid": "65bff0c4-a207-4da1-b536-c115a1284ed4", "vulnerability": {"vulnId": "CVE-2026-95610", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "65bff0c4-a207-4da1-b536-c115a1284ed4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T13:31:10+00:00"}, "timestamps": {"asserted_at": "2026-10-27T13:31:10+00:00", "recorded_at": "2026-10-28T14:00:01+00:00", "first_seen_at": "2026-10-27T13:31:10+00:00"}, "scope": {"notes": "WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability | Affected: UpSolution / UpSolution Core | CVSS: 8.5 (HIGH) | EPSS: 0.00205 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability", "cve_id": "CVE-2026-95610", "vendor": "UpSolution", "ghsa_id": null, "product": "UpSolution Core", "added_date": "2026-10-27T13:31:10.645Z", "cvss_score": 8.5, "epss_score": 0.00205, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.10373, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-95610", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-95610", "url": "https://www.cve.org/CVERecord?id=CVE-2026-95610"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-95610"}]}, {"uuid": "23ffe375-4635-4d4c-bf20-db10f74cb450", "vulnerability": {"vulnId": "CVE-2020-13945", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "23ffe375-4635-4d4c-bf20-db10f74cb450"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-02T00:00:00+00:00"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2026-10-27T11:23:40+00:00", "recorded_at": "2026-11-04T01:00:02+00:00", "last_seen_at": "2026-11-02T00:00:00+00:00", "first_seen_at": "2026-10-27T11:23:40+00:00"}, "scope": {"notes": "Affected: Apache / APISIX | Class: other-software | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-02: 16", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "APISIX", "cisa_kev": "no", "connections": 16, "observation_date": "2026-11-02", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2020-13945", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13945"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "3ca826cb-4c27-4acb-b02b-31de414ecd36", "vulnerability": {"vulnId": "CVE-2016-3976", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "3ca826cb-4c27-4acb-b02b-31de414ecd36"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-29T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-10-27T10:38:21+00:00", "recorded_at": "2026-10-31T01:00:02+00:00", "last_seen_at": "2026-10-29T00:00:00+00:00", "first_seen_at": "2026-10-27T10:38:21+00:00"}, "scope": {"notes": "Affected: SAP / NetWeaver Application Server Java | Class: app-server | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-10-29: 10", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "SAP", "30d_avg": 0, "90d_avg": 0, "product": "NetWeaver Application Server Java", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-10-29", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2016-3976", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3976"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8a4112ea-053e-4b31-b1ca-b73c4d992a0c", "vulnerability": {"vulnId": "CVE-2024-32507", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8a4112ea-053e-4b31-b1ca-b73c4d992a0c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T10:30:55+00:00"}, "timestamps": {"asserted_at": "2026-10-27T10:30:55+00:00", "recorded_at": "2026-10-28T11:00:01+00:00", "first_seen_at": "2026-10-27T10:30:55+00:00"}, "scope": {"notes": "WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability | Affected: Hamid Alinia / Login with phone number | CVSS: 8.8 (HIGH) | EPSS: 0.00457 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability", "cve_id": "CVE-2024-32507", "vendor": "Hamid Alinia", "ghsa_id": null, "product": "Login with phone number", "added_date": "2026-10-27T10:30:55.753Z", "cvss_score": 8.8, "epss_score": 0.00457, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.39453, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-32507", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-32507", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32507"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-32507"}]}, {"uuid": "fe51157b-a407-4d2f-9a88-81a71b6a9ad7", "vulnerability": {"vulnId": "CVE-2026-28039", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "fe51157b-a407-4d2f-9a88-81a71b6a9ad7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T07:31:01+00:00"}, "timestamps": {"asserted_at": "2026-10-27T07:31:01+00:00", "recorded_at": "2026-10-28T08:00:01+00:00", "first_seen_at": "2026-10-27T07:31:01+00:00"}, "scope": {"notes": "WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability | Affected: TMS / wpDataTables | CVSS: 7.5 (HIGH) | EPSS: 0.0037 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability", "cve_id": "CVE-2026-28039", "vendor": "TMS", "ghsa_id": "GHSA-G6MJ-J7H3-8GXQ", "product": "wpDataTables", "added_date": "2026-10-27T07:31:01.570Z", "cvss_score": 7.5, "epss_score": 0.0037, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.3079, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-28039", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-28039", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28039"}, {"id": "GHSA-G6MJ-J7H3-8GXQ", "url": "https://github.com/advisories/GHSA-G6MJ-J7H3-8GXQ"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-28039"}]}, {"uuid": "3b78c4fd-8b0b-488a-9561-67fe614507ef", "vulnerability": {"vulnId": "CVE-2026-111497", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "3b78c4fd-8b0b-488a-9561-67fe614507ef"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-27T00:00:00+00:00", "recorded_at": "2026-10-27T20:00:01+00:00", "first_seen_at": "2026-10-27T00:00:00+00:00"}, "scope": {"notes": "Google Brotli Unchecked Return Value Vulnerability | Affected: Google / Brotli | Description: Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111497"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-252", "CWE-787"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Brotli", "due_date": "2026-11-10", "date_added": "2026-10-27", "vendorProject": "Google", "vulnerabilityName": "Google Brotli Unchecked Return Value Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-111497", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111497"}]}, {"uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "vulnerability": {"vulnId": "CVE-2026-48356", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-27T00:00:00+00:00", "recorded_at": "2026-10-27T20:00:01+00:00", "first_seen_at": "2026-10-27T00:00:00+00:00"}, "scope": {"notes": "Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Affected: Adobe / Commerce and Magento | Description: Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-11-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.adobe.com/trust/security/products/commerce/apsb26-73.html ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48356"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-434"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Commerce and Magento", "due_date": "2026-11-10", "date_added": "2026-10-27", "vendorProject": "Adobe", "vulnerabilityName": "Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-48356", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48356"}]}, {"uuid": "a81bab3c-0529-4976-b6b1-b43dcd277883", "vulnerability": {"vulnId": "CVE-2026-96652", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "a81bab3c-0529-4976-b6b1-b43dcd277883"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T00:00:00+00:00"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-10-26T12:17:05+00:00", "recorded_at": "2026-11-05T01:00:01+00:00", "last_seen_at": "2026-11-03T00:00:00+00:00", "first_seen_at": "2026-10-26T12:17:05+00:00"}, "scope": {"notes": "Affected: Plex / Plex Media Server | Class: video-system | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-11-03: 30", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 2, "vendor": "Plex", "30d_avg": 0, "90d_avg": 0, "product": "Plex Media Server", "cisa_kev": "yes", "connections": 30, "observation_date": "2026-11-03", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2026-96652", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96652"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "5dc881e2-6fc3-4c8f-b427-e04908d75f07", "vulnerability": {"vulnId": "CVE-2024-47167", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "5dc881e2-6fc3-4c8f-b427-e04908d75f07"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-26T08:40:27+00:00"}, "timestamps": {"asserted_at": "2026-10-26T08:40:27+00:00", "recorded_at": "2026-10-27T09:00:01+00:00", "first_seen_at": "2026-10-26T08:40:27+00:00"}, "scope": {"notes": "SSRF in the path parameter of /queue/join in Gradio | Affected: Gradio-app / gradio | CVSS: 6.9 (MEDIUM) | EPSS: 0.00476 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SSRF in the path parameter of /queue/join in Gradio", "cve_id": "CVE-2024-47167", "vendor": "Gradio-app", "ghsa_id": null, "product": "gradio", "added_date": "2026-10-26T08:40:27.425Z", "cvss_score": 6.9, "epss_score": 0.00476, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.40854, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-47167", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-47167", "url": "https://www.cve.org/CVERecord?id=CVE-2024-47167"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-47167"}]}, {"uuid": "fd3dd734-7694-4aeb-9234-83ac9fc6c03e", "vulnerability": {"vulnId": "CVE-2026-28177", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "fd3dd734-7694-4aeb-9234-83ac9fc6c03e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-26T07:50:17+00:00"}, "timestamps": {"asserted_at": "2026-10-26T07:50:17+00:00", "recorded_at": "2026-10-27T08:00:01+00:00", "first_seen_at": "2026-10-26T07:50:17+00:00"}, "scope": {"notes": "WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability | Affected: Code Atlantic / Popup Maker | CVSS: 7.1 (HIGH) | EPSS: 0.00251 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability", "cve_id": "CVE-2026-28177", "vendor": "Code Atlantic", "ghsa_id": null, "product": "Popup Maker", "added_date": "2026-10-26T07:50:17.984Z", "cvss_score": 7.1, "epss_score": 0.00251, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.16377, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-28177", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-28177", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28177"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-28177"}]}, {"uuid": "73f16751-7d4b-422b-978f-da2e27dd61eb", "vulnerability": {"vulnId": "CVE-2026-66592", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "73f16751-7d4b-422b-978f-da2e27dd61eb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-26T07:10:46+00:00"}, "timestamps": {"asserted_at": "2026-10-26T07:10:46+00:00", "recorded_at": "2026-10-27T08:00:01+00:00", "first_seen_at": "2026-10-26T07:10:46+00:00"}, "scope": {"notes": "WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability | Affected: rtCamp / rtMedia for WordPress, BuddyPress and bbPress | CVSS: 9.3 (CRITICAL) | EPSS: 0.004 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability", "cve_id": "CVE-2026-66592", "vendor": "rtCamp", "ghsa_id": "GHSA-6G76-JFV7-JR9X", "product": "rtMedia for WordPress, BuddyPress and bbPress", "added_date": "2026-10-26T07:10:46.665Z", "cvss_score": 9.3, "epss_score": 0.004, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.34031, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-66592", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-66592", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66592"}, {"id": "GHSA-6G76-JFV7-JR9X", "url": "https://github.com/advisories/GHSA-6G76-JFV7-JR9X"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-66592"}]}, {"uuid": "6d88cf51-eb6b-4d74-acb7-934c18dc9b2f", "vulnerability": {"vulnId": "CVE-2026-109619", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "6d88cf51-eb6b-4d74-acb7-934c18dc9b2f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-26T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-26T00:00:00+00:00", "recorded_at": "2026-10-26T23:00:02+00:00", "first_seen_at": "2026-10-26T00:00:00+00:00"}, "scope": {"notes": "PHP Stale Internal Request-State Vulnerability | Affected: PHP Group / PHP | Description: PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ;  https://nvd.nist.gov/vuln/detail/CVE-2026-109619"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-416", "CWE-755", "CWE-824", "CWE-1325", "CWE-1419"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "PHP", "due_date": "2026-10-29", "date_added": "2026-10-26", "vendorProject": "PHP Group", "vulnerabilityName": "PHP Stale Internal Request-State Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-109619", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-109619"}]}, {"uuid": "4a664853-ae57-4521-91c7-321fec43778c", "vulnerability": {"vulnId": "CVE-2026-109618", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "4a664853-ae57-4521-91c7-321fec43778c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-26T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-26T00:00:00+00:00", "recorded_at": "2026-10-26T23:00:02+00:00", "first_seen_at": "2026-10-26T00:00:00+00:00"}, "scope": {"notes": "PHP Memory Corruption Vulnerability | Affected: PHP Group / PHP | Description: PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ;  https://nvd.nist.gov/vuln/detail/CVE-2026-109618"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-416", "CWE-755", "CWE-824", "CWE-1325", "CWE-1419"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "PHP", "due_date": "2026-10-29", "date_added": "2026-10-26", "vendorProject": "PHP Group", "vulnerabilityName": "PHP Memory Corruption Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-109618", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-109618"}]}, {"uuid": "45b08516-21cd-4a31-a665-db852c2639c5", "vulnerability": {"vulnId": "CVE-2015-0279", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "45b08516-21cd-4a31-a665-db852c2639c5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-25T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-25T00:00:00+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-25T00:00:00+00:00"}, "scope": {"notes": "Affected: Red Hat / JBoss RichFaces | Description: JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter. | Patched since: 2015/03/24 | Exploitation type: unknown | CWEs: CWE-95 | Origin source: CNW"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-95"], "euvd": "EUVD-2015-0292", "notes": "", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "JBoss RichFaces", "dateReported": "2026/10/25", "originSource": "CNW", "patchedSince": "2015/03/24", "vendorProject": "Red Hat", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2015-0279", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0279"}, {"id": "EUVD-2015-0292", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-0292"}]}, {"uuid": "a503489f-b016-4e93-a865-583a1f952675", "vulnerability": {"vulnId": "CVE-2024-6047", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "a503489f-b016-4e93-a865-583a1f952675"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-02T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-10-23T21:06:58+00:00", "recorded_at": "2026-11-04T01:00:02+00:00", "last_seen_at": "2026-11-02T00:00:00+00:00", "first_seen_at": "2026-10-23T21:06:58+00:00"}, "scope": {"notes": "Affected: GeoVision / GeoVision multiple EOL products | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-11-02: 126", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "GeoVision", "30d_avg": 0, "90d_avg": 0, "product": "GeoVision multiple EOL products", "cisa_kev": "yes", "connections": 126, "observation_date": "2026-11-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2024-6047", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6047"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "0429adcc-a0da-4b95-b3fc-583cf8b5a5b3", "vulnerability": {"vulnId": "CVE-2021-23337", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "0429adcc-a0da-4b95-b3fc-583cf8b5a5b3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-03T00:00:00+00:00"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-10-23T20:46:37+00:00", "recorded_at": "2026-11-05T01:00:01+00:00", "last_seen_at": "2026-11-03T00:00:00+00:00", "first_seen_at": "2026-10-23T20:46:37+00:00"}, "scope": {"notes": "Affected: Lodash / Template | Class: other-software | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-11-03: 6", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Lodash", "30d_avg": 0, "90d_avg": 0, "product": "Template", "cisa_kev": "no", "connections": 6, "observation_date": "2026-11-03", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2021-23337", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23337"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "95d610c7-70b3-4a7e-9ff0-0683c5a2ea04", "vulnerability": {"vulnId": "CVE-2026-106173", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "95d610c7-70b3-4a7e-9ff0-0683c5a2ea04"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-23T09:56:38+00:00"}, "timestamps": {"asserted_at": "2026-10-23T09:56:38+00:00", "recorded_at": "2026-10-24T10:00:01+00:00", "first_seen_at": "2026-10-23T09:56:38+00:00"}, "scope": {"notes": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to... | Affected: Fortinet / FortiSIEM | CVSS: 9.8 (CRITICAL) | EPSS: 0.00459 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to...", "cve_id": "CVE-2026-106173", "vendor": "Fortinet", "ghsa_id": null, "product": "FortiSIEM", "added_date": "2026-10-23T09:56:38.541Z", "cvss_score": 9.8, "epss_score": 0.00459, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.38811, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-106173", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-106173", "url": "https://www.cve.org/CVERecord?id=CVE-2026-106173"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-106173"}]}, {"uuid": "be4089a7-9955-4cdd-8779-b1d15cf95af3", "vulnerability": {"vulnId": "CVE-2026-105133", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "be4089a7-9955-4cdd-8779-b1d15cf95af3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-23T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-23T00:00:00+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Ahsay / AhsayCBS | Description: A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary. | Patched since: 2026/10/12 | Exploitation type: unknown | CWEs: CWE-287 | Origin source: CNW | Notes: https://github.com/advisories/GHSA-FP2J-3CMP-828J"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-287"], "euvd": "EUVD-2026-92079", "notes": "https://github.com/advisories/GHSA-FP2J-3CMP-828J", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "AhsayCBS", "dateReported": "2026/10/23", "originSource": "CNW", "patchedSince": "2026/10/12", "vendorProject": "Ahsay", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-105133", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105133"}, {"id": "EUVD-2026-92079", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92079"}, {"id": "source", "url": "https://github.com/advisories/GHSA-FP2J-3CMP-828J"}]}, {"uuid": "1e6b8452-5a41-4e7a-801d-21a4de850a78", "vulnerability": {"vulnId": "CVE-2026-110447", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "1e6b8452-5a41-4e7a-801d-21a4de850a78"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-23T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-23T00:00:00+00:00", "recorded_at": "2026-10-23T20:00:02+00:00", "first_seen_at": "2026-10-23T00:00:00+00:00"}, "scope": {"notes": "Collabora Online \u2013 Built-in CODE Server OS Command Injection Vulnerability | Affected: Collabora / Collabora Online \u2013 Built-in CODE Server | Description: Collabora Collabora Online \u2013 Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-26 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 ; https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-110447"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-78"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "Collabora Online \u2013 Built-in CODE Server", "due_date": "2026-10-26", "date_added": "2026-10-23", "vendorProject": "Collabora", "vulnerabilityName": "Collabora Online \u2013 Built-in CODE Server OS Command Injection Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-110447", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-110447"}]}, {"uuid": "0c2360d5-e9cf-484d-abec-c014b2d534b8", "vulnerability": {"vulnId": "CVE-2026-114625", "altId": []}, "gcve": {"origin_uuid": "405284c2-e461-4670-8979-7fd2c9755a60", "gna": 1, "object_uuid": "0c2360d5-e9cf-484d-abec-c014b2d534b8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-23T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-23T00:00:00+00:00", "recorded_at": "2026-10-23T18:00:01+00:00", "first_seen_at": "2026-10-23T00:00:00+00:00"}, "scope": {"notes": "Arista VeloCloud Orchestrator SQL Injection Vulnerability | Affected: Arista / VeloCloud Orchestrator | Description: Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-26 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-114625"}, "evidence": [{"type": "vendor_report", "source": "cisa-kev", "signal": "successful_exploitation", "confidence": 0.8, "details": {"cwes": ["CWE-89"], "feed": "CISA Known Exploited Vulnerabilities Catalog", "product": "VeloCloud Orchestrator", "due_date": "2026-10-26", "date_added": "2026-10-23", "vendorProject": "Arista", "vulnerabilityName": "Arista VeloCloud Orchestrator SQL Injection Vulnerability", "knownRansomwareCampaignUse": "Unknown"}}], "references": [{"id": "CVE-2026-114625", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-114625"}]}, {"uuid": "08788070-9e45-4089-9d67-1b98a149d8a9", "vulnerability": {"vulnId": "CVE-2026-105134", "altId": []}, "gcve": {"origin_uuid": "cce329bf-df49-4c6e-a027-80be2e6483bd", "gna": 1, "object_uuid": "08788070-9e45-4089-9d67-1b98a149d8a9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-23T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-23T00:00:00+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-23T00:00:00+00:00"}, "scope": {"notes": "Affected: Ahsay / AhsayCBS | Description: A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary. | Patched since: 2026/10/12 | Exploitation type: unknown | CWEs: CWE-77 | Origin source: CNW | Notes: https://github.com/advisories/GHSA-MXJ3-2X8Q-2RH9"}, "evidence": [{"type": "csirt_report", "source": "enisa-cnw-kev", "signal": "successful_exploitation", "confidence": 0.75, "details": {"cwes": ["CWE-77"], "euvd": "EUVD-2026-92078", "notes": "https://github.com/advisories/GHSA-MXJ3-2X8Q-2RH9", "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON", "product": "AhsayCBS", "dateReported": "2026/10/23", "originSource": "CNW", "patchedSince": "2026/10/12", "vendorProject": "Ahsay", "exploitationType": ["unknown"], "vulnerabilityName": "", "threatActorsExploiting": []}}], "references": [{"id": "CVE-2026-105134", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105134"}, {"id": "EUVD-2026-92078", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92078"}, {"id": "source", "url": "https://github.com/advisories/GHSA-MXJ3-2X8Q-2RH9"}]}, {"uuid": "f61f6922-f7da-46bd-83b7-945a495046dc", "vulnerability": {"vulnId": "CVE-2026-109619", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f61f6922-f7da-46bd-83b7-945a495046dc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-22T20:30:23+00:00"}, "timestamps": {"asserted_at": "2026-10-22T20:30:23+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-22T20:30:23+00:00"}, "scope": {"notes": "RCE via stale global state | Affected: PHP Group / PHP | CVSS: 9.2 (CRITICAL) | EPSS: 0.99999 | Used in malware: yes | Listed 4 days ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "confirmed_compromise", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "RCE via stale global state", "cve_id": "CVE-2026-109619", "vendor": "PHP Group", "ghsa_id": null, "product": "PHP", "added_date": "2026-10-22T20:30:23.986Z", "cvss_score": 9.2, "epss_score": 0.99999, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": true, "cvss_estimated": false, "epss_percentile": 0.99999, "used_in_malware": "yes", "vulnerability_id": "CVE-2026-109619", "ahead_of_cisa_kev": {"unit": "day", "count": 4}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-109619", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109619"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-109619"}]}, {"uuid": "35d911bd-c55d-4fb6-b61c-0fc3f5fbcbad", "vulnerability": {"vulnId": "CVE-2026-114625", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "35d911bd-c55d-4fb6-b61c-0fc3f5fbcbad"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-22T20:20:51+00:00"}, "timestamps": {"asserted_at": "2026-10-22T20:20:51+00:00", "recorded_at": "2026-10-23T21:00:01+00:00", "first_seen_at": "2026-10-22T20:20:51+00:00"}, "scope": {"notes": "Security Advisory 0199 | Affected: Arista / VeloCloud Orchestrator | CVSS: 9.4 (CRITICAL) | EPSS: 0.00555 | Used in malware: unknown | Listed 21 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Security Advisory 0199", "cve_id": "CVE-2026-114625", "vendor": "Arista", "ghsa_id": null, "product": "VeloCloud Orchestrator", "added_date": "2026-10-22T20:20:51.537Z", "cvss_score": 9.4, "epss_score": 0.00555, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.45586, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-114625", "ahead_of_cisa_kev": {"unit": "hour", "count": 21}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-114625", "url": "https://www.cve.org/CVERecord?id=CVE-2026-114625"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-114625"}]}, {"uuid": "771c500b-bad5-4488-8690-3c203561e4ee", "vulnerability": {"vulnId": "CVE-2026-97237", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "771c500b-bad5-4488-8690-3c203561e4ee"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-22T17:01:06+00:00"}, "timestamps": {"asserted_at": "2026-10-22T17:01:06+00:00", "recorded_at": "2026-10-23T18:00:01+00:00", "first_seen_at": "2026-10-22T17:01:06+00:00"}, "scope": {"notes": "WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability | Affected: Crocoblock / JetEngine | CVSS: 7.1 (HIGH) | EPSS: 0.0018 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability", "cve_id": "CVE-2026-97237", "vendor": "Crocoblock", "ghsa_id": "GHSA-X3P8-H246-R4FC", "product": "JetEngine", "added_date": "2026-10-22T17:01:06.799Z", "cvss_score": 7.1, "epss_score": 0.0018, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.07179, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-97237", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-97237", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97237"}, {"id": "GHSA-X3P8-H246-R4FC", "url": "https://github.com/advisories/GHSA-X3P8-H246-R4FC"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-97237"}]}, {"uuid": "494c276e-d05e-4604-91cc-cdd18db46783", "vulnerability": {"vulnId": "CVE-2023-50917", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "494c276e-d05e-4604-91cc-cdd18db46783"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-27T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-10-22T15:46:25+00:00", "recorded_at": "2026-10-29T01:00:01+00:00", "last_seen_at": "2026-10-27T00:00:00+00:00", "first_seen_at": "2026-10-22T15:46:25+00:00"}, "scope": {"notes": "Affected: MajorDoMo / thumb.php | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-10-27: 76", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "MajorDoMo", "30d_avg": 0, "90d_avg": 0, "product": "thumb.php", "cisa_kev": "no", "connections": 76, "observation_date": "2026-10-27", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-50917", "url": "https://www.cve.org/CVERecord?id=CVE-2023-50917"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ab32669e-8833-49b2-a508-3b4b8f27a859", "vulnerability": {"vulnId": "CVE-2026-109619", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ab32669e-8833-49b2-a508-3b4b8f27a859"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-23T00:00:00+00:00"}, "characteristics": {"severity": 92}, "timestamps": {"asserted_at": "2026-10-22T15:19:12+00:00", "recorded_at": "2026-10-25T01:00:01+00:00", "last_seen_at": "2026-10-23T00:00:00+00:00", "first_seen_at": "2026-10-22T15:19:12+00:00"}, "scope": {"notes": "Affected: PHP / PHP | Class: web-app-framework | Severity: Critical (CVSS 9.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-10-23: 202", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "13", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 4, "vendor": "PHP", "30d_avg": 1, "90d_avg": 0, "product": "PHP", "cisa_kev": "no", "connections": 202, "observation_date": "2026-10-23", "vulnerability_class": "CVSS", "vulnerability_score": 9.2, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-109619", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109619"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d0da0df4-358e-4097-a29d-421bf7323c29", "vulnerability": {"vulnId": "CVE-2025-71434", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d0da0df4-358e-4097-a29d-421bf7323c29"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-22T11:10:56+00:00"}, "timestamps": {"asserted_at": "2026-10-22T11:10:56+00:00", "recorded_at": "2026-10-23T12:00:02+00:00", "first_seen_at": "2026-10-22T11:10:56+00:00"}, "scope": {"notes": "Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list | Affected: Weaver Network / E-cology | CVSS: 8.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list", "cve_id": "CVE-2025-71434", "vendor": "Weaver Network", "ghsa_id": null, "product": "E-cology", "added_date": "2026-10-22T11:10:56.048Z", "cvss_score": 8.8, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-71434", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-71434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71434"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-71434"}]}, {"uuid": "e09d9a6f-f89d-4b26-8f78-e406bd22e5e5", "vulnerability": {"vulnId": "CVE-2024-58394", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e09d9a6f-f89d-4b26-8f78-e406bd22e5e5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-22T11:10:55+00:00"}, "timestamps": {"asserted_at": "2026-10-22T11:10:55+00:00", "recorded_at": "2026-11-04T13:00:01+00:00", "first_seen_at": "2026-10-22T11:10:55+00:00"}, "scope": {"notes": "Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying | Affected: Retool / Retool | CVSS: 5.1 (MEDIUM) | EPSS: 0.00204 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying", "cve_id": "CVE-2024-58394", "vendor": "Retool", "ghsa_id": null, "product": "Retool", "added_date": "2026-10-22T11:10:55.639Z", "cvss_score": 5.1, "epss_score": 0.00204, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.10422, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-58394", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-58394", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58394"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-58394"}]}, {"uuid": "a4c17612-5855-4d91-b508-95f435c3c6e2", "vulnerability": {"vulnId": "CVE-2024-58396", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a4c17612-5855-4d91-b508-95f435c3c6e2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-22T11:10:55+00:00"}, "timestamps": {"asserted_at": "2026-10-22T11:10:55+00:00", "recorded_at": "2026-10-23T12:00:02+00:00", "first_seen_at": "2026-10-22T11:10:55+00:00"}, "scope": {"notes": "YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId | Affected: YouDataSum / CPAS Audit Management System | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId", "cve_id": "CVE-2024-58396", "vendor": "YouDataSum", "ghsa_id": null, "product": "CPAS Audit Management System", "added_date": "2026-10-22T11:10:55.807Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-58396", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-58396", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58396"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-58396"}]}, {"uuid": "930cdda0-4dc9-4e0f-a9ff-a32993a9a551", "vulnerability": {"vulnId": "CVE-2024-58393", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "930cdda0-4dc9-4e0f-a9ff-a32993a9a551"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-22T11:10:55+00:00"}, "timestamps": {"asserted_at": "2026-10-22T11:10:55+00:00", "recorded_at": "2026-10-23T12:00:02+00:00", "first_seen_at": "2026-10-22T11:10:55+00:00"}, "scope": {"notes": "i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php | Affected: i-Netsolution / Readymade Unilevel Ecommerce MLM | CVSS: 8.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php", "cve_id": "CVE-2024-58393", "vendor": "i-Netsolution", "ghsa_id": null, "product": "Readymade Unilevel Ecommerce MLM", "added_date": "2026-10-22T11:10:55.413Z", "cvss_score": 8.8, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-58393", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-58393", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58393"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-58393"}]}, {"uuid": "66a27121-5250-4e9f-b26d-06ed577f7aaf", "vulnerability": {"vulnId": "CVE-2023-54413", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "66a27121-5250-4e9f-b26d-06ed577f7aaf"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-22T11:10:55+00:00"}, "timestamps": {"asserted_at": "2026-10-22T11:10:55+00:00", "recorded_at": "2026-10-23T12:00:02+00:00", "first_seen_at": "2026-10-22T11:10:55+00:00"}, "scope": {"notes": "WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang | Affected: OnTheGoSystems / WPML Multilingual CMS | CVSS: 5.1 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang", "cve_id": "CVE-2023-54413", "vendor": "OnTheGoSystems", "ghsa_id": null, "product": "WPML Multilingual CMS", "added_date": "2026-10-22T11:10:55.202Z", "cvss_score": 5.1, "epss_score": null, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-54413", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-54413", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54413"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-54413"}]}]}