{"metadata": {"count": 2686, "page": 1, "per_page": 100}, "data": [{"uuid": "f017bbfc-d082-444c-9aa6-581c9512a7a3", "vulnerability": {"vulnId": "CVE-2014-2383", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f017bbfc-d082-444c-9aa6-581c9512a7a3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-25T11:07:06+00:00"}, "timestamps": {"asserted_at": "2026-07-25T11:07:06+00:00", "recorded_at": "2026-07-25T12:00:01+00:00", "first_seen_at": "2026-07-25T11:07:06+00:00"}, "scope": {"notes": "dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read... | Affected: dompdf / dompdf | CVSS: 6.8 (MEDIUM) | EPSS: 0.39231 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read...", "vendor": "dompdf", "product": "dompdf", "added_date": "2026-07-25T11:07:06.460Z", "cvss_score": 6.8, "epss_score": 0.39231, "cvss_severity": "MEDIUM", "epss_percentile": 0.98447, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2014-2383", "url": "https://www.cve.org/CVERecord?id=CVE-2014-2383"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2014-2383"}]}, {"uuid": "ac903c11-aca3-458f-a80d-d45bf742c563", "vulnerability": {"vulnId": "CVE-2026-16723", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ac903c11-aca3-458f-a80d-d45bf742c563"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-25T02:23:23+00:00"}, "timestamps": {"asserted_at": "2026-07-25T02:23:23+00:00", "recorded_at": "2026-07-25T12:00:01+00:00", "first_seen_at": "2026-07-25T02:23:23+00:00"}, "scope": {"notes": "Remote Code Execution in fastjson 1.2.68\u20131.2.83 | Affected: Alibaba / Fastjson | CVSS: 9.0 (CRITICAL) | EPSS: 0.00413 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Remote Code Execution in fastjson 1.2.68\u20131.2.83", "vendor": "Alibaba", "product": "Fastjson", "added_date": "2026-07-25T02:23:23.000Z", "cvss_score": 9.0, "epss_score": 0.00413, "cvss_severity": "CRITICAL", "epss_percentile": 0.3383, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-16723", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16723"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-16723"}]}, {"uuid": "a4d5e8f4-d0f8-4147-b66f-584314cfea81", "vulnerability": {"vulnId": "CVE-2025-4283", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a4d5e8f4-d0f8-4147-b66f-584314cfea81"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-24T08:52:14+00:00"}, "timestamps": {"asserted_at": "2026-07-24T08:52:14+00:00", "recorded_at": "2026-07-24T09:00:01+00:00", "first_seen_at": "2026-07-24T08:52:14+00:00"}, "scope": {"notes": "SourceCodester/oretnom23 Stock Management System Login.php sql injection | Affected: SourceCodester, oretnom23 / Stock Management System | CVSS: 6.9 (MEDIUM) | EPSS: 0.00491 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SourceCodester/oretnom23 Stock Management System Login.php sql injection", "vendor": "SourceCodester, oretnom23", "product": "Stock Management System", "added_date": "2026-07-24T08:52:14.602Z", "cvss_score": 6.9, "epss_score": 0.00491, "cvss_severity": "MEDIUM", "epss_percentile": 0.39307, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-4283", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4283"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-4283"}]}, {"uuid": "0c739051-a426-4ad6-8fb8-5fe405382039", "vulnerability": {"vulnId": "CVE-2016-3081", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0c739051-a426-4ad6-8fb8-5fe405382039"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-23T09:37:25+00:00"}, "timestamps": {"asserted_at": "2026-07-23T09:37:25+00:00", "recorded_at": "2026-07-23T10:00:01+00:00", "first_seen_at": "2026-07-23T09:37:25+00:00"}, "scope": {"notes": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to... | Affected: Apache / Struts | CVSS: 8.1 (HIGH) | EPSS: 0.93249 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to...", "vendor": "Apache", "product": "Struts", "added_date": "2026-07-23T09:37:25.728Z", "cvss_score": 8.1, "epss_score": 0.93249, "cvss_severity": "HIGH", "epss_percentile": 0.99824, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2016-3081", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3081"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2016-3081"}]}, {"uuid": "d66db7d5-24d6-4124-9455-9bff341e18ce", "vulnerability": {"vulnId": "CVE-2026-16232", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d66db7d5-24d6-4124-9455-9bff341e18ce"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-22T15:57:00+00:00"}, "timestamps": {"asserted_at": "2026-07-22T15:57:00+00:00", "recorded_at": "2026-07-22T16:00:01+00:00", "first_seen_at": "2026-07-22T15:57:00+00:00"}, "scope": {"notes": "Authentication Bypass in the SmartConsole Login Process Using an Application Token | Affected: checkpoint / Quantum Security Management, Multi-Domain Security Management | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Authentication Bypass in the SmartConsole Login Process Using an Application Token", "vendor": "checkpoint", "product": "Quantum Security Management, Multi-Domain Security Management", "added_date": "2026-07-22T15:57:00.000Z", "cvss_score": null, "epss_score": null, "cvss_severity": null, "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-16232", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16232"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-16232"}]}, {"uuid": "626d6582-9620-47d1-aa26-819dfa407909", "vulnerability": {"vulnId": "CVE-2026-29059", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "626d6582-9620-47d1-aa26-819dfa407909"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-22T12:36:36+00:00"}, "timestamps": {"asserted_at": "2026-07-22T12:36:36+00:00", "recorded_at": "2026-07-22T15:00:01+00:00", "first_seen_at": "2026-07-22T12:36:36+00:00"}, "scope": {"notes": "Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly | Affected: windmill-labs / windmill | CVSS: 6.9 (MEDIUM) | EPSS: 0.02584 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly", "vendor": "windmill-labs", "product": "windmill", "added_date": "2026-07-22T12:36:36.000Z", "cvss_score": 6.9, "epss_score": 0.02584, "cvss_severity": "MEDIUM", "epss_percentile": 0.83609, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-29059", "url": "https://www.cve.org/CVERecord?id=CVE-2026-29059"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-29059"}]}, {"uuid": "910a7498-7d64-4605-a767-ff55aefe2721", "vulnerability": {"vulnId": "CVE-2026-36356", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "910a7498-7d64-4605-a767-ff55aefe2721"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-22T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-22T00:00:00+00:00", "recorded_at": "2026-07-23T11:00:02+00:00", "first_seen_at": "2026-07-22T00:00:00+00:00"}, "scope": {"notes": "The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection... | Affected: MeiG / Smart FORGE_SLT711 | CVSS: 9.1 (CRITICAL) | EPSS: 0.13549 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection...", "vendor": "MeiG", "product": "Smart FORGE_SLT711", "added_date": "2026-07-22T00:00:00.000Z", "cvss_score": 9.1, "epss_score": 0.13549, "cvss_severity": "CRITICAL", "epss_percentile": 0.96056, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-36356", "url": "https://www.cve.org/CVERecord?id=CVE-2026-36356"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-36356"}]}, {"uuid": "bef6a0e7-c26d-47ce-8300-4036ec3b51a2", "vulnerability": {"vulnId": "CVE-2026-0770", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "bef6a0e7-c26d-47ce-8300-4036ec3b51a2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-21T14:32:22+00:00"}, "timestamps": {"asserted_at": "2026-07-21T14:32:22+00:00", "recorded_at": "2026-07-21T15:00:01+00:00", "first_seen_at": "2026-07-21T14:32:22+00:00"}, "scope": {"notes": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability | Affected: Langflow / Langflow | CVSS: 9.8 (CRITICAL) | EPSS: 0.10371 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability", "vendor": "Langflow", "product": "Langflow", "added_date": "2026-07-21T14:32:22.598Z", "cvss_score": 9.8, "epss_score": 0.10371, "cvss_severity": "CRITICAL", "epss_percentile": 0.95225, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-0770", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0770"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-0770"}]}, {"uuid": "0912e7a5-8931-4840-b5b7-3ea958a72576", "vulnerability": {"vulnId": "CVE-2021-27137", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0912e7a5-8931-4840-b5b7-3ea958a72576"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-21T14:32:22+00:00"}, "timestamps": {"asserted_at": "2026-07-21T14:32:22+00:00", "recorded_at": "2026-07-21T15:00:01+00:00", "first_seen_at": "2026-07-21T14:32:22+00:00"}, "scope": {"notes": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an... | Affected: DD-WRT / DD-WRT | CVSS: 8.1 (HIGH) | EPSS: 0.05447 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an...", "vendor": "DD-WRT", "product": "DD-WRT", "added_date": "2026-07-21T14:32:22.598Z", "cvss_score": 8.1, "epss_score": 0.05447, "cvss_severity": "HIGH", "epss_percentile": 0.91861, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2021-27137", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27137"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-27137"}]}, {"uuid": "82969677-7927-4d0b-9056-c5fe9ce59e97", "vulnerability": {"vulnId": "CVE-2026-50522", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "82969677-7927-4d0b-9056-c5fe9ce59e97"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-21T10:24:00+00:00"}, "timestamps": {"asserted_at": "2026-07-21T10:24:00+00:00", "recorded_at": "2026-07-21T11:00:02+00:00", "first_seen_at": "2026-07-21T10:24:00+00:00"}, "scope": {"notes": "Microsoft SharePoint Remote Code Execution Vulnerability | Affected: Microsoft / Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition | CVSS: 9.8 (CRITICAL) | EPSS: 0.20346 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Microsoft SharePoint Remote Code Execution Vulnerability", "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition", "added_date": "2026-07-21T10:24:00.000Z", "cvss_score": 9.8, "epss_score": 0.20346, "cvss_severity": "CRITICAL", "epss_percentile": 0.97202, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-50522", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50522"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-50522"}]}, {"uuid": "69756ecd-e976-4b99-a8b4-c786d1056cd8", "vulnerability": {"vulnId": "CVE-2026-48611", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "69756ecd-e976-4b99-a8b4-c786d1056cd8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-20T07:57:22+00:00"}, "timestamps": {"asserted_at": "2026-07-20T07:57:22+00:00", "recorded_at": "2026-07-20T08:00:01+00:00", "first_seen_at": "2026-07-20T07:57:22+00:00"}, "scope": {"notes": "Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to... | Affected: phpBB / phpBB | CVSS: 9.8 (CRITICAL) | EPSS: 0.02865 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to...", "vendor": "phpBB", "product": "phpBB", "added_date": "2026-07-20T07:57:22.068Z", "cvss_score": 9.8, "epss_score": 0.02865, "cvss_severity": "CRITICAL", "epss_percentile": 0.8522, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-48611", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48611"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48611"}]}, {"uuid": "47a536a1-85f9-4138-a1d5-9c01627e2315", "vulnerability": {"vulnId": "CVE-2025-68493", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "47a536a1-85f9-4138-a1d5-9c01627e2315"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-20T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-20T00:00:00+00:00", "recorded_at": "2026-07-21T11:00:02+00:00", "first_seen_at": "2026-07-20T00:00:00+00:00"}, "scope": {"notes": "Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component | Affected: Apache Software Foundation / Apache Struts | CVSS: 8.1 (HIGH) | EPSS: 0.23054 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component", "vendor": "Apache Software Foundation", "product": "Apache Struts", "added_date": "2026-07-20T00:00:00.000Z", "cvss_score": 8.1, "epss_score": 0.23054, "cvss_severity": "HIGH", "epss_percentile": 0.97507, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-68493", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68493"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-68493"}]}, {"uuid": "d6e69532-3fcd-4c6f-8614-6b20e1245334", "vulnerability": {"vulnId": "CVE-2026-22679", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d6e69532-3fcd-4c6f-8614-6b20e1245334"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-19T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-19T00:00:00+00:00", "recorded_at": "2026-07-20T11:00:02+00:00", "first_seen_at": "2026-07-19T00:00:00+00:00"}, "scope": {"notes": "Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint | Affected: Weaver Network Co., Ltd. / E-cology | CVSS: 9.3 (CRITICAL) | EPSS: 0.2148 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint", "vendor": "Weaver Network Co., Ltd.", "product": "E-cology", "added_date": "2026-07-19T00:00:00.000Z", "cvss_score": 9.3, "epss_score": 0.2148, "cvss_severity": "CRITICAL", "epss_percentile": 0.97341, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-22679", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22679"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-22679"}]}, {"uuid": "a8d657c5-c777-4516-a1a5-d052f50b82be", "vulnerability": {"vulnId": "CVE-2026-63030", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a8d657c5-c777-4516-a1a5-d052f50b82be"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-18T16:03:00+00:00"}, "timestamps": {"asserted_at": "2026-07-18T16:03:00+00:00", "recorded_at": "2026-07-19T17:00:01+00:00", "first_seen_at": "2026-07-18T16:03:00+00:00"}, "scope": {"notes": "WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | Affected: WordPress / WordPress | CVSS: 9.8 (CRITICAL) | EPSS: 0.08946 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution", "vendor": "WordPress", "product": "WordPress", "added_date": "2026-07-18T16:03:00.000Z", "cvss_score": 9.8, "epss_score": 0.08946, "cvss_severity": "CRITICAL", "epss_percentile": 0.94668, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-63030", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63030"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-63030"}]}, {"uuid": "8d6ec1a6-0a0b-4316-8704-6d652396db19", "vulnerability": {"vulnId": "CVE-2026-60137", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8d6ec1a6-0a0b-4316-8704-6d652396db19"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-18T15:32:00+00:00"}, "timestamps": {"asserted_at": "2026-07-18T15:32:00+00:00", "recorded_at": "2026-07-19T16:00:01+00:00", "first_seen_at": "2026-07-18T15:32:00+00:00"}, "scope": {"notes": "WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | Affected: WordPress / WordPress | CVSS: 5.9 (MEDIUM) | EPSS: 0.04026 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query", "vendor": "WordPress", "product": "WordPress", "added_date": "2026-07-18T15:32:00.000Z", "cvss_score": 5.9, "epss_score": 0.04026, "cvss_severity": "MEDIUM", "epss_percentile": 0.89451, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-60137", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60137"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-60137"}]}, {"uuid": "85d8f5a6-1f65-43ae-99b9-83a6f1dc4d62", "vulnerability": {"vulnId": "CVE-2026-6875", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "85d8f5a6-1f65-43ae-99b9-83a6f1dc4d62"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-18T10:55:00+00:00"}, "timestamps": {"asserted_at": "2026-07-18T10:55:00+00:00", "recorded_at": "2026-07-20T09:00:02+00:00", "first_seen_at": "2026-07-18T10:55:00+00:00"}, "scope": {"notes": "Sandbox Escape in ServiceNow AI Platform | Affected: ServiceNow / ServiceNow AI Platform | CVSS: 9.5 (CRITICAL) | EPSS: 0.00509 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Sandbox Escape in ServiceNow AI Platform", "vendor": "ServiceNow", "product": "ServiceNow AI Platform", "added_date": "2026-07-18T10:55:00.000Z", "cvss_score": 9.5, "epss_score": 0.00509, "cvss_severity": "CRITICAL", "epss_percentile": 0.40039, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-6875", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6875"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-6875"}]}, {"uuid": "863e96d2-7d1c-4108-8e55-ed71b3ff2bb3", "vulnerability": {"vulnId": "CVE-2024-36420", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "863e96d2-7d1c-4108-8e55-ed71b3ff2bb3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-17T08:33:53+00:00"}, "timestamps": {"asserted_at": "2026-07-17T08:33:53+00:00", "recorded_at": "2026-07-17T09:00:01+00:00", "first_seen_at": "2026-07-17T08:33:53+00:00"}, "scope": {"notes": "GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file | Affected: FlowiseAI / Flowise | CVSS: 7.5 (HIGH) | EPSS: 0.01776 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file", "vendor": "FlowiseAI", "product": "Flowise", "added_date": "2026-07-17T08:33:53.505Z", "cvss_score": 7.5, "epss_score": 0.01776, "cvss_severity": "HIGH", "epss_percentile": 0.75707, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-36420", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36420"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-36420"}]}, {"uuid": "91a28016-23d4-45f5-b951-0a883f6f08ac", "vulnerability": {"vulnId": "CVE-2026-46442", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "91a28016-23d4-45f5-b951-0a883f6f08ac"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-17T07:51:05+00:00"}, "timestamps": {"asserted_at": "2026-07-17T07:51:05+00:00", "recorded_at": "2026-07-17T08:00:01+00:00", "first_seen_at": "2026-07-17T07:51:05+00:00"}, "scope": {"notes": "Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape | Affected: FlowiseAI / Flowise | CVSS: 9.4 (CRITICAL) | EPSS: 0.0082 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape", "vendor": "FlowiseAI", "product": "Flowise", "added_date": "2026-07-17T07:51:05.707Z", "cvss_score": 9.4, "epss_score": 0.0082, "cvss_severity": "CRITICAL", "epss_percentile": 0.53112, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-46442", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46442"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-46442"}]}, {"uuid": "d39fc083-8f7b-4775-973e-4b573c0eb3a8", "vulnerability": {"vulnId": "CVE-2026-25089", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d39fc083-8f7b-4775-973e-4b573c0eb3a8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T17:00:15+00:00"}, "timestamps": {"asserted_at": "2026-07-16T17:00:15+00:00", "recorded_at": "2026-07-16T18:00:01+00:00", "first_seen_at": "2026-07-16T17:00:15+00:00"}, "scope": {"notes": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through... | Affected: Fortinet / FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS | CVSS: 9.8 (CRITICAL) | EPSS: 0.23393 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through...", "vendor": "Fortinet", "product": "FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS", "added_date": "2026-07-16T17:00:15.684Z", "cvss_score": 9.8, "epss_score": 0.23393, "cvss_severity": "CRITICAL", "epss_percentile": 0.97528, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-25089", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25089"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-25089"}]}, {"uuid": "d2e13884-62b5-4b7e-9f7e-242eb02a64b1", "vulnerability": {"vulnId": "CVE-2023-4346", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d2e13884-62b5-4b7e-9f7e-242eb02a64b1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T16:42:14+00:00"}, "timestamps": {"asserted_at": "2026-07-15T16:42:14+00:00", "recorded_at": "2026-07-15T18:00:02+00:00", "first_seen_at": "2026-07-15T16:42:14+00:00"}, "scope": {"notes": "\nKNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users... | Affected: KNX Association / KNX Protocol Connection Authorization Option 1 | CVSS: 7.5 (HIGH) | EPSS: 0.00483 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "\nKNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users...", "vendor": "KNX Association", "product": "KNX Protocol Connection Authorization Option 1", "added_date": "2026-07-15T16:42:14.826Z", "cvss_score": 7.5, "epss_score": 0.00483, "cvss_severity": "HIGH", "epss_percentile": 0.38438, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2023-4346", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4346"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-4346"}]}, {"uuid": "801dc833-482d-4ed3-8bcc-a2f5d72b9fad", "vulnerability": {"vulnId": "CVE-2026-15410", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "801dc833-482d-4ed3-8bcc-a2f5d72b9fad"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T19:00:56+00:00"}, "timestamps": {"asserted_at": "2026-07-14T19:00:56+00:00", "recorded_at": "2026-07-14T21:00:01+00:00", "first_seen_at": "2026-07-14T19:00:56+00:00"}, "scope": {"notes": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management... | Affected: SonicWall / SMA1000 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management...", "vendor": "SonicWall", "product": "SMA1000", "added_date": "2026-07-14T19:00:56.138Z", "cvss_score": null, "epss_score": null, "cvss_severity": null, "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-15410", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15410"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-15410"}]}, {"uuid": "34c85e31-e0d4-4c40-9da2-bd1a5ce5c375", "vulnerability": {"vulnId": "CVE-2026-15409", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "34c85e31-e0d4-4c40-9da2-bd1a5ce5c375"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T18:18:00+00:00"}, "timestamps": {"asserted_at": "2026-07-14T18:18:00+00:00", "recorded_at": "2026-07-14T19:00:02+00:00", "first_seen_at": "2026-07-14T18:18:00+00:00"}, "scope": {"notes": "Sonicwall SMA1000 Appliance Work Place interface - Unauthenticated Server-side request forgery (SSRF) | Affected: Sonicwall / SMA1000 | CVSS: 10.0 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Sonicwall SMA1000 Appliance Work Place interface - Unauthenticated Server-side request forgery (SSRF)", "vendor": "Sonicwall", "product": "SMA1000", "added_date": "2026-07-14T18:18:00.000Z", "cvss_score": 10.0, "epss_score": null, "cvss_severity": "CRITICAL", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-15409", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15409"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-15409"}]}, {"uuid": "668b2838-95c6-4ab3-abc0-8c35823f659e", "vulnerability": {"vulnId": "CVE-2026-56164", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "668b2838-95c6-4ab3-abc0-8c35823f659e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T07:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-14T07:00:00+00:00", "recorded_at": "2026-07-14T18:00:02+00:00", "first_seen_at": "2026-07-14T07:00:00+00:00"}, "scope": {"notes": "Microsoft SharePoint Server Elevation of Privilege Vulnerability | Affected: Microsoft / Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition | CVSS: 5.3 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Microsoft SharePoint Server Elevation of Privilege Vulnerability", "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition", "added_date": "2026-07-14T07:00:00.000Z", "cvss_score": 5.3, "epss_score": null, "cvss_severity": "MEDIUM", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-56164", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56164"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-56164"}]}, {"uuid": "3d723813-809e-42df-ae57-9da291055398", "vulnerability": {"vulnId": "CVE-2026-56155", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3d723813-809e-42df-ae57-9da291055398"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T07:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-14T07:00:00+00:00", "recorded_at": "2026-07-14T18:00:02+00:00", "first_seen_at": "2026-07-14T07:00:00+00:00"}, "scope": {"notes": "Active Directory Federation Services Elevation of Privilege Vulnerability | Affected: Microsoft / Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core installation) | CVSS: 7.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Active Directory Federation Services Elevation of Privilege Vulnerability", "vendor": "Microsoft", "product": "Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core installation)", "added_date": "2026-07-14T07:00:00.000Z", "cvss_score": 7.8, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-56155", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56155"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-56155"}]}, {"uuid": "8bd46325-bd51-49ff-a693-75c9d4712903", "vulnerability": {"vulnId": "CVE-2008-4128", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8bd46325-bd51-49ff-a693-75c9d4712903"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T17:00:17+00:00"}, "timestamps": {"asserted_at": "2026-07-13T17:00:17+00:00", "recorded_at": "2026-07-13T18:00:01+00:00", "first_seen_at": "2026-07-13T17:00:17+00:00"}, "scope": {"notes": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services... | Affected: Cisco / IOS | CVSS: 4.3 (MEDIUM) | EPSS: 0.12036 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services...", "vendor": "Cisco", "product": "IOS", "added_date": "2026-07-13T17:00:17.965Z", "cvss_score": 4.3, "epss_score": 0.12036, "cvss_severity": "MEDIUM", "epss_percentile": 0.95649, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2008-4128", "url": "https://www.cve.org/CVERecord?id=CVE-2008-4128"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2008-4128"}]}, {"uuid": "d65c1e29-a984-4a2c-a49a-1d3b3381388c", "vulnerability": {"vulnId": "CVE-2024-29972", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d65c1e29-a984-4a2c-a49a-1d3b3381388c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-13T00:00:00+00:00", "recorded_at": "2026-07-14T11:00:01+00:00", "first_seen_at": "2026-07-13T00:00:00+00:00"}, "scope": {"notes": "** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the CGI program \"remote_help-cgi\" in Zyxel NAS326 firmware versions before... | Affected: Zyxel / NAS326 firmware, NAS542 firmware | CVSS: 9.8 (CRITICAL) | EPSS: 0.89218 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the CGI program \"remote_help-cgi\" in Zyxel NAS326 firmware versions before...", "vendor": "Zyxel", "product": "NAS326 firmware, NAS542 firmware", "added_date": "2026-07-13T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.89218, "cvss_severity": "CRITICAL", "epss_percentile": 0.99766, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-29972", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29972"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-29972"}]}, {"uuid": "e8ce3b4b-518e-4cc5-ad71-9781806a54ef", "vulnerability": {"vulnId": "CVE-2026-48939", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e8ce3b4b-518e-4cc5-ad71-9781806a54ef"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T17:00:25+00:00"}, "timestamps": {"asserted_at": "2026-07-10T17:00:25+00:00", "recorded_at": "2026-07-10T18:00:02+00:00", "first_seen_at": "2026-07-10T17:00:25+00:00"}, "scope": {"notes": "Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 | Affected: icagenda.com / iCagenda extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.00564 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15", "vendor": "icagenda.com", "product": "iCagenda extension for Joomla", "added_date": "2026-07-10T17:00:25.732Z", "cvss_score": 10.0, "epss_score": 0.00564, "cvss_severity": "CRITICAL", "epss_percentile": 0.42883, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-48939", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48939"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48939"}]}, {"uuid": "7f8175a4-d002-4926-ad93-9c4b5f79efc9", "vulnerability": {"vulnId": "CVE-2026-56291", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7f8175a4-d002-4926-ad93-9c4b5f79efc9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T17:00:25+00:00"}, "timestamps": {"asserted_at": "2026-07-10T17:00:25+00:00", "recorded_at": "2026-07-10T18:00:02+00:00", "first_seen_at": "2026-07-10T17:00:25+00:00"}, "scope": {"notes": "Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 | Affected: balbooa.com / balbooa.com Balbooa Forms extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.00278 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1", "vendor": "balbooa.com", "product": "balbooa.com Balbooa Forms extension for Joomla", "added_date": "2026-07-10T17:00:25.732Z", "cvss_score": 10.0, "epss_score": 0.00278, "cvss_severity": "CRITICAL", "epss_percentile": 0.19623, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-56291", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56291"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-56291"}]}, {"uuid": "427bdb3e-2dd6-4ecd-b538-9ea4109bf423", "vulnerability": {"vulnId": "CVE-2026-2699", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "427bdb3e-2dd6-4ecd-b538-9ea4109bf423"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-10T00:00:00+00:00", "recorded_at": "2026-07-11T11:00:01+00:00", "first_seen_at": "2026-07-10T00:00:00+00:00"}, "scope": {"notes": "EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC) | Affected: Progress / ShareFile Storage Zones Controller | CVSS: 9.8 (CRITICAL) | EPSS: 0.49424 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)", "vendor": "Progress", "product": "ShareFile Storage Zones Controller", "added_date": "2026-07-10T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.49424, "cvss_severity": "CRITICAL", "epss_percentile": 0.98754, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-2699", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2699"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-2699"}]}, {"uuid": "05c049ff-ee99-4575-a7cd-e5fe92dc927e", "vulnerability": {"vulnId": "CVE-2026-1207", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "05c049ff-ee99-4575-a7cd-e5fe92dc927e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T16:15:55+00:00"}, "timestamps": {"asserted_at": "2026-07-09T16:15:55+00:00", "recorded_at": "2026-07-09T17:00:01+00:00", "first_seen_at": "2026-07-09T16:15:55+00:00"}, "scope": {"notes": "Potential SQL injection via raster lookups on PostGIS | Affected: djangoproject / Django | CVSS: 5.4 (MEDIUM) | EPSS: 0.09436 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Potential SQL injection via raster lookups on PostGIS", "vendor": "djangoproject", "product": "Django", "added_date": "2026-07-09T16:15:55.777Z", "cvss_score": 5.4, "epss_score": 0.09436, "cvss_severity": "MEDIUM", "epss_percentile": 0.94829, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-1207", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1207"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-1207"}]}, {"uuid": "f67d2217-1c6d-4467-9275-02d3946f0edf", "vulnerability": {"vulnId": "CVE-2023-39361", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f67d2217-1c6d-4467-9275-02d3946f0edf"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-08T00:00:00+00:00", "recorded_at": "2026-07-09T09:00:01+00:00", "first_seen_at": "2026-07-08T00:00:00+00:00"}, "scope": {"notes": "Unauthenticated SQL Injection in graph_view.php in Cacti | Affected: Cacti / cacti | CVSS: 9.8 (CRITICAL) | EPSS: 0.87575 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Unauthenticated SQL Injection in graph_view.php in Cacti", "vendor": "Cacti", "product": "cacti", "added_date": "2026-07-08T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.87575, "cvss_severity": "CRITICAL", "epss_percentile": 0.99736, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-39361", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39361"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-39361"}]}, {"uuid": "68d3f3d4-7e6e-4256-87a0-d668391985aa", "vulnerability": {"vulnId": "CVE-2026-4631", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "68d3f3d4-7e6e-4256-87a0-d668391985aa"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-08T00:00:00+00:00", "recorded_at": "2026-07-09T09:00:01+00:00", "first_seen_at": "2026-07-08T00:00:00+00:00"}, "scope": {"notes": "Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection | Affected: Red Hat / Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 | CVSS: 9.8 (CRITICAL) | EPSS: 0.142 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection", "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8", "added_date": "2026-07-08T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.142, "cvss_severity": "CRITICAL", "epss_percentile": 0.96147, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-4631", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4631"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-4631"}]}, {"uuid": "e1a4b5b4-3b51-406d-9540-2240437e87d1", "vulnerability": {"vulnId": "CVE-2026-48908", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e1a4b5b4-3b51-406d-9540-2240437e87d1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-07T17:00:54+00:00"}, "timestamps": {"asserted_at": "2026-07-07T17:00:54+00:00", "recorded_at": "2026-07-07T18:00:02+00:00", "first_seen_at": "2026-07-07T17:00:54+00:00"}, "scope": {"notes": "KEVIntel entry: Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 | Affected: joomshaper.net / SP Page Builder extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.00803 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2", "vendor": "joomshaper.net", "product": "SP Page Builder extension for Joomla", "added_date": "2026-07-07T17:00:54.263Z", "cvss_score": 10.0, "epss_score": 0.00803, "cvss_severity": "CRITICAL", "epss_percentile": 0.52274, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-48908", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48908"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48908"}]}, {"uuid": "dd1e4271-1fb8-4dfa-af0f-1b755d41763d", "vulnerability": {"vulnId": "CVE-2026-55255", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "dd1e4271-1fb8-4dfa-af0f-1b755d41763d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-07T17:00:54+00:00"}, "timestamps": {"asserted_at": "2026-07-07T17:00:54+00:00", "recorded_at": "2026-07-07T18:00:02+00:00", "first_seen_at": "2026-07-07T17:00:54+00:00"}, "scope": {"notes": "KEVIntel entry: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow | Affected: langflow-ai / langflow | CVSS: 9.9 (CRITICAL) | EPSS: 0.00233 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow", "vendor": "langflow-ai", "product": "langflow", "added_date": "2026-07-07T17:00:54.263Z", "cvss_score": 9.9, "epss_score": 0.00233, "cvss_severity": "CRITICAL", "epss_percentile": 0.14148, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-55255", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55255"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-55255"}]}, {"uuid": "6ee34d77-b707-46d5-baed-7361fcc5150c", "vulnerability": {"vulnId": "CVE-2026-56290", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "6ee34d77-b707-46d5-baed-7361fcc5150c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-07T17:00:54+00:00"}, "timestamps": {"asserted_at": "2026-07-07T17:00:54+00:00", "recorded_at": "2026-07-07T18:00:02+00:00", "first_seen_at": "2026-07-07T17:00:54+00:00"}, "scope": {"notes": "KEVIntel entry: Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 | Affected: joomlack.fr / JoomlaCK.fr Page Builder CK extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.00356 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0", "vendor": "joomlack.fr", "product": "JoomlaCK.fr Page Builder CK extension for Joomla", "added_date": "2026-07-07T17:00:54.263Z", "cvss_score": 10.0, "epss_score": 0.00356, "cvss_severity": "CRITICAL", "epss_percentile": 0.27626, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-56290", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56290"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-56290"}]}, {"uuid": "639792fc-c342-4515-bc82-651d788d0487", "vulnerability": {"vulnId": "CVE-2026-48282", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "639792fc-c342-4515-bc82-651d788d0487"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-02T18:20:12+00:00"}, "timestamps": {"asserted_at": "2026-07-02T18:20:12+00:00", "recorded_at": "2026-07-02T19:00:01+00:00", "first_seen_at": "2026-07-02T18:20:12+00:00"}, "scope": {"notes": "KEVIntel entry: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Affected: Adobe / ColdFusion | CVSS: 10.0 (CRITICAL) | EPSS: 0.01021 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)", "vendor": "Adobe", "product": "ColdFusion", "added_date": "2026-07-02T18:20:12.605Z", "cvss_score": 10.0, "epss_score": 0.01021, "cvss_severity": "CRITICAL", "epss_percentile": 0.59172, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-48282", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48282"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48282"}]}, {"uuid": "4d5dcdca-7d58-4047-beb1-f54f5e5c1bb3", "vulnerability": {"vulnId": "CVE-2026-8451", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "4d5dcdca-7d58-4047-beb1-f54f5e5c1bb3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-01T21:50:00+00:00"}, "timestamps": {"asserted_at": "2026-07-01T21:50:00+00:00", "recorded_at": "2026-07-02T17:00:02+00:00", "first_seen_at": "2026-07-01T21:50:00+00:00"}, "scope": {"notes": "KEVIntel entry: Insufficient input validation leading to memory overread | Affected: NetScaler / ADC, Gateway | CVSS: 8.8 (HIGH) | EPSS: 0.00502 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Insufficient input validation leading to memory overread", "vendor": "NetScaler", "product": "ADC, Gateway", "added_date": "2026-07-01T21:50:00.000Z", "cvss_score": 8.8, "epss_score": 0.00502, "cvss_severity": "HIGH", "epss_percentile": 0.39231, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-8451", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8451"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-8451"}]}, {"uuid": "657482b4-fc37-4bd2-aded-f92d21f1793a", "vulnerability": {"vulnId": "CVE-2026-45659", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "657482b4-fc37-4bd2-aded-f92d21f1793a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-01T19:00:06+00:00"}, "timestamps": {"asserted_at": "2026-07-01T19:00:06+00:00", "recorded_at": "2026-07-01T20:00:01+00:00", "first_seen_at": "2026-07-01T19:00:06+00:00"}, "scope": {"notes": "KEVIntel entry: Microsoft SharePoint Remote Code Execution Vulnerability | Affected: Microsoft / Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition | CVSS: 8.8 (HIGH) | EPSS: 0.02781 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Microsoft SharePoint Remote Code Execution Vulnerability", "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition", "added_date": "2026-07-01T19:00:06.901Z", "cvss_score": 8.8, "epss_score": 0.02781, "cvss_severity": "HIGH", "epss_percentile": 0.8461, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-45659", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45659"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-45659"}]}, {"uuid": "d2df5079-2286-4d5c-a131-546b27ea662c", "vulnerability": {"vulnId": "CVE-2026-8037", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d2df5079-2286-4d5c-a131-546b27ea662c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-01T14:51:57+00:00"}, "timestamps": {"asserted_at": "2026-07-01T14:51:57+00:00", "recorded_at": "2026-07-01T15:00:02+00:00", "first_seen_at": "2026-07-01T14:51:57+00:00"}, "scope": {"notes": "KEVIntel entry: OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF | Affected: Progress Software / LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF | CVSS: 9.6 (CRITICAL) | EPSS: 0.0819 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF", "vendor": "Progress Software", "product": "LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF", "added_date": "2026-07-01T14:51:57.959Z", "cvss_score": 9.6, "epss_score": 0.0819, "cvss_severity": "CRITICAL", "epss_percentile": 0.94176, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-8037", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8037"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-8037"}]}, {"uuid": "65a07e8f-71bc-4743-900f-bf9585bfde6d", "vulnerability": {"vulnId": "CVE-2026-52813", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "65a07e8f-71bc-4743-900f-bf9585bfde6d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T16:02:32+00:00"}, "timestamps": {"asserted_at": "2026-06-30T16:02:32+00:00", "recorded_at": "2026-06-30T17:00:01+00:00", "first_seen_at": "2026-06-30T16:02:32+00:00"}, "scope": {"notes": "KEVIntel entry: Gogs: Path Traversal in organization name results in RCE through Git hooks | Affected: gogs / gogs | CVSS: 10.0 (CRITICAL) | EPSS: 0.01107 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Gogs: Path Traversal in organization name results in RCE through Git hooks", "vendor": "gogs", "product": "gogs", "added_date": "2026-06-30T16:02:32.752Z", "cvss_score": 10.0, "epss_score": 0.01107, "cvss_severity": "CRITICAL", "epss_percentile": 0.6173, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-52813", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52813"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-52813"}]}, {"uuid": "8998fef8-ec6c-4604-a451-cda9b577b0f1", "vulnerability": {"vulnId": "CVE-2026-46817", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8998fef8-ec6c-4604-a451-cda9b577b0f1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-29T15:45:00+00:00"}, "timestamps": {"asserted_at": "2026-06-29T15:45:00+00:00", "recorded_at": "2026-06-29T16:00:01+00:00", "first_seen_at": "2026-06-29T15:45:00+00:00"}, "scope": {"notes": "KEVIntel entry: Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).  Supported versions that are affected are... | Affected: Oracle Corporation / Oracle Payments | CVSS: 9.8 (CRITICAL) | EPSS: 0.00418 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).  Supported versions that are affected are...", "vendor": "Oracle Corporation", "product": "Oracle Payments", "added_date": "2026-06-29T15:45:00.000Z", "cvss_score": 9.8, "epss_score": 0.00418, "cvss_severity": "CRITICAL", "epss_percentile": 0.3353, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-46817", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46817"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-46817"}]}, {"uuid": "b3a20fd8-eebe-4a24-887e-3d9ad481e7d6", "vulnerability": {"vulnId": "CVE-2026-48558", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b3a20fd8-eebe-4a24-887e-3d9ad481e7d6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-29T14:20:22+00:00"}, "timestamps": {"asserted_at": "2026-06-29T14:20:22+00:00", "recorded_at": "2026-06-29T15:00:02+00:00", "first_seen_at": "2026-06-29T14:20:22+00:00"}, "scope": {"notes": "KEVIntel entry: SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification | Affected: SimpleHelp / SimpleHelp | CVSS: 9.5 (CRITICAL) | EPSS: 0.00721 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification", "vendor": "SimpleHelp", "product": "SimpleHelp", "added_date": "2026-06-29T14:20:22.145Z", "cvss_score": 9.5, "epss_score": 0.00721, "cvss_severity": "CRITICAL", "epss_percentile": 0.49308, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-48558", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48558"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48558"}]}, {"uuid": "fb05ca4f-cbab-41af-a562-524a013fc591", "vulnerability": {"vulnId": "CVE-2026-8054", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "fb05ca4f-cbab-41af-a562-524a013fc591"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-27T14:36:50+00:00"}, "timestamps": {"asserted_at": "2026-06-27T14:36:50+00:00", "recorded_at": "2026-06-27T15:00:01+00:00", "first_seen_at": "2026-06-27T14:36:50+00:00"}, "scope": {"notes": "KEVIntel entry: Unauthenticated SQL Injection in dotCMS Publish Audit API | Affected: dotCMS / dotCMS Core | CVSS: 10.0 (CRITICAL) | EPSS: 0.01584 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Unauthenticated SQL Injection in dotCMS Publish Audit API", "vendor": "dotCMS", "product": "dotCMS Core", "added_date": "2026-06-27T14:36:50.219Z", "cvss_score": 10.0, "epss_score": 0.01584, "cvss_severity": "CRITICAL", "epss_percentile": 0.72506, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-8054", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8054"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-8054"}]}, {"uuid": "a6345fab-5c65-4d48-80ad-80b8cbd234e5", "vulnerability": {"vulnId": "CVE-2023-6567", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a6345fab-5c65-4d48-80ad-80b8cbd234e5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-27T14:36:38+00:00"}, "timestamps": {"asserted_at": "2026-06-27T14:36:38+00:00", "recorded_at": "2026-06-27T15:00:01+00:00", "first_seen_at": "2026-06-27T14:36:38+00:00"}, "scope": {"notes": "KEVIntel entry: The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018order_by\u2019 parameter in all versions up to, and including,... | Affected: thimpress / LearnPress \u2013 WordPress LMS Plugin | CVSS: 9.8 (CRITICAL) | EPSS: 0.51394 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018order_by\u2019 parameter in all versions up to, and including,...", "vendor": "thimpress", "product": "LearnPress \u2013 WordPress LMS Plugin", "added_date": "2026-06-27T14:36:38.919Z", "cvss_score": 9.8, "epss_score": 0.51394, "cvss_severity": "CRITICAL", "epss_percentile": 0.98802, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-6567", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6567"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-6567"}]}, {"uuid": "eafceb5e-2031-4547-b567-fef9e152991e", "vulnerability": {"vulnId": "CVE-2026-12569", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "eafceb5e-2031-4547-b567-fef9e152991e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-25T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-25T00:00:00+00:00", "recorded_at": "2026-06-25T20:00:01+00:00", "first_seen_at": "2026-06-25T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Remote Code Execution (RCE) vulnerability in Windchill PDMlink | Affected: PTC / Windchill PDMLink, FlexPLM | CVSS: 9.3 (CRITICAL) | EPSS: 0.00499 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Remote Code Execution (RCE) vulnerability in Windchill PDMlink", "vendor": "PTC", "product": "Windchill PDMLink, FlexPLM", "added_date": "2026-06-25T00:00:00.000Z", "cvss_score": 9.3, "epss_score": 0.00499, "cvss_severity": "CRITICAL", "epss_percentile": 0.38899, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-12569", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12569"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-12569"}]}, {"uuid": "9a30df14-176b-450a-845b-42cd2768d79d", "vulnerability": {"vulnId": "CVE-2026-20230", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "9a30df14-176b-450a-845b-42cd2768d79d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-23T22:20:36+00:00"}, "timestamps": {"asserted_at": "2026-06-23T22:20:36+00:00", "recorded_at": "2026-06-23T23:00:01+00:00", "first_seen_at": "2026-06-23T22:20:36+00:00"}, "scope": {"notes": "KEVIntel entry: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified... | Affected: Cisco / Cisco Unified Communications Manager | CVSS: 8.6 (HIGH) | EPSS: 0.20442 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified...", "vendor": "Cisco", "product": "Cisco Unified Communications Manager", "added_date": "2026-06-23T22:20:36.536Z", "cvss_score": 8.6, "epss_score": 0.20442, "cvss_severity": "HIGH", "epss_percentile": 0.97156, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-20230", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20230"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-20230"}]}, {"uuid": "8e8a4f05-9e1b-4d1f-b0d9-81ac83a41432", "vulnerability": {"vulnId": "CVE-2025-67038", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8e8a4f05-9e1b-4d1f-b0d9-81ac83a41432"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-23T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-23T00:00:00+00:00", "recorded_at": "2026-06-23T19:00:01+00:00", "first_seen_at": "2026-06-23T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication... | Affected: Lantronix / EDS5000 | EPSS: 0.00469 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication...", "vendor": "Lantronix", "product": "EDS5000", "added_date": "2026-06-23T00:00:00.000Z", "cvss_score": null, "epss_score": 0.00469, "cvss_severity": null, "epss_percentile": 0.36913, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2025-67038", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67038"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-67038"}]}, {"uuid": "217450ae-1eff-41d7-a95c-6e4b5272e4e4", "vulnerability": {"vulnId": "CVE-2026-20253", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "217450ae-1eff-41d7-a95c-6e4b5272e4e4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-18T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-18T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-18T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise | Affected: Splunk / Splunk Enterprise | CVSS: 9.8 (CRITICAL) | EPSS: 0.10035 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise", "vendor": "Splunk", "product": "Splunk Enterprise", "added_date": "2026-06-18T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.10035, "cvss_severity": "CRITICAL", "epss_percentile": 0.95018, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "day", "count": 3}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-20253", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20253"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-20253"}]}, {"uuid": "1d0f87f0-35b7-498e-8c08-7868fef52eff", "vulnerability": {"vulnId": "CVE-2026-4020", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "1d0f87f0-35b7-498e-8c08-7868fef52eff"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-17T10:28:34+00:00"}, "timestamps": {"asserted_at": "2026-06-17T10:28:34+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-17T10:28:34+00:00"}, "scope": {"notes": "KEVIntel entry: Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API | Affected: RocketGenius / Gravity SMTP | CVSS: 7.5 (HIGH) | EPSS: 0.0298 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API", "vendor": "RocketGenius", "product": "Gravity SMTP", "added_date": "2026-06-17T10:28:34.000Z", "cvss_score": 7.5, "epss_score": 0.0298, "cvss_severity": "HIGH", "epss_percentile": 0.8552, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-4020", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4020"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-4020"}]}, {"uuid": "5c9f9de2-5560-4056-9ed6-937928435f16", "vulnerability": {"vulnId": "CVE-2026-39813", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "5c9f9de2-5560-4056-9ed6-937928435f16"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-16T15:17:57+00:00"}, "timestamps": {"asserted_at": "2026-06-16T15:17:57+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-16T15:17:57+00:00"}, "scope": {"notes": "KEVIntel entry: A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to... | Affected: Fortinet / FortiSandbox, FortiSandbox Cloud | CVSS: 9.1 (CRITICAL) | EPSS: 0.18703 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to...", "vendor": "Fortinet", "product": "FortiSandbox, FortiSandbox Cloud", "added_date": "2026-06-16T15:17:57.989Z", "cvss_score": 9.1, "epss_score": 0.18703, "cvss_severity": "CRITICAL", "epss_percentile": 0.96902, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-39813", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39813"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-39813"}]}, {"uuid": "0f2302f3-00e7-4d90-86fc-886701fba25b", "vulnerability": {"vulnId": "CVE-2026-48907", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0f2302f3-00e7-4d90-86fc-886701fba25b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-16T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-16T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-16T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5 | Affected: joomlacontenteditor.net / Joomla Content Editor (JCE) extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.06854 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5", "vendor": "joomlacontenteditor.net", "product": "Joomla Content Editor (JCE) extension for Joomla", "added_date": "2026-06-16T00:00:00.000Z", "cvss_score": 10.0, "epss_score": 0.06854, "cvss_severity": "CRITICAL", "epss_percentile": 0.93214, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-48907", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48907"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48907"}]}, {"uuid": "7c04c96c-3f75-4977-9e20-76ebc2722fa6", "vulnerability": {"vulnId": "CVE-2026-53435", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7c04c96c-3f75-4977-9e20-76ebc2722fa6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T09:02:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T09:02:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T09:02:00+00:00"}, "scope": {"notes": "KEVIntel entry: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins... | Affected: Jenkins Project / Jenkins | CVSS: 8.8 (HIGH) | EPSS: 0.00368 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins...", "vendor": "Jenkins Project", "product": "Jenkins", "added_date": "2026-06-15T09:02:00.000Z", "cvss_score": 8.8, "epss_score": 0.00368, "cvss_severity": "HIGH", "epss_percentile": 0.28374, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-53435", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-53435"}]}, {"uuid": "d093481d-83f5-4937-b1ba-0dede5f49587", "vulnerability": {"vulnId": "CVE-2022-25486", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d093481d-83f5-4937-b1ba-0dede5f49587"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php. | Affected: CuppaCMS / CuppaCMS | CVSS: 7.8 (HIGH) | EPSS: 0.09966 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.", "vendor": "CuppaCMS", "product": "CuppaCMS", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 7.8, "epss_score": 0.09966, "cvss_severity": "HIGH", "epss_percentile": 0.94996, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-25486", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25486"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-25486"}]}, {"uuid": "7e8891a5-d602-4fee-89e3-4582e2d2a111", "vulnerability": {"vulnId": "CVE-2022-25485", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7e8891a5-d602-4fee-89e3-4582e2d2a111"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php. | Affected: CuppaCMS / CuppaCMS | CVSS: 7.8 (HIGH) | EPSS: 0.07927 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.", "vendor": "CuppaCMS", "product": "CuppaCMS", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 7.8, "epss_score": 0.07927, "cvss_severity": "HIGH", "epss_percentile": 0.93978, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-25485", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25485"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-25485"}]}, {"uuid": "78967047-8c03-44ac-b3b1-46a5e8b0c76e", "vulnerability": {"vulnId": "CVE-2024-31750", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "78967047-8c03-44ac-b3b1-46a5e8b0c76e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter. | Affected: f-logic / datacube3 | CVSS: 9.8 (CRITICAL) | EPSS: 0.1942 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.", "vendor": "f-logic", "product": "datacube3", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.1942, "cvss_severity": "CRITICAL", "epss_percentile": 0.97013, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-31750", "url": "https://www.cve.org/CVERecord?id=CVE-2024-31750"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-31750"}]}, {"uuid": "64b51d32-a6fc-49bf-af74-40c0a28ebc1f", "vulnerability": {"vulnId": "CVE-2024-32738", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "64b51d32-a6fc-49bf-af74-40c0a28ebc1f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: CyberPower PowerPanel Enterprise SQL Injection | Affected: CyberPower / CyberPower PowerPanel Enterprise | CVSS: 7.5 (HIGH) | EPSS: 0.04515 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "CyberPower PowerPanel Enterprise SQL Injection", "vendor": "CyberPower", "product": "CyberPower PowerPanel Enterprise", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.04515, "cvss_severity": "HIGH", "epss_percentile": 0.90293, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-32738", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32738"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-32738"}]}, {"uuid": "48364ef7-7988-451d-9f35-3b718276aa7b", "vulnerability": {"vulnId": "CVE-2024-27497", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "48364ef7-7988-451d-9f35-3b718276aa7b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. | Affected: Linksys / E2000 | CVSS: 8.8 (HIGH) | EPSS: 0.2646 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.", "vendor": "Linksys", "product": "E2000", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 8.8, "epss_score": 0.2646, "cvss_severity": "HIGH", "epss_percentile": 0.97748, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-27497", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27497"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-27497"}]}, {"uuid": "451fc3f7-d517-4b1e-b7ba-39f59d14a5a6", "vulnerability": {"vulnId": "CVE-2017-9833", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "451fc3f7-d517-4b1e-b7ba-39f59d14a5a6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of \"../..\" using the FILECAMERA variable (sent by GET) to read files with root privileges.... | Affected: Boa / Boa Web Server | CVSS: 7.5 (HIGH) | EPSS: 0.67725 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of \"../..\" using the FILECAMERA variable (sent by GET) to read files with root privileges....", "vendor": "Boa", "product": "Boa Web Server", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.67725, "cvss_severity": "HIGH", "epss_percentile": 0.99225, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2017-9833", "url": "https://www.cve.org/CVERecord?id=CVE-2017-9833"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2017-9833"}]}, {"uuid": "43197e16-ece1-458d-b853-c7602318902b", "vulnerability": {"vulnId": "CVE-2020-24949", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "43197e16-ece1-458d-b853-c7602318902b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server... | Affected: PHP-Fusion / PHP-Fusion | CVSS: 8.8 (HIGH) | EPSS: 0.67289 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server...", "vendor": "PHP-Fusion", "product": "PHP-Fusion", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 8.8, "epss_score": 0.67289, "cvss_severity": "HIGH", "epss_percentile": 0.99211, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2020-24949", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24949"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2020-24949"}]}, {"uuid": "3b901bd8-1d55-46c1-9a8b-54f3f09b897e", "vulnerability": {"vulnId": "CVE-2023-31059", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3b901bd8-1d55-46c1-9a8b-54f3f09b897e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php. | Affected: Repetier / Repetier Server | CVSS: 7.5 (HIGH) | EPSS: 0.05574 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.", "vendor": "Repetier", "product": "Repetier Server", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.05574, "cvss_severity": "HIGH", "epss_percentile": 0.91871, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-31059", "url": "https://www.cve.org/CVERecord?id=CVE-2023-31059"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-31059"}]}, {"uuid": "3b3f3882-95aa-4a93-addf-ba63755a1cb1", "vulnerability": {"vulnId": "CVE-2025-27222", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3b3f3882-95aa-4a93-addf-ba63755a1cb1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't... | Affected: Rocket Software / TRUfusion Enterprise | CVSS: 8.6 (HIGH) | EPSS: 0.01773 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't...", "vendor": "Rocket Software", "product": "TRUfusion Enterprise", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 8.6, "epss_score": 0.01773, "cvss_severity": "HIGH", "epss_percentile": 0.75268, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-27222", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27222"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-27222"}]}, {"uuid": "3694768f-1754-4696-b592-bbf54084b670", "vulnerability": {"vulnId": "CVE-2026-20262", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3694768f-1754-4696-b592-bbf54084b670"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability | Affected: Cisco / Cisco Catalyst SD-WAN Manager | CVSS: 6.5 (MEDIUM) | EPSS: 0.01145 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability", "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 6.5, "epss_score": 0.01145, "cvss_severity": "MEDIUM", "epss_percentile": 0.62568, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-20262", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20262"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-20262"}]}, {"uuid": "3157fa07-dbdf-4cc8-bbe0-55efc33784a6", "vulnerability": {"vulnId": "CVE-2017-15363", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3157fa07-dbdf-4cc8-bbe0-55efc33784a6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-15T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-15T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension... | Affected: Luracast / Restler | CVSS: 7.5 (HIGH) | EPSS: 0.13649 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension...", "vendor": "Luracast", "product": "Restler", "added_date": "2026-06-15T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.13649, "cvss_severity": "HIGH", "epss_percentile": 0.95994, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2017-15363", "url": "https://www.cve.org/CVERecord?id=CVE-2017-15363"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2017-15363"}]}, {"uuid": "f26bd3cc-065a-461e-9c0e-cc278b73e637", "vulnerability": {"vulnId": "CVE-2026-54420", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f26bd3cc-065a-461e-9c0e-cc278b73e637"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-14T04:01:15+00:00"}, "timestamps": {"asserted_at": "2026-06-14T04:01:15+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-14T04:01:15+00:00"}, "scope": {"notes": "KEVIntel entry: LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web... | Affected: LiteSpeed Technologies / cPanel Plugin | CVSS: 8.5 (HIGH) | EPSS: 0.00654 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web...", "vendor": "LiteSpeed Technologies", "product": "cPanel Plugin", "added_date": "2026-06-14T04:01:15.820Z", "cvss_score": 8.5, "epss_score": 0.00654, "cvss_severity": "HIGH", "epss_percentile": 0.46413, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "hour", "count": 20}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-54420", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54420"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-54420"}]}, {"uuid": "69519984-a493-4cae-91db-a57cd2bdc22e", "vulnerability": {"vulnId": "CVE-2023-39796", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "69519984-a493-4cae-91db-a57cd2bdc22e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-14T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-14T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-14T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the... | Affected: WBCE / WBCE CMS | CVSS: 9.8 (CRITICAL) | EPSS: 0.06096 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the...", "vendor": "WBCE", "product": "WBCE CMS", "added_date": "2026-06-14T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.06096, "cvss_severity": "CRITICAL", "epss_percentile": 0.92493, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-39796", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39796"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-39796"}]}, {"uuid": "b780bd67-7e20-4ce8-a916-5059984312a4", "vulnerability": {"vulnId": "CVE-2022-38296", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b780bd67-7e20-4ce8-a916-5059984312a4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-13T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-13T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-13T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager. | Affected: Cuppa CMS / Cuppa CMS | CVSS: 9.8 (CRITICAL) | EPSS: 0.0377 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.", "vendor": "Cuppa CMS", "product": "Cuppa CMS", "added_date": "2026-06-13T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.0377, "cvss_severity": "CRITICAL", "epss_percentile": 0.88528, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-38296", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38296"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-38296"}]}, {"uuid": "efcc9691-84cb-45c2-9e5d-5a03fcc9654a", "vulnerability": {"vulnId": "CVE-2026-39808", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "efcc9691-84cb-45c2-9e5d-5a03fcc9654a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-12T13:59:12+00:00"}, "timestamps": {"asserted_at": "2026-06-12T13:59:12+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-12T13:59:12+00:00"}, "scope": {"notes": "KEVIntel entry: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through... | Affected: Fortinet / FortiSandbox, FortiSandbox PaaS | CVSS: 9.8 (CRITICAL) | EPSS: 0.66168 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through...", "vendor": "Fortinet", "product": "FortiSandbox, FortiSandbox PaaS", "added_date": "2026-06-12T13:59:12.791Z", "cvss_score": 9.8, "epss_score": 0.66168, "cvss_severity": "CRITICAL", "epss_percentile": 0.99179, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-39808", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39808"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-39808"}]}, {"uuid": "e2278c84-0bab-4988-a653-4d0124f05354", "vulnerability": {"vulnId": "CVE-2021-31805", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e2278c84-0bab-4988-a653-4d0124f05354"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-12T00:32:51+00:00"}, "timestamps": {"asserted_at": "2026-06-12T00:32:51+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-12T00:32:51+00:00"}, "scope": {"notes": "KEVIntel entry: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. | Affected: Apache Software Foundation / Apache Struts | CVSS: 9.8 (CRITICAL) | EPSS: 0.85101 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.", "vendor": "Apache Software Foundation", "product": "Apache Struts", "added_date": "2026-06-12T00:32:51.325Z", "cvss_score": 9.8, "epss_score": 0.85101, "cvss_severity": "CRITICAL", "epss_percentile": 0.99684, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-31805", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31805"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-31805"}]}, {"uuid": "07ba7d04-e340-4a57-90b9-b292c1ce1506", "vulnerability": {"vulnId": "CVE-2021-30128", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "07ba7d04-e340-4a57-90b9-b292c1ce1506"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-12T00:32:50+00:00"}, "timestamps": {"asserted_at": "2026-06-12T00:32:50+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-12T00:32:50+00:00"}, "scope": {"notes": "KEVIntel entry: Unsafe deserialization in Apache OFBiz | Affected: Apache Software Foundation / Apache OFBiz | CVSS: 9.8 (CRITICAL) | EPSS: 0.81079 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Unsafe deserialization in Apache OFBiz", "vendor": "Apache Software Foundation", "product": "Apache OFBiz", "added_date": "2026-06-12T00:32:50.259Z", "cvss_score": 9.8, "epss_score": 0.81079, "cvss_severity": "CRITICAL", "epss_percentile": 0.99583, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-30128", "url": "https://www.cve.org/CVERecord?id=CVE-2021-30128"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-30128"}]}, {"uuid": "2606c056-543a-4c3c-82b6-3bedddc9b527", "vulnerability": {"vulnId": "CVE-2020-6286", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2606c056-543a-4c3c-82b6-3bedddc9b527"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-12T00:32:46+00:00"}, "timestamps": {"asserted_at": "2026-06-12T00:32:46+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-12T00:32:46+00:00"}, "scope": {"notes": "KEVIntel entry: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30,... | Affected: SAP SE / SAP NetWeaver AS JAVA (LM Configuration Wizard) | CVSS: 5.3 (MEDIUM) | EPSS: 0.28312 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30,...", "vendor": "SAP SE", "product": "SAP NetWeaver AS JAVA (LM Configuration Wizard)", "added_date": "2026-06-12T00:32:46.583Z", "cvss_score": 5.3, "epss_score": 0.28312, "cvss_severity": "MEDIUM", "epss_percentile": 0.97868, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2020-6286", "url": "https://www.cve.org/CVERecord?id=CVE-2020-6286"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2020-6286"}]}, {"uuid": "2e4600e2-4d7b-4dd3-abab-b415a23c1bbd", "vulnerability": {"vulnId": "CVE-2026-35273", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2e4600e2-4d7b-4dd3-abab-b415a23c1bbd"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-11T20:20:23+00:00"}, "timestamps": {"asserted_at": "2026-06-11T20:20:23+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-11T20:20:23+00:00"}, "scope": {"notes": "KEVIntel entry: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions... | Affected: Oracle Corporation / PeopleSoft Enterprise PeopleTools | CVSS: 9.8 (CRITICAL) | EPSS: 0.07511 | Used in malware: yes | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "confirmed_compromise", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions...", "vendor": "Oracle Corporation", "product": "PeopleSoft Enterprise PeopleTools", "added_date": "2026-06-11T20:20:23.651Z", "cvss_score": 9.8, "epss_score": 0.07511, "cvss_severity": "CRITICAL", "epss_percentile": 0.93709, "used_in_malware": "yes", "ahead_of_cisa_kev": {"unit": "hour", "count": 4}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-35273", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35273"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-35273"}]}, {"uuid": "3a42c5e0-8132-4a5e-addf-8b8d014ed95b", "vulnerability": {"vulnId": "CVE-2026-10795", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3a42c5e0-8132-4a5e-addf-8b8d014ed95b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-11T07:20:32+00:00"}, "timestamps": {"asserted_at": "2026-06-11T07:20:32+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-11T07:20:32+00:00"}, "scope": {"notes": "KEVIntel entry: UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc | Affected: davidanderson / UpdraftPlus: WP Backup & Migration Plugin | CVSS: 8.1 (HIGH) | EPSS: 0.01252 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc", "vendor": "davidanderson", "product": "UpdraftPlus: WP Backup & Migration Plugin", "added_date": "2026-06-11T07:20:32.076Z", "cvss_score": 8.1, "epss_score": 0.01252, "cvss_severity": "HIGH", "epss_percentile": 0.65543, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-10795", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10795"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-10795"}]}, {"uuid": "20e8deb5-00f4-4562-929e-700b6f4b46f4", "vulnerability": {"vulnId": "CVE-2025-5821", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "20e8deb5-00f4-4562-929e-700b6f4b46f4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-11T00:20:49+00:00"}, "timestamps": {"asserted_at": "2026-06-11T00:20:49+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-11T00:20:49+00:00"}, "scope": {"notes": "KEVIntel entry: Case Theme User <= 1.0.3 - Authentication Bypass via Social Login | Affected: Case-Themes / Case Theme User | CVSS: 9.8 (CRITICAL) | EPSS: 0.00714 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Case Theme User <= 1.0.3 - Authentication Bypass via Social Login", "vendor": "Case-Themes", "product": "Case Theme User", "added_date": "2026-06-11T00:20:49.551Z", "cvss_score": 9.8, "epss_score": 0.00714, "cvss_severity": "CRITICAL", "epss_percentile": 0.48791, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-5821", "url": "https://www.cve.org/CVERecord?id=CVE-2025-5821"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-5821"}]}, {"uuid": "587a20e7-a453-432e-a04d-c31630e6139a", "vulnerability": {"vulnId": "CVE-2026-5027", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "587a20e7-a453-432e-a04d-c31630e6139a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-10T16:20:36+00:00"}, "timestamps": {"asserted_at": "2026-06-10T16:20:36+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-10T16:20:36+00:00"}, "scope": {"notes": "KEVIntel entry: Langflow - Path Traversal Arbitrary File Write via upload_user_file | Affected: langflow-ai / langflow | CVSS: 8.8 (HIGH) | EPSS: 0.02289 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Langflow - Path Traversal Arbitrary File Write via upload_user_file", "vendor": "langflow-ai", "product": "langflow", "added_date": "2026-06-10T16:20:36.494Z", "cvss_score": 8.8, "epss_score": 0.02289, "cvss_severity": "HIGH", "epss_percentile": 0.80954, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-5027", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5027"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-5027"}]}, {"uuid": "0064d242-0ee1-4d90-807e-e7aa6abae62e", "vulnerability": {"vulnId": "CVE-2026-10520", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0064d242-0ee1-4d90-807e-e7aa6abae62e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-10T09:50:00+00:00"}, "timestamps": {"asserted_at": "2026-06-10T09:50:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-10T09:50:00+00:00"}, "scope": {"notes": "KEVIntel entry: An OS Command Injection vulnerability\u00a0in Ivanti\u00a0Sentry before\u00a0the\u00a0R10.5.2, R10.6.2 and R10.7.1\u00a0versions\u00a0allows\u00a0a remote unauthenticated user to... | Affected: ivanti / Sentry | CVSS: 10.0 (CRITICAL) | EPSS: 0.59524 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "An OS Command Injection vulnerability\u00a0in Ivanti\u00a0Sentry before\u00a0the\u00a0R10.5.2, R10.6.2 and R10.7.1\u00a0versions\u00a0allows\u00a0a remote unauthenticated user to...", "vendor": "ivanti", "product": "Sentry", "added_date": "2026-06-10T09:50:00.000Z", "cvss_score": 10.0, "epss_score": 0.59524, "cvss_severity": "CRITICAL", "epss_percentile": 0.99003, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "day", "count": 1}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-10520", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10520"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-10520"}]}, {"uuid": "a81998b0-09f6-4d56-890b-4d90525e1c62", "vulnerability": {"vulnId": "CVE-2026-11645", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a81998b0-09f6-4d56-890b-4d90525e1c62"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-09T13:20:17+00:00"}, "timestamps": {"asserted_at": "2026-06-09T13:20:17+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-09T13:20:17+00:00"}, "scope": {"notes": "KEVIntel entry: Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox... | Affected: Google / Chrome | CVSS: 8.8 (HIGH) | EPSS: 0.00713 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox...", "vendor": "Google", "product": "Chrome", "added_date": "2026-06-09T13:20:17.736Z", "cvss_score": 8.8, "epss_score": 0.00713, "cvss_severity": "HIGH", "epss_percentile": 0.48759, "used_in_malware": "unknown", "ahead_of_cisa_kev": {"unit": "hour", "count": 5}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-11645", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11645"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-11645"}]}, {"uuid": "c40d4737-8b5c-4304-8cad-98d5394c0f5a", "vulnerability": {"vulnId": "CVE-2026-34910", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c40d4737-8b5c-4304-8cad-98d5394c0f5a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-09T08:18:00+00:00"}, "timestamps": {"asserted_at": "2026-06-09T08:18:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-09T08:18:00+00:00"}, "scope": {"notes": "KEVIntel entry: A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a... | Affected: Ubiquiti Inc / UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial | CVSS: 10.0 (CRITICAL) | EPSS: 0.04509 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a...", "vendor": "Ubiquiti Inc", "product": "UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial", "added_date": "2026-06-09T08:18:00.000Z", "cvss_score": 10.0, "epss_score": 0.04509, "cvss_severity": "CRITICAL", "epss_percentile": 0.90281, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-34910", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34910"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-34910"}]}, {"uuid": "de3af882-4d92-4a98-a92c-c025d4818825", "vulnerability": {"vulnId": "CVE-2026-34909", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "de3af882-4d92-4a98-a92c-c025d4818825"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-09T07:29:00+00:00"}, "timestamps": {"asserted_at": "2026-06-09T07:29:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-09T07:29:00+00:00"}, "scope": {"notes": "KEVIntel entry: A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the... | Affected: Ubiquiti Inc / UniFi OS Server, Express, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial | CVSS: 10.0 (CRITICAL) | EPSS: 0.00623 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the...", "vendor": "Ubiquiti Inc", "product": "UniFi OS Server, Express, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial", "added_date": "2026-06-09T07:29:00.000Z", "cvss_score": 10.0, "epss_score": 0.00623, "cvss_severity": "CRITICAL", "epss_percentile": 0.45095, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-34909", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34909"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-34909"}]}, {"uuid": "4c2ac14b-8057-44c2-8780-186c987089b2", "vulnerability": {"vulnId": "CVE-2026-34908", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "4c2ac14b-8057-44c2-8780-186c987089b2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-09T07:27:00+00:00"}, "timestamps": {"asserted_at": "2026-06-09T07:27:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-09T07:27:00+00:00"}, "scope": {"notes": "KEVIntel entry: A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized... | Affected: Ubiquiti Inc / UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial | CVSS: 10.0 (CRITICAL) | EPSS: 0.00565 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized...", "vendor": "Ubiquiti Inc", "product": "UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial", "added_date": "2026-06-09T07:27:00.000Z", "cvss_score": 10.0, "epss_score": 0.00565, "cvss_severity": "CRITICAL", "epss_percentile": 0.4239, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-34908", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34908"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-34908"}]}, {"uuid": "9a132474-34d7-4126-9585-beafa55e1c1a", "vulnerability": {"vulnId": "CVE-2026-42271", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "9a132474-34d7-4126-9585-beafa55e1c1a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-08T18:00:45+00:00"}, "timestamps": {"asserted_at": "2026-06-08T18:00:45+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-08T18:00:45+00:00"}, "scope": {"notes": "KEVIntel entry: LiteLLM: Authenticated command execution via MCP stdio test endpoints | Affected: BerriAI / litellm | CVSS: 8.7 (HIGH) | EPSS: 0.53701 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "LiteLLM: Authenticated command execution via MCP stdio test endpoints", "vendor": "BerriAI", "product": "litellm", "added_date": "2026-06-08T18:00:45.030Z", "cvss_score": 8.7, "epss_score": 0.53701, "cvss_severity": "HIGH", "epss_percentile": 0.98861, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-42271", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42271"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-42271"}]}, {"uuid": "feccf252-10d1-4d86-bf22-c40658570cf5", "vulnerability": {"vulnId": "CVE-2026-50751", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "feccf252-10d1-4d86-bf22-c40658570cf5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-08T14:20:34+00:00"}, "timestamps": {"asserted_at": "2026-06-08T14:20:34+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-08T14:20:34+00:00"}, "scope": {"notes": "KEVIntel entry: User Authentication Bypass in VPN Remote Access and Mobile Access | Affected: checkpoint / Quantum Security Gateway, Spark Firewalls | CVSS: 9.3 (CRITICAL) | EPSS: 0.41152 | Used in malware: yes | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "confirmed_compromise", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "User Authentication Bypass in VPN Remote Access and Mobile Access", "vendor": "checkpoint", "product": "Quantum Security Gateway, Spark Firewalls", "added_date": "2026-06-08T14:20:34.968Z", "cvss_score": 9.3, "epss_score": 0.41152, "cvss_severity": "CRITICAL", "epss_percentile": 0.98485, "used_in_malware": "yes", "ahead_of_cisa_kev": {"unit": "hour", "count": 6}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-50751", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50751"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-50751"}]}, {"uuid": "e5f80d35-793f-4d6f-9601-d568ef8a4324", "vulnerability": {"vulnId": "CVE-2025-61666", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e5f80d35-793f-4d6f-9601-d568ef8a4324"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-08T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-08T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File | Affected: traccar / traccar | CVSS: 8.7 (HIGH) | EPSS: 0.01214 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File", "vendor": "traccar", "product": "traccar", "added_date": "2026-06-08T00:00:00.000Z", "cvss_score": 8.7, "epss_score": 0.01214, "cvss_severity": "HIGH", "epss_percentile": 0.64562, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-61666", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61666"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-61666"}]}, {"uuid": "76affcac-eba7-4e16-bfba-b8981d37944e", "vulnerability": {"vulnId": "CVE-2025-8085", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "76affcac-eba7-4e16-bfba-b8981d37944e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-08T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-08T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Ditty < 3.1.58 - Unauthenticated SSRF | Affected: Unknown / Ditty | CVSS: 8.6 (HIGH) | EPSS: 0.16399 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Ditty < 3.1.58 - Unauthenticated SSRF", "vendor": "Unknown", "product": "Ditty", "added_date": "2026-06-08T00:00:00.000Z", "cvss_score": 8.6, "epss_score": 0.16399, "cvss_severity": "HIGH", "epss_percentile": 0.9657, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-8085", "url": "https://www.cve.org/CVERecord?id=CVE-2025-8085"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-8085"}]}, {"uuid": "5a75ea9d-cc99-43cb-9601-a4135b4c0079", "vulnerability": {"vulnId": "CVE-2021-33544", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "5a75ea9d-cc99-43cb-9601-a4135b4c0079"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-08T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-08T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-08T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: UDP Technology/Geutebr\u00fcck camera devices: command injection leading to RCE | Affected: Geutebr\u00fcck / E2 Series, Encoder G-Code | CVSS: 7.2 (HIGH) | EPSS: 0.94622 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "UDP Technology/Geutebr\u00fcck camera devices: command injection leading to RCE", "vendor": "Geutebr\u00fcck", "product": "E2 Series, Encoder G-Code", "added_date": "2026-06-08T00:00:00.000Z", "cvss_score": 7.2, "epss_score": 0.94622, "cvss_severity": "HIGH", "epss_percentile": 0.99846, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-33544", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33544"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-33544"}]}, {"uuid": "e88c1d70-c289-41cd-99b4-214ff1f1a135", "vulnerability": {"vulnId": "CVE-2023-4490", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e88c1d70-c289-41cd-99b4-214ff1f1a135"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: WP Job Portal < 2.0.6 - Unauthenticated SQLi | Affected: Unknown / WP Job Portal | CVSS: 9.8 (CRITICAL) | EPSS: 0.03122 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WP Job Portal < 2.0.6 - Unauthenticated SQLi", "vendor": "Unknown", "product": "WP Job Portal", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.03122, "cvss_severity": "CRITICAL", "epss_percentile": 0.86156, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-4490", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4490"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-4490"}]}, {"uuid": "c92022c4-a816-4553-9e38-0068b3cf7baa", "vulnerability": {"vulnId": "CVE-2022-3801", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c92022c4-a816-4553-9e38-0068b3cf7baa"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: IBAX go-ibax rowsInfo sql injection | Affected: IBAX / go-ibax | CVSS: 6.3 (MEDIUM) | EPSS: 0.30082 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "IBAX go-ibax rowsInfo sql injection", "vendor": "IBAX", "product": "go-ibax", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 6.3, "epss_score": 0.30082, "cvss_severity": "MEDIUM", "epss_percentile": 0.97974, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-3801", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3801"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-3801"}]}, {"uuid": "96d27c57-3d61-448c-9baf-32b932ffa2ae", "vulnerability": {"vulnId": "CVE-2021-3577", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "96d27c57-3d61-448c-9baf-32b932ffa2ae"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker... | Affected: Motorola / Binatone Hubble Cameras | CVSS: 8.8 (HIGH) | EPSS: 0.59893 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker...", "vendor": "Motorola", "product": "Binatone Hubble Cameras", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 8.8, "epss_score": 0.59893, "cvss_severity": "HIGH", "epss_percentile": 0.99011, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-3577", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3577"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-3577"}]}, {"uuid": "8998e4dc-a047-4cae-8002-e3593a3f2ede", "vulnerability": {"vulnId": "CVE-2024-55457", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8998e4dc-a047-4cae-8002-e3593a3f2ede"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by... | Affected: MasterSAM / Star Gate 11 | CVSS: 6.5 (MEDIUM) | EPSS: 0.03012 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by...", "vendor": "MasterSAM", "product": "Star Gate 11", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 6.5, "epss_score": 0.03012, "cvss_severity": "MEDIUM", "epss_percentile": 0.85678, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-55457", "url": "https://www.cve.org/CVERecord?id=CVE-2024-55457"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-55457"}]}, {"uuid": "879a13a2-3dc1-4a56-84d0-61d156dd7ef3", "vulnerability": {"vulnId": "CVE-2022-34121", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "879a13a2-3dc1-4a56-84d0-61d156dd7ef3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php. | Affected: Cuppa CMS / Cuppa CMS | CVSS: 7.5 (HIGH) | EPSS: 0.02955 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.", "vendor": "Cuppa CMS", "product": "Cuppa CMS", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.02955, "cvss_severity": "HIGH", "epss_percentile": 0.8539, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-34121", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34121"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-34121"}]}, {"uuid": "863f0fa2-dfee-4c23-bf43-4d7b220285b5", "vulnerability": {"vulnId": "CVE-2024-39713", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "863f0fa2-dfee-4c23-bf43-4d7b220285b5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. | Affected: Rocket.Chat / Rocket.Chat | CVSS: 8.6 (HIGH) | EPSS: 0.03201 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.", "vendor": "Rocket.Chat", "product": "Rocket.Chat", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 8.6, "epss_score": 0.03201, "cvss_severity": "HIGH", "epss_percentile": 0.8647, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-39713", "url": "https://www.cve.org/CVERecord?id=CVE-2024-39713"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-39713"}]}, {"uuid": "6ade58a7-1b90-4139-a8b4-750c65ec34a5", "vulnerability": {"vulnId": "CVE-2021-41569", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "6ade58a7-1b90-4139-a8b4-750c65ec34a5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows... | Affected: SAS Institute Inc. / SAS/Intrnet | CVSS: 7.5 (HIGH) | EPSS: 0.07845 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows...", "vendor": "SAS Institute Inc.", "product": "SAS/Intrnet", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.07845, "cvss_severity": "HIGH", "epss_percentile": 0.93926, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-41569", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41569"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-41569"}]}, {"uuid": "612a88d8-4624-46fa-ad5f-30557f8e6120", "vulnerability": {"vulnId": "CVE-2021-27358", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "612a88d8-4624-46fa-ad5f-30557f8e6120"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API... | Affected: Grafana Labs / Grafana | CVSS: 7.5 (HIGH) | EPSS: 0.83042 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API...", "vendor": "Grafana Labs", "product": "Grafana", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.83042, "cvss_severity": "HIGH", "epss_percentile": 0.99635, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-27358", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27358"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-27358"}]}, {"uuid": "609cf17d-dd9a-4de9-9221-fb8db1d8be57", "vulnerability": {"vulnId": "CVE-2024-8752", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "609cf17d-dd9a-4de9-9221-fb8db1d8be57"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability | Affected: Smart HMI / WebIQ | CVSS: 9.3 (CRITICAL) | EPSS: 0.1166 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability", "vendor": "Smart HMI", "product": "WebIQ", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 9.3, "epss_score": 0.1166, "cvss_severity": "CRITICAL", "epss_percentile": 0.95505, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-8752", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8752"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-8752"}]}, {"uuid": "55f9bd46-b6a0-4478-bef2-cbb7f074e9ca", "vulnerability": {"vulnId": "CVE-2021-20166", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "55f9bd46-b6a0-4478-bef2-cbb7f074e9ca"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router... | Affected: Netgear / RAX43 | CVSS: 8.8 (HIGH) | EPSS: 0.02177 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router...", "vendor": "Netgear", "product": "RAX43", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 8.8, "epss_score": 0.02177, "cvss_severity": "HIGH", "epss_percentile": 0.79979, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-20166", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20166"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-20166"}]}, {"uuid": "5462a64f-df09-4cdc-9f3d-8d3b9f99e0c0", "vulnerability": {"vulnId": "CVE-2021-24227", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "5462a64f-df09-4cdc-9f3d-8d3b9f99e0c0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure | Affected: Unknown / Patreon WordPress | CVSS: 7.5 (HIGH) | EPSS: 0.05879 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure", "vendor": "Unknown", "product": "Patreon WordPress", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.05879, "cvss_severity": "HIGH", "epss_percentile": 0.9226, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-24227", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24227"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-24227"}]}, {"uuid": "2fefa712-0f22-4193-9af6-4102e7d93669", "vulnerability": {"vulnId": "CVE-2022-34753", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2fefa712-0f22-4193-9af6-4102e7d93669"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote... | Affected: Schneider Electric / SpaceLogic C-Bus Home Controller | CVSS: 8.8 (HIGH) | EPSS: 0.71084 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote...", "vendor": "Schneider Electric", "product": "SpaceLogic C-Bus Home Controller", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 8.8, "epss_score": 0.71084, "cvss_severity": "HIGH", "epss_percentile": 0.99325, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-34753", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34753"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-34753"}]}, {"uuid": "1f9a043c-b093-4f41-9eba-ac695aaee70c", "vulnerability": {"vulnId": "CVE-2017-10974", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "1f9a043c-b093-4f41-9eba-ac695aaee70c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of... | Affected: Yaws / Yaws | CVSS: 7.5 (HIGH) | EPSS: 0.81028 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of...", "vendor": "Yaws", "product": "Yaws", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.81028, "cvss_severity": "HIGH", "epss_percentile": 0.99582, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2017-10974", "url": "https://www.cve.org/CVERecord?id=CVE-2017-10974"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2017-10974"}]}, {"uuid": "16987de2-3130-4b74-921d-88bfdda208a5", "vulnerability": {"vulnId": "CVE-2026-1405", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "16987de2-3130-4b74-921d-88bfdda208a5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-07T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload | Affected: franchidesign / Slider Future | CVSS: 9.8 (CRITICAL) | EPSS: 0.03177 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload", "vendor": "franchidesign", "product": "Slider Future", "added_date": "2026-06-07T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.03177, "cvss_severity": "CRITICAL", "epss_percentile": 0.86384, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-1405", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1405"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-1405"}]}, {"uuid": "d08373c4-30d6-4802-a424-45b21441129f", "vulnerability": {"vulnId": "CVE-2021-27670", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d08373c4-30d6-4802-a424-45b21441129f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-06T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-06T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-06T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. | Affected: Appspace / Appspace 6.2.4 | CVSS: 9.8 (CRITICAL) | EPSS: 0.61274 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.", "vendor": "Appspace", "product": "Appspace 6.2.4", "added_date": "2026-06-06T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.61274, "cvss_severity": "CRITICAL", "epss_percentile": 0.99045, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-27670", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27670"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-27670"}]}, {"uuid": "8b40d2f0-45eb-447f-bcf2-f342df7b9dca", "vulnerability": {"vulnId": "CVE-2021-21805", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8b40d2f0-45eb-447f-bcf2-f342df7b9dca"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-06T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-06T00:00:00+00:00", "recorded_at": "2026-06-23T14:02:37+00:00", "first_seen_at": "2026-06-06T00:00:00+00:00"}, "scope": {"notes": "KEVIntel entry: An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted... | Affected: Advantech / R-SeeNet | CVSS: 9.8 (CRITICAL) | EPSS: 0.69631 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted...", "vendor": "Advantech", "product": "R-SeeNet", "added_date": "2026-06-06T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.69631, "cvss_severity": "CRITICAL", "epss_percentile": 0.99279, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-21805", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21805"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-21805"}]}]}