{"metadata": {"count": 2984, "page": 1, "per_page": 100}, "data": [{"uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "vulnerability": {"vulnId": "CVE-2026-105134", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-09T09:54:00+00:00"}, "timestamps": {"asserted_at": "2026-10-09T09:54:00+00:00", "recorded_at": "2026-10-10T10:00:01+00:00", "first_seen_at": "2026-10-09T09:54:00+00:00"}, "scope": {"notes": "Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection | Affected: Ahsay / AhsayCBS | CVSS: 10.0 (CRITICAL) | EPSS: 0.01843 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection", "cve_id": "CVE-2026-105134", "vendor": "Ahsay", "ghsa_id": null, "product": "AhsayCBS", "added_date": "2026-10-09T09:54:00.860Z", "cvss_score": 10.0, "epss_score": 0.01843, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.78395, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-105134", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-105134", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105134"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-105134"}]}, {"uuid": "b2b7b8c9-bd9b-42a5-9b74-32ea88ff338f", "vulnerability": {"vulnId": "CVE-2026-105133", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b2b7b8c9-bd9b-42a5-9b74-32ea88ff338f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-09T09:53:50+00:00"}, "timestamps": {"asserted_at": "2026-10-09T09:53:50+00:00", "recorded_at": "2026-10-10T10:00:01+00:00", "first_seen_at": "2026-10-09T09:53:50+00:00"}, "scope": {"notes": "Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication | Affected: Ahsay / AhsayCBS | CVSS: 6.9 (MEDIUM) | EPSS: 0.00383 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication", "cve_id": "CVE-2026-105133", "vendor": "Ahsay", "ghsa_id": null, "product": "AhsayCBS", "added_date": "2026-10-09T09:53:50.123Z", "cvss_score": 6.9, "epss_score": 0.00383, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.30303, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-105133", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-105133", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105133"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-105133"}]}, {"uuid": "dd69a225-9482-4dcf-b583-351ac2dc62f8", "vulnerability": {"vulnId": "CVE-2026-102255", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "dd69a225-9482-4dcf-b583-351ac2dc62f8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-09T08:49:34+00:00"}, "timestamps": {"asserted_at": "2026-10-09T08:49:34+00:00", "recorded_at": "2026-10-10T09:00:01+00:00", "first_seen_at": "2026-10-09T08:49:34+00:00"}, "scope": {"notes": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing... | Affected: SonicWall / SMA1000 | CVSS: 10.0 (CRITICAL) | EPSS: 0.00477 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing...", "cve_id": "CVE-2026-102255", "vendor": "SonicWall", "ghsa_id": null, "product": "SMA1000", "added_date": "2026-10-09T08:49:34.082Z", "cvss_score": 10.0, "epss_score": 0.00477, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": true, "cvss_estimated": false, "epss_percentile": 0.39271, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-102255", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-102255", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102255"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-102255"}]}, {"uuid": "4896323e-6ec2-4b4c-9220-528c2158269d", "vulnerability": {"vulnId": "CVE-2025-10123", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "4896323e-6ec2-4b4c-9220-528c2158269d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-09T00:00:00+00:00", "recorded_at": "2026-10-10T11:00:01+00:00", "first_seen_at": "2026-10-09T00:00:00+00:00"}, "scope": {"notes": "D-Link DIR-823X set_static_leases sub_415028 command injection | Affected: D-Link / DIR-823X | CVSS: 6.9 (MEDIUM) | EPSS: 0.04735 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "D-Link DIR-823X set_static_leases sub_415028 command injection", "cve_id": "CVE-2025-10123", "vendor": "D-Link", "ghsa_id": null, "product": "DIR-823X", "added_date": "2026-10-09T00:00:00.000Z", "cvss_score": 6.9, "epss_score": 0.04735, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.9163, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-10123", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-10123", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10123"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-10123"}]}, {"uuid": "b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f", "vulnerability": {"vulnId": "CVE-2021-3199", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-08T17:40:54+00:00"}, "timestamps": {"asserted_at": "2026-10-08T17:40:54+00:00", "recorded_at": "2026-10-09T06:13:48+00:00", "first_seen_at": "2026-10-08T17:40:54+00:00"}, "scope": {"notes": "Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..... | Affected: Onlyoffice / Document Server | CVSS: 9.8 (CRITICAL) | EPSS: 0.08215 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.....", "cve_id": "CVE-2021-3199", "vendor": "Onlyoffice", "ghsa_id": null, "product": "Document Server", "added_date": "2026-10-08T17:40:54.331Z", "cvss_score": 9.8, "epss_score": 0.08215, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.9475, "used_in_malware": "unknown", "vulnerability_id": "CVE-2021-3199", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2021-3199", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3199"}, {"id": "previdian", "url": "https://previdian.com/CVE-2021-3199"}]}, {"uuid": "917791c5-a237-490d-9c0d-8d0318ff465b", "vulnerability": {"vulnId": "CVE-2015-3306", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "917791c5-a237-490d-9c0d-8d0318ff465b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-08T17:40:54+00:00"}, "timestamps": {"asserted_at": "2026-10-08T17:40:54+00:00", "recorded_at": "2026-10-09T06:13:48+00:00", "first_seen_at": "2026-10-08T17:40:54+00:00"}, "scope": {"notes": "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | Affected: Proftpd / Proftpd | CVSS: 10.0 (CRITICAL) | EPSS: 0.96752 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.", "cve_id": "CVE-2015-3306", "vendor": "Proftpd", "ghsa_id": "GHSA-4MFJ-5WR8-X32Q", "product": "Proftpd", "added_date": "2026-10-08T17:40:54.555Z", "cvss_score": 10.0, "epss_score": 0.96752, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.99887, "used_in_malware": "unknown", "vulnerability_id": "CVE-2015-3306", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2015-3306", "url": "https://www.cve.org/CVERecord?id=CVE-2015-3306"}, {"id": "GHSA-4MFJ-5WR8-X32Q", "url": "https://github.com/advisories/GHSA-4MFJ-5WR8-X32Q"}, {"id": "previdian", "url": "https://previdian.com/CVE-2015-3306"}]}, {"uuid": "c6e1ed85-a8fa-48e8-9dff-6523817a5315", "vulnerability": {"vulnId": "CVE-2023-22894", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c6e1ed85-a8fa-48e8-9dff-6523817a5315"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-08T17:40:53+00:00"}, "timestamps": {"asserted_at": "2026-10-08T17:40:53+00:00", "recorded_at": "2026-10-09T06:13:48+00:00", "first_seen_at": "2026-10-08T17:40:53+00:00"}, "scope": {"notes": "Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The... | Affected: Strapi / Strapi | CVSS: 7.2 (HIGH) | EPSS: 0.01658 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The...", "cve_id": "CVE-2023-22894", "vendor": "Strapi", "ghsa_id": "GHSA-JJQF-J4W7-92W8", "product": "Strapi", "added_date": "2026-10-08T17:40:53.828Z", "cvss_score": 7.2, "epss_score": 0.01658, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.7591, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-22894", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2023-22894", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22894"}, {"id": "GHSA-JJQF-J4W7-92W8", "url": "https://github.com/advisories/GHSA-JJQF-J4W7-92W8"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-22894"}]}, {"uuid": "a28c52a3-14e5-4aa3-9101-3faf673e3acf", "vulnerability": {"vulnId": "CVE-2015-5477", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a28c52a3-14e5-4aa3-9101-3faf673e3acf"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-08T17:40:52+00:00"}, "timestamps": {"asserted_at": "2026-10-08T17:40:52+00:00", "recorded_at": "2026-10-09T06:13:48+00:00", "first_seen_at": "2026-10-08T17:40:52+00:00"}, "scope": {"notes": "named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure... | Affected: Isc / Bind | CVSS: 7.5 (HIGH) | EPSS: 0.91284 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure...", "cve_id": "CVE-2015-5477", "vendor": "Isc", "ghsa_id": "GHSA-4622-VJCX-P39J", "product": "Bind", "added_date": "2026-10-08T17:40:52.336Z", "cvss_score": 7.5, "epss_score": 0.91284, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.9981, "used_in_malware": "unknown", "vulnerability_id": "CVE-2015-5477", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2015-5477", "url": "https://www.cve.org/CVERecord?id=CVE-2015-5477"}, {"id": "GHSA-4622-VJCX-P39J", "url": "https://github.com/advisories/GHSA-4622-VJCX-P39J"}, {"id": "previdian", "url": "https://previdian.com/CVE-2015-5477"}]}, {"uuid": "1deb8a8e-6a14-4d30-baf5-900aebe0b9bd", "vulnerability": {"vulnId": "CVE-2025-34469", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "1deb8a8e-6a14-4d30-baf5-900aebe0b9bd"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-08T15:41:02+00:00"}, "timestamps": {"asserted_at": "2026-10-08T15:41:02+00:00", "recorded_at": "2026-10-09T06:13:48+00:00", "first_seen_at": "2026-10-08T15:41:02+00:00"}, "scope": {"notes": "Cowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS Amplification | Affected: Cowrie / Cowrie | CVSS: 6.9 (MEDIUM) | EPSS: 0.00675 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Cowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS Amplification", "cve_id": "CVE-2025-34469", "vendor": "Cowrie", "ghsa_id": "GHSA-83JG-M2PM-4JXJ", "product": "Cowrie", "added_date": "2026-10-08T15:41:02.488Z", "cvss_score": 6.9, "epss_score": 0.00675, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.50715, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-34469", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-34469", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34469"}, {"id": "GHSA-83JG-M2PM-4JXJ", "url": "https://github.com/advisories/GHSA-83JG-M2PM-4JXJ"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-34469"}]}, {"uuid": "62ce49f1-3906-451c-beaa-91854d1c1f3f", "vulnerability": {"vulnId": "CVE-2026-26216", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "62ce49f1-3906-451c-beaa-91854d1c1f3f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-07T16:59:36+00:00"}, "timestamps": {"asserted_at": "2026-10-07T16:59:36+00:00", "recorded_at": "2026-10-08T17:00:02+00:00", "first_seen_at": "2026-10-07T16:59:36+00:00"}, "scope": {"notes": "Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter | Affected: Unclecode / Crawl4AI | CVSS: 10.0 (CRITICAL) | EPSS: 0.05496 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter", "cve_id": "CVE-2026-26216", "vendor": "Unclecode", "ghsa_id": "GHSA-5882-5RX9-XGXP", "product": "Crawl4AI", "added_date": "2026-10-07T16:59:36.524Z", "cvss_score": 10.0, "epss_score": 0.05496, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.92568, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-26216", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-26216", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26216"}, {"id": "GHSA-5882-5RX9-XGXP", "url": "https://github.com/advisories/GHSA-5882-5RX9-XGXP"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-26216"}]}, {"uuid": "e1ec1166-19d6-4883-92e2-0fdf6d18c1e3", "vulnerability": {"vulnId": "CVE-2026-94504", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e1ec1166-19d6-4883-92e2-0fdf6d18c1e3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-07T07:08:00+00:00"}, "timestamps": {"asserted_at": "2026-10-07T07:08:00+00:00", "recorded_at": "2026-10-08T08:00:01+00:00", "first_seen_at": "2026-10-07T07:08:00+00:00"}, "scope": {"notes": "Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting | Affected: Kstover / Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | CVSS: 7.2 (HIGH) | EPSS: 0.00412 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting", "cve_id": "CVE-2026-94504", "vendor": "Kstover", "ghsa_id": null, "product": "Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder", "added_date": "2026-10-07T07:08:00.000Z", "cvss_score": 7.2, "epss_score": 0.00412, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.33392, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-94504", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-94504", "url": "https://www.cve.org/CVERecord?id=CVE-2026-94504"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-94504"}]}, {"uuid": "9508844c-3529-4d84-920b-bfebfd2af3e6", "vulnerability": {"vulnId": "CVE-2026-93836", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "9508844c-3529-4d84-920b-bfebfd2af3e6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-07T07:08:00+00:00"}, "timestamps": {"asserted_at": "2026-10-07T07:08:00+00:00", "recorded_at": "2026-10-08T08:00:01+00:00", "first_seen_at": "2026-10-07T07:08:00+00:00"}, "scope": {"notes": "WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter | Affected: Wpclever / WPC Product Bundles for WooCommerce | CVSS: 7.2 (HIGH) | EPSS: 0.00243 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter", "cve_id": "CVE-2026-93836", "vendor": "Wpclever", "ghsa_id": null, "product": "WPC Product Bundles for WooCommerce", "added_date": "2026-10-07T07:08:00.000Z", "cvss_score": 7.2, "epss_score": 0.00243, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.14185, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-93836", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-93836", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93836"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-93836"}]}, {"uuid": "ca794994-53b1-4f27-8263-ee62a3eb8e2c", "vulnerability": {"vulnId": "CVE-2026-21589", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ca794994-53b1-4f27-8263-ee62a3eb8e2c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-06T21:55:50+00:00"}, "timestamps": {"asserted_at": "2026-10-06T21:55:50+00:00", "recorded_at": "2026-10-07T22:00:01+00:00", "first_seen_at": "2026-10-06T21:55:50+00:00"}, "scope": {"notes": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo... | Affected: Atlassian / Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, Jira Software Data Center | CVSS: 9.3 (CRITICAL) | EPSS: 0.00738 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo...", "cve_id": "CVE-2026-21589", "vendor": "Atlassian", "ghsa_id": null, "product": "Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, Jira Software Data Center", "added_date": "2026-10-06T21:55:50.336Z", "cvss_score": 9.3, "epss_score": 0.00738, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": true, "cvss_estimated": false, "epss_percentile": 0.53045, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-21589", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-21589", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21589"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-21589"}]}, {"uuid": "7d0e3597-9618-4dbd-8041-31a8cd295ac4", "vulnerability": {"vulnId": "CVE-2023-7102", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7d0e3597-9618-4dbd-8041-31a8cd295ac4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-06T18:34:49+00:00"}, "timestamps": {"asserted_at": "2026-10-06T18:34:49+00:00", "recorded_at": "2026-10-07T19:00:01+00:00", "first_seen_at": "2026-10-06T18:34:49+00:00"}, "scope": {"notes": "Remote Code Execution (RCE) Vulnerability | Affected: Barracuda / Barracuda ESG Appliance | CVSS: 9.8 (CRITICAL) | EPSS: 0.44575 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Remote Code Execution (RCE) Vulnerability", "cve_id": "CVE-2023-7102", "vendor": "Barracuda", "ghsa_id": null, "product": "Barracuda ESG Appliance", "added_date": "2026-10-06T18:34:49.746Z", "cvss_score": 9.8, "epss_score": 0.44575, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98734, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-7102", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-7102", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7102"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-7102"}]}, {"uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "vulnerability": {"vulnId": "CVE-2026-51886", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-06T10:31:37+00:00"}, "timestamps": {"asserted_at": "2026-10-06T10:31:37+00:00", "recorded_at": "2026-10-07T11:00:01+00:00", "first_seen_at": "2026-10-06T10:31:37+00:00"}, "scope": {"notes": "langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is:... | Affected: Langflow-ai / langflow | CVSS: 9.8 (CRITICAL) | EPSS: 0.00403 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is:...", "cve_id": "CVE-2026-51886", "vendor": "Langflow-ai", "ghsa_id": null, "product": "langflow", "added_date": "2026-10-06T10:31:37.276Z", "cvss_score": 9.8, "epss_score": 0.00403, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.32379, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-51886", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-51886", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51886"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-51886"}]}, {"uuid": "9d819753-841c-4f81-87e6-078edf156eff", "vulnerability": {"vulnId": "CVE-2025-41243", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "9d819753-841c-4f81-87e6-078edf156eff"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-06T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-06T00:00:00+00:00", "recorded_at": "2026-10-07T11:00:01+00:00", "first_seen_at": "2026-10-06T00:00:00+00:00"}, "scope": {"notes": "Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux | Affected: Spring / Cloud Gateway | CVSS: 10.0 (CRITICAL) | EPSS: 0.03548 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux", "cve_id": "CVE-2025-41243", "vendor": "Spring", "ghsa_id": null, "product": "Cloud Gateway", "added_date": "2026-10-06T00:00:00.000Z", "cvss_score": 10.0, "epss_score": 0.03548, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.88957, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-41243", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-41243", "url": "https://www.cve.org/CVERecord?id=CVE-2025-41243"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-41243"}]}, {"uuid": "84e9cef2-d4a1-4690-bd9f-9e8be9e8372a", "vulnerability": {"vulnId": "CVE-2024-23624", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "84e9cef2-d4a1-4690-bd9f-9e8be9e8372a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-05T16:02:55+00:00"}, "timestamps": {"asserted_at": "2026-10-05T16:02:55+00:00", "recorded_at": "2026-10-06T17:00:01+00:00", "first_seen_at": "2026-10-05T16:02:55+00:00"}, "scope": {"notes": "D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerability | Affected: D-Link / DAP-1650 | CVSS: 9.6 (CRITICAL) | EPSS: 0.25988 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerability", "cve_id": "CVE-2024-23624", "vendor": "D-Link", "ghsa_id": null, "product": "DAP-1650", "added_date": "2026-10-05T16:02:55.607Z", "cvss_score": 9.6, "epss_score": 0.25988, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.97932, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-23624", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-23624", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23624"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-23624"}]}, {"uuid": "1f4021c0-f437-40b1-ba4c-ec891b284272", "vulnerability": {"vulnId": "CVE-2025-34035", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "1f4021c0-f437-40b1-ba4c-ec891b284272"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-05T15:37:06+00:00"}, "timestamps": {"asserted_at": "2026-10-05T15:37:06+00:00", "recorded_at": "2026-10-06T16:00:02+00:00", "first_seen_at": "2026-10-05T15:37:06+00:00"}, "scope": {"notes": "EnGenius EnShare IoT Gigabit Cloud Service Command Injection | Affected: EnGenius / EnShare IoT Gigabit Cloud Service | CVSS: 10.0 (CRITICAL) | EPSS: 0.12531 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "EnGenius EnShare IoT Gigabit Cloud Service Command Injection", "cve_id": "CVE-2025-34035", "vendor": "EnGenius", "ghsa_id": null, "product": "EnShare IoT Gigabit Cloud Service", "added_date": "2026-10-05T15:37:06.305Z", "cvss_score": 10.0, "epss_score": 0.12531, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.96122, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-34035", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-34035", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34035"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-34035"}]}, {"uuid": "5fbc5d1d-e4ac-4880-b93f-0ecc0c64d0ae", "vulnerability": {"vulnId": "CVE-2026-61500", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "5fbc5d1d-e4ac-4880-b93f-0ecc0c64d0ae"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-05T08:32:18+00:00"}, "timestamps": {"asserted_at": "2026-10-05T08:32:18+00:00", "recorded_at": "2026-10-06T09:00:01+00:00", "first_seen_at": "2026-10-05T08:32:18+00:00"}, "scope": {"notes": "Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key | Affected: Rejetto / hfs | CVSS: 9.3 (CRITICAL) | EPSS: 0.00987 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key", "cve_id": "CVE-2026-61500", "vendor": "Rejetto", "ghsa_id": null, "product": "hfs", "added_date": "2026-10-05T08:32:18.906Z", "cvss_score": 9.3, "epss_score": 0.00987, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.61116, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-61500", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-61500", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61500"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-61500"}]}, {"uuid": "b60d31f0-6c6f-4254-a3f3-08bf09670193", "vulnerability": {"vulnId": "CVE-2026-95675", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b60d31f0-6c6f-4254-a3f3-08bf09670193"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-05T07:05:32+00:00"}, "timestamps": {"asserted_at": "2026-10-05T07:05:32+00:00", "recorded_at": "2026-10-06T08:00:01+00:00", "first_seen_at": "2026-10-05T07:05:32+00:00"}, "scope": {"notes": "D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface | Affected: D-LINK / DAP-1360 | CVSS: 9.3 (CRITICAL) | EPSS: 0.02057 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface", "cve_id": "CVE-2026-95675", "vendor": "D-LINK", "ghsa_id": null, "product": "DAP-1360", "added_date": "2026-10-05T07:05:32.858Z", "cvss_score": 9.3, "epss_score": 0.02057, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": true, "cvss_estimated": false, "epss_percentile": 0.80624, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-95675", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-95675", "url": "https://www.cve.org/CVERecord?id=CVE-2026-95675"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-95675"}]}, {"uuid": "f239642a-e081-4d30-bc41-cb05c251d804", "vulnerability": {"vulnId": "CVE-2025-29306", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f239642a-e081-4d30-bc41-cb05c251d804"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-05T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-05T00:00:00+00:00", "recorded_at": "2026-10-06T11:00:01+00:00", "first_seen_at": "2026-10-05T00:00:00+00:00"}, "scope": {"notes": "An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. | Affected: Foxcms / Foxcms | CVSS: 9.8 (CRITICAL) | EPSS: 0.46583 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.", "cve_id": "CVE-2025-29306", "vendor": "Foxcms", "ghsa_id": null, "product": "Foxcms", "added_date": "2026-10-05T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.46583, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98789, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-29306", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-29306", "url": "https://www.cve.org/CVERecord?id=CVE-2025-29306"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-29306"}]}, {"uuid": "57c7c689-0197-4f25-9d8a-cd788e7174e5", "vulnerability": {"vulnId": "CVE-2025-49002", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "57c7c689-0197-4f25-9d8a-cd788e7174e5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-05T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-05T00:00:00+00:00", "recorded_at": "2026-10-06T11:00:01+00:00", "first_seen_at": "2026-10-05T00:00:00+00:00"}, "scope": {"notes": "Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability | Affected: Dataease / dataease | CVSS: 8.2 (HIGH) | EPSS: 0.49985 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability", "cve_id": "CVE-2025-49002", "vendor": "Dataease", "ghsa_id": null, "product": "dataease", "added_date": "2026-10-05T00:00:00.000Z", "cvss_score": 8.2, "epss_score": 0.49985, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98871, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-49002", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-49002", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49002"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-49002"}]}, {"uuid": "0c75f2c5-b09c-4f9c-aba7-7f387979219d", "vulnerability": {"vulnId": "CVE-2025-56520", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0c75f2c5-b09c-4f9c-aba7-7f387979219d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-05T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-05T00:00:00+00:00", "recorded_at": "2026-10-06T11:00:01+00:00", "first_seen_at": "2026-10-05T00:00:00+00:00"}, "scope": {"notes": "Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.... | Affected: Dify / Dify | CVSS: 5.3 (MEDIUM) | EPSS: 0.00696 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi....", "cve_id": "CVE-2025-56520", "vendor": "Dify", "ghsa_id": null, "product": "Dify", "added_date": "2026-10-05T00:00:00.000Z", "cvss_score": 5.3, "epss_score": 0.00696, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.51351, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-56520", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-56520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-56520"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-56520"}]}, {"uuid": "f9546ed0-8bec-45b1-be2d-83be14550f68", "vulnerability": {"vulnId": "CVE-2026-88779", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f9546ed0-8bec-45b1-be2d-83be14550f68"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-04T07:14:00+00:00"}, "timestamps": {"asserted_at": "2026-10-04T07:14:00+00:00", "recorded_at": "2026-10-05T08:00:01+00:00", "first_seen_at": "2026-10-04T07:14:00+00:00"}, "scope": {"notes": "Memory overflow vulnerability  leading to Denial of Service | Affected: NetScaler / ADC, Gateway | CVSS: 8.7 (HIGH) | EPSS: 0.00276 | Used in malware: unknown | Listed 12 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Memory overflow vulnerability  leading to Denial of Service", "cve_id": "CVE-2026-88779", "vendor": "NetScaler", "ghsa_id": "GHSA-56R3-M27M-8P62", "product": "ADC, Gateway", "added_date": "2026-10-04T07:14:00.000Z", "cvss_score": 8.7, "epss_score": 0.00276, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.18203, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-88779", "ahead_of_cisa_kev": {"unit": "hour", "count": 12}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-88779", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88779"}, {"id": "GHSA-56R3-M27M-8P62", "url": "https://github.com/advisories/GHSA-56R3-M27M-8P62"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-88779"}]}, {"uuid": "a1528dcb-547b-427d-be7a-a233141030be", "vulnerability": {"vulnId": "CVE-2025-11913", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a1528dcb-547b-427d-be7a-a233141030be"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-04T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-04T00:00:00+00:00", "recorded_at": "2026-10-05T11:00:01+00:00", "first_seen_at": "2026-10-04T00:00:00+00:00"}, "scope": {"notes": "Shenzhen Ruiming Technology Streamax Crocus Service.do download path traversal | Affected: Shenzhen Ruiming Technology / Streamax Crocus | CVSS: 5.3 (MEDIUM) | EPSS: 0.0087 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Shenzhen Ruiming Technology Streamax Crocus Service.do download path traversal", "cve_id": "CVE-2025-11913", "vendor": "Shenzhen Ruiming Technology", "ghsa_id": null, "product": "Streamax Crocus", "added_date": "2026-10-04T00:00:00.000Z", "cvss_score": 5.3, "epss_score": 0.0087, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.57378, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-11913", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-11913", "url": "https://www.cve.org/CVERecord?id=CVE-2025-11913"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-11913"}]}, {"uuid": "124c7ca3-bf8e-4967-90d6-a4f3090b771d", "vulnerability": {"vulnId": "CVE-2020-37214", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "124c7ca3-bf8e-4967-90d6-a4f3090b771d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-04T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-04T00:00:00+00:00", "recorded_at": "2026-10-05T11:00:01+00:00", "first_seen_at": "2026-10-04T00:00:00+00:00"}, "scope": {"notes": "Voyager 1.3.0 - Directory Traversal | Affected: Control Group / Voyager | CVSS: 8.7 (HIGH) | EPSS: 0.00649 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Voyager 1.3.0 - Directory Traversal", "cve_id": "CVE-2020-37214", "vendor": "Control Group", "ghsa_id": null, "product": "Voyager", "added_date": "2026-10-04T00:00:00.000Z", "cvss_score": 8.7, "epss_score": 0.00649, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.49309, "used_in_malware": "unknown", "vulnerability_id": "CVE-2020-37214", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2020-37214", "url": "https://www.cve.org/CVERecord?id=CVE-2020-37214"}, {"id": "previdian", "url": "https://previdian.com/CVE-2020-37214"}]}, {"uuid": "45471c64-19ff-4006-8f19-b305de9f2b1d", "vulnerability": {"vulnId": "CVE-2023-54405", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "45471c64-19ff-4006-8f19-b305de9f2b1d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T19:00:54+00:00"}, "timestamps": {"asserted_at": "2026-10-02T19:00:54+00:00", "recorded_at": "2026-10-03T20:00:01+00:00", "first_seen_at": "2026-10-02T19:00:54+00:00"}, "scope": {"notes": "H3C CVM Unauthenticated File Upload via fileUpload/upload Token | Affected: H3C / CVM | CVSS: 9.3 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "H3C CVM Unauthenticated File Upload via fileUpload/upload Token", "cve_id": "CVE-2023-54405", "vendor": "H3C", "ghsa_id": "GHSA-369P-HMV2-9PW3", "product": "CVM", "added_date": "2026-10-02T19:00:54.326Z", "cvss_score": 9.3, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-54405", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-54405", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54405"}, {"id": "GHSA-369P-HMV2-9PW3", "url": "https://github.com/advisories/GHSA-369P-HMV2-9PW3"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-54405"}]}, {"uuid": "66a93d1e-50cd-4a1b-bf24-6174560d87d4", "vulnerability": {"vulnId": "CVE-2020-37278", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "66a93d1e-50cd-4a1b-bf24-6174560d87d4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T19:00:53+00:00"}, "timestamps": {"asserted_at": "2026-10-02T19:00:53+00:00", "recorded_at": "2026-10-03T20:00:01+00:00", "first_seen_at": "2026-10-02T19:00:53+00:00"}, "scope": {"notes": "Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile | Affected: Weaver / e-Bridge | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile", "cve_id": "CVE-2020-37278", "vendor": "Weaver", "ghsa_id": "GHSA-JH67-5HQG-R8P4", "product": "e-Bridge", "added_date": "2026-10-02T19:00:53.874Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2020-37278", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2020-37278", "url": "https://www.cve.org/CVERecord?id=CVE-2020-37278"}, {"id": "GHSA-JH67-5HQG-R8P4", "url": "https://github.com/advisories/GHSA-JH67-5HQG-R8P4"}, {"id": "previdian", "url": "https://previdian.com/CVE-2020-37278"}]}, {"uuid": "16a4c4a2-a99b-4de7-8c5b-a03fd029d18b", "vulnerability": {"vulnId": "CVE-2014-125130", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "16a4c4a2-a99b-4de7-8c5b-a03fd029d18b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T19:00:52+00:00"}, "timestamps": {"asserted_at": "2026-10-02T19:00:52+00:00", "recorded_at": "2026-10-03T20:00:01+00:00", "first_seen_at": "2026-10-02T19:00:52+00:00"}, "scope": {"notes": "CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php | Affected: Damjan / CodeArt Google MP3 Audio Player | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php", "cve_id": "CVE-2014-125130", "vendor": "Damjan", "ghsa_id": "GHSA-JXRX-56G9-9J28", "product": "CodeArt Google MP3 Audio Player", "added_date": "2026-10-02T19:00:52.141Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2014-125130", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2014-125130", "url": "https://www.cve.org/CVERecord?id=CVE-2014-125130"}, {"id": "GHSA-JXRX-56G9-9J28", "url": "https://github.com/advisories/GHSA-JXRX-56G9-9J28"}, {"id": "previdian", "url": "https://previdian.com/CVE-2014-125130"}]}, {"uuid": "967b06de-4061-423d-ba9a-fef4488ac312", "vulnerability": {"vulnId": "CVE-2026-65761", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "967b06de-4061-423d-ba9a-fef4488ac312"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T16:06:50+00:00"}, "timestamps": {"asserted_at": "2026-10-02T16:06:50+00:00", "recorded_at": "2026-10-03T17:00:02+00:00", "first_seen_at": "2026-10-02T16:06:50+00:00"}, "scope": {"notes": "Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 | Affected: Joomshaper.com / Easy Store extension for Joomla | CVSS: 9.3 (CRITICAL) | EPSS: 0.01045 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1", "cve_id": "CVE-2026-65761", "vendor": "Joomshaper.com", "ghsa_id": null, "product": "Easy Store extension for Joomla", "added_date": "2026-10-02T16:06:50.740Z", "cvss_score": 9.3, "epss_score": 0.01045, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.62898, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-65761", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-65761", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65761"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-65761"}]}, {"uuid": "c5001898-671d-41c0-9115-d353c67d4a15", "vulnerability": {"vulnId": "CVE-2026-6433", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c5001898-671d-41c0-9115-d353c67d4a15"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T09:09:27+00:00"}, "timestamps": {"asserted_at": "2026-10-02T09:09:27+00:00", "recorded_at": "2026-10-03T10:00:01+00:00", "first_seen_at": "2026-10-02T09:09:27+00:00"}, "scope": {"notes": "Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE | Affected: Custom css-js-php / Custom CSS JS PHP | CVSS: 7.3 (HIGH) | EPSS: 0.00807 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE", "cve_id": "CVE-2026-6433", "vendor": "Custom css-js-php", "ghsa_id": null, "product": "Custom CSS JS PHP", "added_date": "2026-10-02T09:09:27.220Z", "cvss_score": 7.3, "epss_score": 0.00807, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": true, "cvss_estimated": false, "epss_percentile": 0.55306, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-6433", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-6433", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6433"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-6433"}]}, {"uuid": "73a2a54f-f1d3-4e90-88dc-6ac19c1fc509", "vulnerability": {"vulnId": "CVE-2026-73382", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "73a2a54f-f1d3-4e90-88dc-6ac19c1fc509"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T06:40:29+00:00"}, "timestamps": {"asserted_at": "2026-10-02T06:40:29+00:00", "recorded_at": "2026-10-03T07:00:02+00:00", "first_seen_at": "2026-10-02T06:40:29+00:00"}, "scope": {"notes": "WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability | Affected: Gemini Labs / Site Reviews | CVSS: 7.1 (HIGH) | EPSS: 0.00251 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability", "cve_id": "CVE-2026-73382", "vendor": "Gemini Labs", "ghsa_id": "GHSA-JP6J-VV83-V73X", "product": "Site Reviews", "added_date": "2026-10-02T06:40:29.077Z", "cvss_score": 7.1, "epss_score": 0.00251, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.15018, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-73382", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-73382", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73382"}, {"id": "GHSA-JP6J-VV83-V73X", "url": "https://github.com/advisories/GHSA-JP6J-VV83-V73X"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-73382"}]}, {"uuid": "ab834dfd-fb3d-4c8b-89ef-ac7da54da53f", "vulnerability": {"vulnId": "CVE-2026-56005", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ab834dfd-fb3d-4c8b-89ef-ac7da54da53f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T06:40:28+00:00"}, "timestamps": {"asserted_at": "2026-10-02T06:40:28+00:00", "recorded_at": "2026-10-03T07:00:02+00:00", "first_seen_at": "2026-10-02T06:40:28+00:00"}, "scope": {"notes": "WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability | Affected: Melapress / WP Activity Log | CVSS: 7.1 (HIGH) | EPSS: 0.00251 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability", "cve_id": "CVE-2026-56005", "vendor": "Melapress", "ghsa_id": "GHSA-FR34-XVR7-V6G8", "product": "WP Activity Log", "added_date": "2026-10-02T06:40:28.298Z", "cvss_score": 7.1, "epss_score": 0.00251, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.15074, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-56005", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-56005", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56005"}, {"id": "GHSA-FR34-XVR7-V6G8", "url": "https://github.com/advisories/GHSA-FR34-XVR7-V6G8"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-56005"}]}, {"uuid": "be47baf5-d90e-4c28-8544-51a61049c21c", "vulnerability": {"vulnId": "CVE-2016-15047", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "be47baf5-d90e-4c28-8544-51a61049c21c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-10-02T00:00:00+00:00", "recorded_at": "2026-10-03T11:00:01+00:00", "first_seen_at": "2026-10-02T00:00:00+00:00"}, "scope": {"notes": "AVTECH CloudSetup.cgi Authenticated Command Injection | Affected: AVTECH SECURITY / IP Camera, NVR, and DVR Devices | CVSS: 8.7 (HIGH) | EPSS: 0.03879 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "AVTECH CloudSetup.cgi Authenticated Command Injection", "cve_id": "CVE-2016-15047", "vendor": "AVTECH SECURITY", "ghsa_id": null, "product": "IP Camera, NVR, and DVR Devices", "added_date": "2026-10-02T00:00:00.000Z", "cvss_score": 8.7, "epss_score": 0.03879, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.899, "used_in_malware": "unknown", "vulnerability_id": "CVE-2016-15047", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2016-15047", "url": "https://www.cve.org/CVERecord?id=CVE-2016-15047"}, {"id": "previdian", "url": "https://previdian.com/CVE-2016-15047"}]}, {"uuid": "a66b618f-aae5-401b-b529-f7b0c130cdcb", "vulnerability": {"vulnId": "CVE-2026-104286", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a66b618f-aae5-401b-b529-f7b0c130cdcb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-01T19:38:00+00:00"}, "timestamps": {"asserted_at": "2026-10-01T19:38:00+00:00", "recorded_at": "2026-10-02T20:00:01+00:00", "first_seen_at": "2026-10-01T19:38:00+00:00"}, "scope": {"notes": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1,... | Affected: Fortinet / FortiMail | CVSS: 9.8 (CRITICAL) | EPSS: 0.01779 | Used in malware: unknown | Listed 1 hour ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1,...", "cve_id": "CVE-2026-104286", "vendor": "Fortinet", "ghsa_id": "GHSA-6GXC-3VV7-7W24", "product": "FortiMail", "added_date": "2026-10-01T19:38:00.000Z", "cvss_score": 9.8, "epss_score": 0.01779, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.77459, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-104286", "ahead_of_cisa_kev": {"unit": "hour", "count": 1}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-104286", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104286"}, {"id": "GHSA-6GXC-3VV7-7W24", "url": "https://github.com/advisories/GHSA-6GXC-3VV7-7W24"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-104286"}]}, {"uuid": "0cbe614b-0d65-49a6-9ad3-dbca4a72f266", "vulnerability": {"vulnId": "CVE-2025-3759", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0cbe614b-0d65-49a6-9ad3-dbca4a72f266"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-01T16:25:06+00:00"}, "timestamps": {"asserted_at": "2026-10-01T16:25:06+00:00", "recorded_at": "2026-10-02T17:00:01+00:00", "first_seen_at": "2026-10-01T16:25:06+00:00"}, "scope": {"notes": "Missing Authentication for Changing Device Configuration in WF2220 | Affected: Netis / WF2220 | CVSS: 8.7 (HIGH) | EPSS: 0.00249 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Missing Authentication for Changing Device Configuration in WF2220", "cve_id": "CVE-2025-3759", "vendor": "Netis", "ghsa_id": null, "product": "WF2220", "added_date": "2026-10-01T16:25:06.245Z", "cvss_score": 8.7, "epss_score": 0.00249, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.14637, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-3759", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-3759", "url": "https://www.cve.org/CVERecord?id=CVE-2025-3759"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-3759"}]}, {"uuid": "bcafb6ac-6c9e-489c-b5d6-0a5131d6db6e", "vulnerability": {"vulnId": "CVE-2024-58388", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "bcafb6ac-6c9e-489c-b5d6-0a5131d6db6e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-01T14:40:31+00:00"}, "timestamps": {"asserted_at": "2026-10-01T14:40:31+00:00", "recorded_at": "2026-10-02T15:00:01+00:00", "first_seen_at": "2026-10-01T14:40:31+00:00"}, "scope": {"notes": "Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html | Affected: Sharp, Toshiba Tec / Multiple Multifunction Printers | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html", "cve_id": "CVE-2024-58388", "vendor": "Sharp, Toshiba Tec", "ghsa_id": "GHSA-4H3V-2VRP-HX8F", "product": "Multiple Multifunction Printers", "added_date": "2026-10-01T14:40:31.539Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-58388", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-58388", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58388"}, {"id": "GHSA-4H3V-2VRP-HX8F", "url": "https://github.com/advisories/GHSA-4H3V-2VRP-HX8F"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-58388"}]}, {"uuid": "c2410517-1ab1-4f9d-881f-449bfb037a77", "vulnerability": {"vulnId": "CVE-2026-1581", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c2410517-1ab1-4f9d-881f-449bfb037a77"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-01T09:44:10+00:00"}, "timestamps": {"asserted_at": "2026-10-01T09:44:10+00:00", "recorded_at": "2026-10-02T10:00:01+00:00", "first_seen_at": "2026-10-01T09:44:10+00:00"}, "scope": {"notes": "wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection | Affected: Tomdever / wpForo Forum | CVSS: 7.5 (HIGH) | EPSS: 0.01727 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection", "cve_id": "CVE-2026-1581", "vendor": "Tomdever", "ghsa_id": null, "product": "wpForo Forum", "added_date": "2026-10-01T09:44:10.830Z", "cvss_score": 7.5, "epss_score": 0.01727, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.76722, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-1581", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-1581", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1581"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-1581"}]}, {"uuid": "67178a7a-26a9-4107-b0b6-88b1053a340d", "vulnerability": {"vulnId": "CVE-2026-100382", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "67178a7a-26a9-4107-b0b6-88b1053a340d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-10-01T09:43:00+00:00"}, "timestamps": {"asserted_at": "2026-10-01T09:43:00+00:00", "recorded_at": "2026-10-02T10:00:01+00:00", "first_seen_at": "2026-10-01T09:43:00+00:00"}, "scope": {"notes": "Unauthenticated remote code execution through wikitext in ExternalData | Affected: Wikimedia / Mediawiki - ExternalData Extension | CVSS: 10.0 (CRITICAL) | EPSS: 0.00947 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Unauthenticated remote code execution through wikitext in ExternalData", "cve_id": "CVE-2026-100382", "vendor": "Wikimedia", "ghsa_id": null, "product": "Mediawiki - ExternalData Extension", "added_date": "2026-10-01T09:43:00.000Z", "cvss_score": 10.0, "epss_score": 0.00947, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.5976, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-100382", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-100382", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100382"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-100382"}]}, {"uuid": "093ac396-53fc-48fb-a297-9ce1df475354", "vulnerability": {"vulnId": "CVE-2024-58387", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "093ac396-53fc-48fb-a297-9ce1df475354"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-30T20:40:21+00:00"}, "timestamps": {"asserted_at": "2026-09-30T20:40:21+00:00", "recorded_at": "2026-10-01T21:00:01+00:00", "first_seen_at": "2026-09-30T20:40:21+00:00"}, "scope": {"notes": "Inspur HCM Cloud Arbitrary File Read via file/download Endpoint | Affected: Inspur / Haiyue HCM Cloud | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Inspur HCM Cloud Arbitrary File Read via file/download Endpoint", "cve_id": "CVE-2024-58387", "vendor": "Inspur", "ghsa_id": "GHSA-9FRQ-682F-P456", "product": "Haiyue HCM Cloud", "added_date": "2026-09-30T20:40:21.475Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-58387", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-58387", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58387"}, {"id": "GHSA-9FRQ-682F-P456", "url": "https://github.com/advisories/GHSA-9FRQ-682F-P456"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-58387"}]}, {"uuid": "49542f3e-49e6-4af2-b34d-7876129065d5", "vulnerability": {"vulnId": "CVE-2023-54403", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "49542f3e-49e6-4af2-b34d-7876129065d5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-30T20:40:20+00:00"}, "timestamps": {"asserted_at": "2026-09-30T20:40:20+00:00", "recorded_at": "2026-10-01T21:00:01+00:00", "first_seen_at": "2026-09-30T20:40:20+00:00"}, "scope": {"notes": "Yonyou U8 CRM Arbitrary File Read via getemaildata.php | Affected: Yonyou / U8 CRM | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Yonyou U8 CRM Arbitrary File Read via getemaildata.php", "cve_id": "CVE-2023-54403", "vendor": "Yonyou", "ghsa_id": "GHSA-8VGX-V6GM-MHXR", "product": "U8 CRM", "added_date": "2026-09-30T20:40:20.538Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-54403", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-54403", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54403"}, {"id": "GHSA-8VGX-V6GM-MHXR", "url": "https://github.com/advisories/GHSA-8VGX-V6GM-MHXR"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-54403"}]}, {"uuid": "f4b7332f-d6fe-43a3-8a9f-b8ea951f0b95", "vulnerability": {"vulnId": "CVE-2023-54402", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f4b7332f-d6fe-43a3-8a9f-b8ea951f0b95"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-30T20:30:25+00:00"}, "timestamps": {"asserted_at": "2026-09-30T20:30:25+00:00", "recorded_at": "2026-10-01T21:00:01+00:00", "first_seen_at": "2026-09-30T20:30:25+00:00"}, "scope": {"notes": "iDocView SSRF via /doc/upload Endpoint Hardcoded Token | Affected: iDocView / iDocView | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "iDocView SSRF via /doc/upload Endpoint Hardcoded Token", "cve_id": "CVE-2023-54402", "vendor": "iDocView", "ghsa_id": "GHSA-2XG3-76QW-G9MM", "product": "iDocView", "added_date": "2026-09-30T20:30:25.907Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-54402", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-54402", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54402"}, {"id": "GHSA-2XG3-76QW-G9MM", "url": "https://github.com/advisories/GHSA-2XG3-76QW-G9MM"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-54402"}]}, {"uuid": "001ddc38-48ab-4017-8d21-a67300513e14", "vulnerability": {"vulnId": "CVE-2026-102490", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "001ddc38-48ab-4017-8d21-a67300513e14"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-30T18:53:04+00:00"}, "timestamps": {"asserted_at": "2026-09-30T18:53:04+00:00", "recorded_at": "2026-10-01T19:00:01+00:00", "first_seen_at": "2026-09-30T18:53:04+00:00"}, "scope": {"notes": "Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha | Affected: Zammad / Zammad | CVSS: 8.5 (HIGH) | EPSS: 0.00319 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha", "cve_id": "CVE-2026-102490", "vendor": "Zammad", "ghsa_id": "GHSA-HGFF-G8G3-4XR8", "product": "Zammad", "added_date": "2026-09-30T18:53:04.428Z", "cvss_score": 8.5, "epss_score": 0.00319, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.22508, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-102490", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-102490", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102490"}, {"id": "GHSA-HGFF-G8G3-4XR8", "url": "https://github.com/advisories/GHSA-HGFF-G8G3-4XR8"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-102490"}]}, {"uuid": "e84ea692-17b1-47d8-adfb-2c5c590f6965", "vulnerability": {"vulnId": "CVE-2026-102489", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e84ea692-17b1-47d8-adfb-2c5c590f6965"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-30T18:52:45+00:00"}, "timestamps": {"asserted_at": "2026-09-30T18:52:45+00:00", "recorded_at": "2026-10-01T19:00:01+00:00", "first_seen_at": "2026-09-30T18:52:45+00:00"}, "scope": {"notes": "Undisclosed RCE in Zammad v6.3 and higher | Affected: Zammad / Zammad | CVSS: 8.7 (HIGH) | EPSS: 0.00709 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Undisclosed RCE in Zammad v6.3 and higher", "cve_id": "CVE-2026-102489", "vendor": "Zammad", "ghsa_id": "GHSA-XMW5-M2WG-4243", "product": "Zammad", "added_date": "2026-09-30T18:52:45.188Z", "cvss_score": 8.7, "epss_score": 0.00709, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.51763, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-102489", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-102489", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102489"}, {"id": "GHSA-XMW5-M2WG-4243", "url": "https://github.com/advisories/GHSA-XMW5-M2WG-4243"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-102489"}]}, {"uuid": "d5233a23-4682-413c-818a-709221feb653", "vulnerability": {"vulnId": "CVE-2026-76504", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d5233a23-4682-413c-818a-709221feb653"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-30T13:49:09+00:00"}, "timestamps": {"asserted_at": "2026-09-30T13:49:09+00:00", "recorded_at": "2026-10-01T14:00:01+00:00", "first_seen_at": "2026-09-30T13:49:09+00:00"}, "scope": {"notes": "Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability | Affected: Cisco / Cisco Catalyst SD-WAN Manager | CVSS: 9.8 (CRITICAL) | Used in malware: unknown | Listed 4 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability", "cve_id": "CVE-2026-76504", "vendor": "Cisco", "ghsa_id": "GHSA-XQJC-V467-8FVF", "product": "Cisco Catalyst SD-WAN Manager", "added_date": "2026-09-30T13:49:09.169Z", "cvss_score": 9.8, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-76504", "ahead_of_cisa_kev": {"unit": "hour", "count": 4}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-76504", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76504"}, {"id": "GHSA-XQJC-V467-8FVF", "url": "https://github.com/advisories/GHSA-XQJC-V467-8FVF"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-76504"}]}, {"uuid": "7c66304f-e455-401e-9a9a-c3f649473687", "vulnerability": {"vulnId": "CVE-2023-54400", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7c66304f-e455-401e-9a9a-c3f649473687"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-29T15:30:26+00:00"}, "timestamps": {"asserted_at": "2026-09-29T15:30:26+00:00", "recorded_at": "2026-09-30T16:00:01+00:00", "first_seen_at": "2026-09-29T15:30:26+00:00"}, "scope": {"notes": "Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname | Affected: Fumasoft / Fumeng Cloud | CVSS: 9.3 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname", "cve_id": "CVE-2023-54400", "vendor": "Fumasoft", "ghsa_id": "GHSA-39VR-225P-6CCC", "product": "Fumeng Cloud", "added_date": "2026-09-29T15:30:26.734Z", "cvss_score": 9.3, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-54400", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-54400", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54400"}, {"id": "GHSA-39VR-225P-6CCC", "url": "https://github.com/advisories/GHSA-39VR-225P-6CCC"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-54400"}]}, {"uuid": "37f53b50-caff-402a-bf20-fccfb2a40756", "vulnerability": {"vulnId": "CVE-2015-20122", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "37f53b50-caff-402a-bf20-fccfb2a40756"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-29T15:10:34+00:00"}, "timestamps": {"asserted_at": "2026-09-29T15:10:34+00:00", "recorded_at": "2026-09-30T16:00:01+00:00", "first_seen_at": "2026-09-29T15:10:34+00:00"}, "scope": {"notes": "Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp | Affected: Yonyou / A6 OA | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp", "cve_id": "CVE-2015-20122", "vendor": "Yonyou", "ghsa_id": "GHSA-JP76-J5HR-562V", "product": "A6 OA", "added_date": "2026-09-29T15:10:34.191Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2015-20122", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2015-20122", "url": "https://www.cve.org/CVERecord?id=CVE-2015-20122"}, {"id": "GHSA-JP76-J5HR-562V", "url": "https://github.com/advisories/GHSA-JP76-J5HR-562V"}, {"id": "previdian", "url": "https://previdian.com/CVE-2015-20122"}]}, {"uuid": "4d20aa8a-6177-4f53-8598-87bdf2fef32b", "vulnerability": {"vulnId": "CVE-2026-85520", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "4d20aa8a-6177-4f53-8598-87bdf2fef32b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-29T11:40:26+00:00"}, "timestamps": {"asserted_at": "2026-09-29T11:40:26+00:00", "recorded_at": "2026-09-30T12:00:02+00:00", "first_seen_at": "2026-09-29T11:40:26+00:00"}, "scope": {"notes": "Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module | Affected: MyPresta / Google Merchant Center Feed | CVSS: 9.3 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module", "cve_id": "CVE-2026-85520", "vendor": "MyPresta", "ghsa_id": "GHSA-MXMH-VX83-QFXG", "product": "Google Merchant Center Feed", "added_date": "2026-09-29T11:40:26.621Z", "cvss_score": 9.3, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-85520", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-85520", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85520"}, {"id": "GHSA-MXMH-VX83-QFXG", "url": "https://github.com/advisories/GHSA-MXMH-VX83-QFXG"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-85520"}]}, {"uuid": "b16025d2-fd35-495e-b70d-30d7cd33aa5f", "vulnerability": {"vulnId": "CVE-2025-62023", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b16025d2-fd35-495e-b70d-30d7cd33aa5f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-29T07:10:24+00:00"}, "timestamps": {"asserted_at": "2026-09-29T07:10:24+00:00", "recorded_at": "2026-09-30T08:00:02+00:00", "first_seen_at": "2026-09-29T07:10:24+00:00"}, "scope": {"notes": "WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability | Affected: Cristi\u00e1n L\u00e1vaque / s2Member | CVSS: 9.0 (CRITICAL) | EPSS: 0.00418 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability", "cve_id": "CVE-2025-62023", "vendor": "Cristi\u00e1n L\u00e1vaque", "ghsa_id": null, "product": "s2Member", "added_date": "2026-09-29T07:10:24.985Z", "cvss_score": 9.0, "epss_score": 0.00418, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.33673, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-62023", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-62023", "url": "https://www.cve.org/CVERecord?id=CVE-2025-62023"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-62023"}]}, {"uuid": "40f14d7c-bfd6-4b8b-9521-0da985c5b884", "vulnerability": {"vulnId": "CVE-2026-86950", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "40f14d7c-bfd6-4b8b-9521-0da985c5b884"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-28T19:30:46+00:00"}, "timestamps": {"asserted_at": "2026-09-28T19:30:46+00:00", "recorded_at": "2026-09-29T20:00:01+00:00", "first_seen_at": "2026-09-28T19:30:46+00:00"}, "scope": {"notes": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia... | Affected: Apple / iOS and iPadOS, macOS | CVSS: 8.8 (HIGH) | EPSS: 0.00812 | Used in malware: unknown | Listed 19 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia...", "cve_id": "CVE-2026-86950", "vendor": "Apple", "ghsa_id": "GHSA-3CF3-H799-FJVQ", "product": "iOS and iPadOS, macOS", "added_date": "2026-09-28T19:30:46.754Z", "cvss_score": 8.8, "epss_score": 0.00812, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.55295, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-86950", "ahead_of_cisa_kev": {"unit": "hour", "count": 19}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-86950", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86950"}, {"id": "GHSA-3CF3-H799-FJVQ", "url": "https://github.com/advisories/GHSA-3CF3-H799-FJVQ"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-86950"}]}, {"uuid": "5a852104-5b26-428f-8c7f-d9d3e32b0cb4", "vulnerability": {"vulnId": "CVE-2026-49076", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "5a852104-5b26-428f-8c7f-d9d3e32b0cb4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-28T06:01:08+00:00"}, "timestamps": {"asserted_at": "2026-09-28T06:01:08+00:00", "recorded_at": "2026-09-29T07:00:01+00:00", "first_seen_at": "2026-09-28T06:01:08+00:00"}, "scope": {"notes": "WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability | Affected: Crocoblock / JetEngine | CVSS: 9.3 (CRITICAL) | EPSS: 0.004 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability", "cve_id": "CVE-2026-49076", "vendor": "Crocoblock", "ghsa_id": "GHSA-JM3J-9P9F-953F", "product": "JetEngine", "added_date": "2026-09-28T06:01:08.926Z", "cvss_score": 9.3, "epss_score": 0.004, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.31642, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-49076", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-49076", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49076"}, {"id": "GHSA-JM3J-9P9F-953F", "url": "https://github.com/advisories/GHSA-JM3J-9P9F-953F"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-49076"}]}, {"uuid": "32ec46a3-6547-4d17-889b-c5f8adf87441", "vulnerability": {"vulnId": "CVE-2026-42608", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "32ec46a3-6547-4d17-889b-c5f8adf87441"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-27T17:12:00+00:00"}, "timestamps": {"asserted_at": "2026-09-27T17:12:00+00:00", "recorded_at": "2026-09-28T18:00:01+00:00", "first_seen_at": "2026-09-27T17:12:00+00:00"}, "scope": {"notes": "Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. | Affected: Getgrav / grav | CVSS: 8.8 (HIGH) | EPSS: 0.00521 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.", "cve_id": "CVE-2026-42608", "vendor": "Getgrav", "ghsa_id": null, "product": "grav", "added_date": "2026-09-27T17:12:00.000Z", "cvss_score": 8.8, "epss_score": 0.00521, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.41948, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-42608", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-42608", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42608"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-42608"}]}, {"uuid": "fb84583a-1292-444b-a5af-e431e11e44e6", "vulnerability": {"vulnId": "CVE-2026-88772", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "fb84583a-1292-444b-a5af-e431e11e44e6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-27T16:45:00+00:00"}, "timestamps": {"asserted_at": "2026-09-27T16:45:00+00:00", "recorded_at": "2026-09-28T17:00:01+00:00", "first_seen_at": "2026-09-27T16:45:00+00:00"}, "scope": {"notes": "Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Affected: Citrix NetScaler / ADC, Gateway | CVSS: 9.5 (CRITICAL) | Used in malware: unknown | Listed 5 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Memory overflow vulnerability leading to Remote Code Execution or Denial of Service", "cve_id": "CVE-2026-88772", "vendor": "Citrix NetScaler", "ghsa_id": "GHSA-H5XM-PF48-4C32", "product": "ADC, Gateway", "added_date": "2026-09-27T16:45:00.000Z", "cvss_score": 9.5, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-88772", "ahead_of_cisa_kev": {"unit": "hour", "count": 5}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-88772", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88772"}, {"id": "GHSA-H5XM-PF48-4C32", "url": "https://github.com/advisories/GHSA-H5XM-PF48-4C32"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-88772"}]}, {"uuid": "8531502c-38a6-45cf-a019-1e85f05f720a", "vulnerability": {"vulnId": "CVE-2026-88771", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8531502c-38a6-45cf-a019-1e85f05f720a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-27T16:44:00+00:00"}, "timestamps": {"asserted_at": "2026-09-27T16:44:00+00:00", "recorded_at": "2026-09-28T17:00:01+00:00", "first_seen_at": "2026-09-27T16:44:00+00:00"}, "scope": {"notes": "A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | Affected: Citrix NetScaler / ADC, Gateway | CVSS: 9.5 (CRITICAL) | Used in malware: unknown | Listed 5 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands", "cve_id": "CVE-2026-88771", "vendor": "Citrix NetScaler", "ghsa_id": "GHSA-MX58-P288-86QP", "product": "ADC, Gateway", "added_date": "2026-09-27T16:44:00.000Z", "cvss_score": 9.5, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-88771", "ahead_of_cisa_kev": {"unit": "hour", "count": 5}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-88771", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88771"}, {"id": "GHSA-MX58-P288-86QP", "url": "https://github.com/advisories/GHSA-MX58-P288-86QP"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-88771"}]}, {"uuid": "cf4216fb-e807-4062-8066-f8e3e06f3cb9", "vulnerability": {"vulnId": "CVE-2026-65660", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "cf4216fb-e807-4062-8066-f8e3e06f3cb9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-24T12:32:16+00:00"}, "timestamps": {"asserted_at": "2026-09-24T12:32:16+00:00", "recorded_at": "2026-09-25T13:00:01+00:00", "first_seen_at": "2026-09-24T12:32:16+00:00"}, "scope": {"notes": "Microsoft SharePoint Server Remote Code Execution Vulnerability | Affected: Microsoft / Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition | CVSS: 8.8 (HIGH) | EPSS: 0.01192 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "cve_id": "CVE-2026-65660", "vendor": "Microsoft", "ghsa_id": "GHSA-R94X-X846-RXQX", "product": "Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition", "added_date": "2026-09-24T12:32:16.826Z", "cvss_score": 8.8, "epss_score": 0.01192, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.66634, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-65660", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-65660", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65660"}, {"id": "GHSA-R94X-X846-RXQX", "url": "https://github.com/advisories/GHSA-R94X-X846-RXQX"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-65660"}]}, {"uuid": "d60be5ee-8dc0-4445-8ee3-de257a629592", "vulnerability": {"vulnId": "CVE-2026-48842", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d60be5ee-8dc0-4445-8ee3-de257a629592"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-24T09:23:00+00:00"}, "timestamps": {"asserted_at": "2026-09-24T09:23:00+00:00", "recorded_at": "2026-09-25T10:00:01+00:00", "first_seen_at": "2026-09-24T09:23:00+00:00"}, "scope": {"notes": "Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace()... | Affected: Roundcube / Webmail | CVSS: 8.1 (HIGH) | EPSS: 0.00888 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace()...", "cve_id": "CVE-2026-48842", "vendor": "Roundcube", "ghsa_id": null, "product": "Webmail", "added_date": "2026-09-24T09:23:00.000Z", "cvss_score": 8.1, "epss_score": 0.00888, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.57555, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-48842", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-48842", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48842"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-48842"}]}, {"uuid": "e256776c-0b8f-41d4-9ac6-b67df9058184", "vulnerability": {"vulnId": "CVE-2026-67279", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e256776c-0b8f-41d4-9ac6-b67df9058184"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-23T17:08:47+00:00"}, "timestamps": {"asserted_at": "2026-09-23T17:08:47+00:00", "recorded_at": "2026-09-24T18:00:01+00:00", "first_seen_at": "2026-09-23T17:08:47+00:00"}, "scope": {"notes": "SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | Affected: Mikrotik / RouterOS | CVSS: 6.9 (MEDIUM) | EPSS: 0.00446 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS", "cve_id": "CVE-2026-67279", "vendor": "Mikrotik", "ghsa_id": null, "product": "RouterOS", "added_date": "2026-09-23T17:08:47.607Z", "cvss_score": 6.9, "epss_score": 0.00446, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.38167, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-67279", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-67279", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67279"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-67279"}]}, {"uuid": "d94335f8-a75d-4714-b625-7e5c5418779a", "vulnerability": {"vulnId": "CVE-2026-87902", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d94335f8-a75d-4714-b625-7e5c5418779a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-23T12:53:51+00:00"}, "timestamps": {"asserted_at": "2026-09-23T12:53:51+00:00", "recorded_at": "2026-09-24T13:00:01+00:00", "first_seen_at": "2026-09-23T12:53:51+00:00"}, "scope": {"notes": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active... | Affected: WordPress / WordPress | CVSS: 8.1 (HIGH) | EPSS: 0.0042 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active...", "cve_id": "CVE-2026-87902", "vendor": "WordPress", "ghsa_id": null, "product": "WordPress", "added_date": "2026-09-23T12:53:51.266Z", "cvss_score": 8.1, "epss_score": 0.0042, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.35945, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-87902", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-87902", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87902"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-87902"}]}, {"uuid": "fd1ef58c-7221-498a-9b82-d2d318be7af2", "vulnerability": {"vulnId": "CVE-2026-94127", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "fd1ef58c-7221-498a-9b82-d2d318be7af2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T16:21:00+00:00"}, "timestamps": {"asserted_at": "2026-09-22T16:21:00+00:00", "recorded_at": "2026-09-23T17:00:01+00:00", "first_seen_at": "2026-09-22T16:21:00+00:00"}, "scope": {"notes": "BIG-IP APM OAuth vulnerability | Affected: F5 / BIG-IP | CVSS: 9.3 (CRITICAL) | EPSS: 0.01391 | Used in malware: unknown | Listed 3 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "BIG-IP APM OAuth vulnerability", "cve_id": "CVE-2026-94127", "vendor": "F5", "ghsa_id": "GHSA-QPPV-6JRG-HXQ4", "product": "BIG-IP", "added_date": "2026-09-22T16:21:00.000Z", "cvss_score": 9.3, "epss_score": 0.01391, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.71171, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-94127", "ahead_of_cisa_kev": {"unit": "hour", "count": 3}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-94127", "url": "https://www.cve.org/CVERecord?id=CVE-2026-94127"}, {"id": "GHSA-QPPV-6JRG-HXQ4", "url": "https://github.com/advisories/GHSA-QPPV-6JRG-HXQ4"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-94127"}]}, {"uuid": "550d42d5-c0a7-4671-80e0-1ee97a3ea93c", "vulnerability": {"vulnId": "CVE-2026-75949", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "550d42d5-c0a7-4671-80e0-1ee97a3ea93c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T13:50:27+00:00"}, "timestamps": {"asserted_at": "2026-09-22T13:50:27+00:00", "recorded_at": "2026-09-23T14:00:01+00:00", "first_seen_at": "2026-09-22T13:50:27+00:00"}, "scope": {"notes": "Joomla Extension - cmsjunkie.com -  Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 | Affected: Cmsjunkie.com / J-BusinessDirectory extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.00312 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Joomla Extension - cmsjunkie.com -  Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3", "cve_id": "CVE-2026-75949", "vendor": "Cmsjunkie.com", "ghsa_id": null, "product": "J-BusinessDirectory extension for Joomla", "added_date": "2026-09-22T13:50:27.661Z", "cvss_score": 10.0, "epss_score": 0.00312, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.24255, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-75949", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-75949", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75949"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-75949"}]}, {"uuid": "ee9c0ffc-6063-477c-8c6e-4b9772209835", "vulnerability": {"vulnId": "CVE-2026-93616", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ee9c0ffc-6063-477c-8c6e-4b9772209835"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T13:50:06+00:00"}, "timestamps": {"asserted_at": "2026-09-22T13:50:06+00:00", "recorded_at": "2026-09-23T14:00:01+00:00", "first_seen_at": "2026-09-22T13:50:06+00:00"}, "scope": {"notes": "Directory Traversal and File upload allows execution of arbitrary script on the Management Server | Affected: Checkpoint / Quantum Security Management | CVSS: 9.8 (CRITICAL) | Used in malware: unknown | Listed 6 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Directory Traversal and File upload allows execution of arbitrary script on the Management Server", "cve_id": "CVE-2026-93616", "vendor": "Checkpoint", "ghsa_id": "GHSA-X5GQ-4CXX-RF2R", "product": "Quantum Security Management", "added_date": "2026-09-22T13:50:06.963Z", "cvss_score": 9.8, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-93616", "ahead_of_cisa_kev": {"unit": "hour", "count": 6}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-93616", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93616"}, {"id": "GHSA-X5GQ-4CXX-RF2R", "url": "https://github.com/advisories/GHSA-X5GQ-4CXX-RF2R"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-93616"}]}, {"uuid": "2fa907d9-9cf4-41f5-8c8a-f1ba1afd2999", "vulnerability": {"vulnId": "CVE-2026-85102", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "2fa907d9-9cf4-41f5-8c8a-f1ba1afd2999"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T13:49:33+00:00"}, "timestamps": {"asserted_at": "2026-09-22T13:49:33+00:00", "recorded_at": "2026-09-23T14:00:01+00:00", "first_seen_at": "2026-09-22T13:49:33+00:00"}, "scope": {"notes": "Improper Certificate Validation in Quantum Security Gateway | Affected: Checkpoint / Quantum Security Gateway | CVSS: 9.8 (CRITICAL) | EPSS: 0.00329 | Used in malware: unknown | Listed 6 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Improper Certificate Validation in Quantum Security Gateway", "cve_id": "CVE-2026-85102", "vendor": "Checkpoint", "ghsa_id": "GHSA-3FVR-5GG9-225M", "product": "Quantum Security Gateway", "added_date": "2026-09-22T13:49:33.449Z", "cvss_score": 9.8, "epss_score": 0.00329, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.26293, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-85102", "ahead_of_cisa_kev": {"unit": "hour", "count": 6}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-85102", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85102"}, {"id": "GHSA-3FVR-5GG9-225M", "url": "https://github.com/advisories/GHSA-3FVR-5GG9-225M"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-85102"}]}, {"uuid": "29fc720b-8bbf-423f-932b-1423f4349a5f", "vulnerability": {"vulnId": "CVE-2026-79756", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "29fc720b-8bbf-423f-932b-1423f4349a5f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T11:33:20+00:00"}, "timestamps": {"asserted_at": "2026-09-22T11:33:20+00:00", "recorded_at": "2026-09-23T12:00:01+00:00", "first_seen_at": "2026-09-22T11:33:20+00:00"}, "scope": {"notes": "Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform | Affected: Nuclio / nuclio | CVSS: 8.7 (HIGH) | EPSS: 0.05148 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform", "cve_id": "CVE-2026-79756", "vendor": "Nuclio", "ghsa_id": null, "product": "nuclio", "added_date": "2026-09-22T11:33:20.860Z", "cvss_score": 8.7, "epss_score": 0.05148, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.92043, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-79756", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-79756", "url": "https://www.cve.org/CVERecord?id=CVE-2026-79756"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-79756"}]}, {"uuid": "b5ed2306-c9e6-49e3-8621-a0ea3f1ad228", "vulnerability": {"vulnId": "CVE-2026-54569", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "b5ed2306-c9e6-49e3-8621-a0ea3f1ad228"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T11:33:14+00:00"}, "timestamps": {"asserted_at": "2026-09-22T11:33:14+00:00", "recorded_at": "2026-09-23T12:00:01+00:00", "first_seen_at": "2026-09-22T11:33:14+00:00"}, "scope": {"notes": "SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core | Affected: Senaite / senaite.core | CVSS: 9.8 (CRITICAL) | EPSS: 0.00776 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core", "cve_id": "CVE-2026-54569", "vendor": "Senaite", "ghsa_id": null, "product": "senaite.core", "added_date": "2026-09-22T11:33:14.053Z", "cvss_score": 9.8, "epss_score": 0.00776, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.54306, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-54569", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-54569", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54569"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-54569"}]}, {"uuid": "19974dd3-6491-475e-86c3-fd4ddcafc724", "vulnerability": {"vulnId": "CVE-2026-56271", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "19974dd3-6491-475e-86c3-fd4ddcafc724"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T11:32:55+00:00"}, "timestamps": {"asserted_at": "2026-09-22T11:32:55+00:00", "recorded_at": "2026-09-23T12:00:01+00:00", "first_seen_at": "2026-09-22T11:32:55+00:00"}, "scope": {"notes": "Flowise - Weak Default JWT Secrets in Authentication Middleware | Affected: Flowise / Flowise | CVSS: 9.3 (CRITICAL) | EPSS: 0.00655 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Flowise - Weak Default JWT Secrets in Authentication Middleware", "cve_id": "CVE-2026-56271", "vendor": "Flowise", "ghsa_id": null, "product": "Flowise", "added_date": "2026-09-22T11:32:55.153Z", "cvss_score": 9.3, "epss_score": 0.00655, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.49936, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-56271", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-56271", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56271"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-56271"}]}, {"uuid": "ec6923e9-01bf-4e63-b522-ee4566299eb4", "vulnerability": {"vulnId": "CVE-2026-93952", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ec6923e9-01bf-4e63-b522-ee4566299eb4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T10:06:00+00:00"}, "timestamps": {"asserted_at": "2026-09-22T10:06:00+00:00", "recorded_at": "2026-09-23T11:00:01+00:00", "first_seen_at": "2026-09-22T10:06:00+00:00"}, "scope": {"notes": "Security Advisory 0183 | Affected: Arista Networks / VeloCloud Orchestrator (VCO) On-Prem | CVSS: 9.5 (CRITICAL) | EPSS: 0.00424 | Used in malware: unknown | Listed 10 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Security Advisory 0183", "cve_id": "CVE-2026-93952", "vendor": "Arista Networks", "ghsa_id": "GHSA-FQHW-F6HF-CQ3W", "product": "VeloCloud Orchestrator (VCO) On-Prem", "added_date": "2026-09-22T10:06:00.365Z", "cvss_score": 9.5, "epss_score": 0.00424, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.36318, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-93952", "ahead_of_cisa_kev": {"unit": "hour", "count": 10}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-93952", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93952"}, {"id": "GHSA-FQHW-F6HF-CQ3W", "url": "https://github.com/advisories/GHSA-FQHW-F6HF-CQ3W"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-93952"}]}, {"uuid": "4ab1e200-28ab-455a-8f7b-a4da9fa29a0e", "vulnerability": {"vulnId": "CVE-2026-66457", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "4ab1e200-28ab-455a-8f7b-a4da9fa29a0e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T07:50:38+00:00"}, "timestamps": {"asserted_at": "2026-09-22T07:50:38+00:00", "recorded_at": "2026-09-23T08:00:02+00:00", "first_seen_at": "2026-09-22T07:50:38+00:00"}, "scope": {"notes": "WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability | Affected: Pixelite / Events Manager | CVSS: 7.1 (HIGH) | EPSS: 0.00186 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability", "cve_id": "CVE-2026-66457", "vendor": "Pixelite", "ghsa_id": null, "product": "Events Manager", "added_date": "2026-09-22T07:50:38.771Z", "cvss_score": 7.1, "epss_score": 0.00186, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.08406, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-66457", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-66457", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66457"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-66457"}]}, {"uuid": "a3aebe6f-9de4-46ea-8b05-71a1bc616406", "vulnerability": {"vulnId": "CVE-2016-20080", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a3aebe6f-9de4-46ea-8b05-71a1bc616406"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-22T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-22T00:00:00+00:00", "recorded_at": "2026-09-23T11:00:01+00:00", "first_seen_at": "2026-09-22T00:00:00+00:00"}, "scope": {"notes": "WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php | Affected: Brandfolder / Brandfolder | CVSS: 6.9 (MEDIUM) | EPSS: 0.0039 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php", "cve_id": "CVE-2016-20080", "vendor": "Brandfolder", "ghsa_id": null, "product": "Brandfolder", "added_date": "2026-09-22T00:00:00.000Z", "cvss_score": 6.9, "epss_score": 0.0039, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.32954, "used_in_malware": "unknown", "vulnerability_id": "CVE-2016-20080", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2016-20080", "url": "https://www.cve.org/CVERecord?id=CVE-2016-20080"}, {"id": "previdian", "url": "https://previdian.com/CVE-2016-20080"}]}, {"uuid": "7745d5d7-2d4a-4fe5-b165-f069b289ff62", "vulnerability": {"vulnId": "CVE-2026-26980", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7745d5d7-2d4a-4fe5-b165-f069b289ff62"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T22:32:51+00:00"}, "timestamps": {"asserted_at": "2026-09-21T22:32:51+00:00", "recorded_at": "2026-09-22T23:00:01+00:00", "first_seen_at": "2026-09-21T22:32:51+00:00"}, "scope": {"notes": "Ghost has a SQL Injection in its Content API | Affected: TryGhost / Ghost | CVSS: 9.4 (CRITICAL) | EPSS: 0.70208 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Ghost has a SQL Injection in its Content API", "cve_id": "CVE-2026-26980", "vendor": "TryGhost", "ghsa_id": null, "product": "Ghost", "added_date": "2026-09-21T22:32:51.000Z", "cvss_score": 9.4, "epss_score": 0.70208, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.99368, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-26980", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-26980", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26980"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-26980"}]}, {"uuid": "8c9a57f0-6012-4178-909d-f5c8e33c4d16", "vulnerability": {"vulnId": "CVE-2026-32996", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8c9a57f0-6012-4178-909d-f5c8e33c4d16"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T20:34:30+00:00"}, "timestamps": {"asserted_at": "2026-09-21T20:34:30+00:00", "recorded_at": "2026-09-22T21:00:02+00:00", "first_seen_at": "2026-09-21T20:34:30+00:00"}, "scope": {"notes": "This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | Affected: Veeam / Backup and Replication | CVSS: 7.3 (HIGH) | EPSS: 0.00154 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.", "cve_id": "CVE-2026-32996", "vendor": "Veeam", "ghsa_id": null, "product": "Backup and Replication", "added_date": "2026-09-21T20:34:30.610Z", "cvss_score": 7.3, "epss_score": 0.00154, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.04886, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-32996", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-32996", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32996"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-32996"}]}, {"uuid": "27fccf97-3da8-4838-bee7-2af2c68d94dc", "vulnerability": {"vulnId": "CVE-2024-52270", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "27fccf97-3da8-4838-bee7-2af2c68d94dc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T18:01:14+00:00"}, "timestamps": {"asserted_at": "2026-09-21T18:01:14+00:00", "recorded_at": "2026-09-22T19:00:01+00:00", "first_seen_at": "2026-09-21T18:01:14+00:00"}, "scope": {"notes": "PDF Document Spoofing in DropBox Sign(HelloSign) | Affected: DropBox(HelloSign) / DropBox Sign | CVSS: 8.2 (HIGH) | EPSS: 0.00193 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "PDF Document Spoofing in DropBox Sign(HelloSign)", "cve_id": "CVE-2024-52270", "vendor": "DropBox(HelloSign)", "ghsa_id": null, "product": "DropBox Sign", "added_date": "2026-09-21T18:01:14.657Z", "cvss_score": 8.2, "epss_score": 0.00193, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.09239, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-52270", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-52270", "url": "https://www.cve.org/CVERecord?id=CVE-2024-52270"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-52270"}]}, {"uuid": "4d622737-cf24-43c3-a122-d3be1a7b99ad", "vulnerability": {"vulnId": "CVE-2026-7273", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "4d622737-cf24-43c3-a122-d3be1a7b99ad"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T13:20:00+00:00"}, "timestamps": {"asserted_at": "2026-09-21T13:20:00+00:00", "recorded_at": "2026-09-22T14:00:02+00:00", "first_seen_at": "2026-09-21T13:20:00+00:00"}, "scope": {"notes": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through\u00a02.90(ABTQ.1)C0 could allow a... | Affected: Zyxel / GS1900-48HPv2 firmware, GS1900-8 firmware, GS1900-8HP firmware, GS1900-10HP firmware, GS1900-16 firmware, GS1900-24 firmware, GS1900-24E firmware, GS1900-24EP firmware, GS1900-24HPv2 firmware, GS1900-48 firmware | CVSS: 8.8 (HIGH) | EPSS: 0.00315 | Used in malware: unknown | Listed 6 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through\u00a02.90(ABTQ.1)C0 could allow a...", "cve_id": "CVE-2026-7273", "vendor": "Zyxel", "ghsa_id": "GHSA-RRV4-8JQ5-8J78", "product": "GS1900-48HPv2 firmware, GS1900-8 firmware, GS1900-8HP firmware, GS1900-10HP firmware, GS1900-16 firmware, GS1900-24 firmware, GS1900-24E firmware, GS1900-24EP firmware, GS1900-24HPv2 firmware, GS1900-48 firmware", "added_date": "2026-09-21T13:20:00.000Z", "cvss_score": 8.8, "epss_score": 0.00315, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.24603, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-7273", "ahead_of_cisa_kev": {"unit": "hour", "count": 6}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-7273", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7273"}, {"id": "GHSA-RRV4-8JQ5-8J78", "url": "https://github.com/advisories/GHSA-RRV4-8JQ5-8J78"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-7273"}]}, {"uuid": "1506b02f-740a-4c0e-99f7-23a89054d52e", "vulnerability": {"vulnId": "CVE-2026-27960", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "1506b02f-740a-4c0e-99f7-23a89054d52e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T08:06:49+00:00"}, "timestamps": {"asserted_at": "2026-09-21T08:06:49+00:00", "recorded_at": "2026-09-22T09:00:02+00:00", "first_seen_at": "2026-09-21T08:06:49+00:00"}, "scope": {"notes": "OpenCTI privilege escalation and unauthenticated access via default admin account | Affected: OpenCTI-Platform / opencti | CVSS: 9.8 (CRITICAL) | EPSS: 0.01995 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "OpenCTI privilege escalation and unauthenticated access via default admin account", "cve_id": "CVE-2026-27960", "vendor": "OpenCTI-Platform", "ghsa_id": null, "product": "opencti", "added_date": "2026-09-21T08:06:49.239Z", "cvss_score": 9.8, "epss_score": 0.01995, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.79575, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-27960", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-27960", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27960"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-27960"}]}, {"uuid": "d45473f6-1133-48fe-b010-9259889aa352", "vulnerability": {"vulnId": "CVE-2018-13980", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d45473f6-1133-48fe-b010-9259889aa352"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-21T00:00:00+00:00", "recorded_at": "2026-09-22T11:00:01+00:00", "first_seen_at": "2026-09-21T00:00:00+00:00"}, "scope": {"notes": "The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin... | Affected: Zeta-producer / Zeta Producer | CVSS: 5.5 (MEDIUM) | EPSS: 0.06902 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin...", "cve_id": "CVE-2018-13980", "vendor": "Zeta-producer", "ghsa_id": null, "product": "Zeta Producer", "added_date": "2026-09-21T00:00:00.000Z", "cvss_score": 5.5, "epss_score": 0.06902, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.93862, "used_in_malware": "unknown", "vulnerability_id": "CVE-2018-13980", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2018-13980", "url": "https://www.cve.org/CVERecord?id=CVE-2018-13980"}, {"id": "previdian", "url": "https://previdian.com/CVE-2018-13980"}]}, {"uuid": "ccb01387-6a5e-49bf-990a-75e468fa7d04", "vulnerability": {"vulnId": "CVE-2021-30134", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ccb01387-6a5e-49bf-990a-75e468fa7d04"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-21T00:00:00+00:00", "recorded_at": "2026-09-22T11:00:01+00:00", "first_seen_at": "2026-09-21T00:00:00+00:00"}, "scope": {"notes": "php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to... | Affected: Php_curl_class_project, Ht_slider_range_for_amazon_affiliates_project, Qiwi, Teamleade, Ptwooplugins, Shopello_api_project / PHP Curl Class, HT Slider Range FOR Amazon Affiliates, Woo-qiwi-payment-gateway, Teamleader CRM Forms, Invoicing With Invoicexpress FOR Woocommerce, Shopello API | CVSS: 6.1 (MEDIUM) | EPSS: 0.01261 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to...", "cve_id": "CVE-2021-30134", "vendor": "Php_curl_class_project, Ht_slider_range_for_amazon_affiliates_project, Qiwi, Teamleade, Ptwooplugins, Shopello_api_project", "ghsa_id": null, "product": "PHP Curl Class, HT Slider Range FOR Amazon Affiliates, Woo-qiwi-payment-gateway, Teamleader CRM Forms, Invoicing With Invoicexpress FOR Woocommerce, Shopello API", "added_date": "2026-09-21T00:00:00.000Z", "cvss_score": 6.1, "epss_score": 0.01261, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.67847, "used_in_malware": "unknown", "vulnerability_id": "CVE-2021-30134", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-30134", "url": "https://www.cve.org/CVERecord?id=CVE-2021-30134"}, {"id": "previdian", "url": "https://previdian.com/CVE-2021-30134"}]}, {"uuid": "391fdcf9-4312-4905-b982-e1a9557917d1", "vulnerability": {"vulnId": "CVE-2026-88062", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "391fdcf9-4312-4905-b982-e1a9557917d1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-21T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-21T00:00:00+00:00", "recorded_at": "2026-09-22T11:00:01+00:00", "first_seen_at": "2026-09-21T00:00:00+00:00"}, "scope": {"notes": "OmniRoute ACP Custom-Agent Remote Code Execution (RCE) | Affected: Diegosouzapw / OmniRoute | CVSS: 9.5 (CRITICAL) | EPSS: 0.00943 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "OmniRoute ACP Custom-Agent Remote Code Execution (RCE)", "cve_id": "CVE-2026-88062", "vendor": "Diegosouzapw", "ghsa_id": null, "product": "OmniRoute", "added_date": "2026-09-21T00:00:00.000Z", "cvss_score": 9.5, "epss_score": 0.00943, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.58962, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-88062", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-88062", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88062"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-88062"}]}, {"uuid": "fbe0bf49-cd97-455c-89f8-8cc99b2ea6b7", "vulnerability": {"vulnId": "CVE-2026-32882", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "fbe0bf49-cd97-455c-89f8-8cc99b2ea6b7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T20:28:00+00:00"}, "timestamps": {"asserted_at": "2026-09-18T20:28:00+00:00", "recorded_at": "2026-09-19T21:00:01+00:00", "first_seen_at": "2026-09-18T20:28:00+00:00"}, "scope": {"notes": "libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride | Affected: Strukturag / libheif | CVSS: 7.1 (HIGH) | EPSS: 0.00335 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride", "cve_id": "CVE-2026-32882", "vendor": "Strukturag", "ghsa_id": null, "product": "libheif", "added_date": "2026-09-18T20:28:00.000Z", "cvss_score": 7.1, "epss_score": 0.00335, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.26929, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-32882", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-32882", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32882"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-32882"}]}, {"uuid": "658a8fd7-a69e-4a17-86ca-a5f73c20f5d3", "vulnerability": {"vulnId": "CVE-2017-20284", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "658a8fd7-a69e-4a17-86ca-a5f73c20f5d3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T19:20:49+00:00"}, "timestamps": {"asserted_at": "2026-09-18T19:20:49+00:00", "recorded_at": "2026-09-19T20:00:01+00:00", "first_seen_at": "2026-09-18T19:20:49+00:00"}, "scope": {"notes": "Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet | Affected: Caucho Technology / Resin | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet", "cve_id": "CVE-2017-20284", "vendor": "Caucho Technology", "ghsa_id": "GHSA-X46G-Q89H-7XG3", "product": "Resin", "added_date": "2026-09-18T19:20:49.638Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2017-20284", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2017-20284", "url": "https://www.cve.org/CVERecord?id=CVE-2017-20284"}, {"id": "GHSA-X46G-Q89H-7XG3", "url": "https://github.com/advisories/GHSA-X46G-Q89H-7XG3"}, {"id": "previdian", "url": "https://previdian.com/CVE-2017-20284"}]}, {"uuid": "21f76e95-2fa4-464b-b0be-ef2fc48d5693", "vulnerability": {"vulnId": "CVE-2025-39682", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "21f76e95-2fa4-464b-b0be-ef2fc48d5693"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T19:20:38+00:00"}, "timestamps": {"asserted_at": "2026-09-18T19:20:38+00:00", "recorded_at": "2026-09-19T20:00:01+00:00", "first_seen_at": "2026-09-18T19:20:38+00:00"}, "scope": {"notes": "tls: fix handling of zero-length records on the rx_list | Affected: Linux / Linux | CVSS: 9.8 (CRITICAL) | EPSS: 0.00505 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "tls: fix handling of zero-length records on the rx_list", "cve_id": "CVE-2025-39682", "vendor": "Linux", "ghsa_id": "GHSA-V2PF-75PF-9C5H", "product": "Linux", "added_date": "2026-09-18T19:20:38.811Z", "cvss_score": 9.8, "epss_score": 0.00505, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.42129, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-39682", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2025-39682", "url": "https://www.cve.org/CVERecord?id=CVE-2025-39682"}, {"id": "GHSA-V2PF-75PF-9C5H", "url": "https://github.com/advisories/GHSA-V2PF-75PF-9C5H"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-39682"}]}, {"uuid": "f3db3454-5e05-426b-9952-73c9165409df", "vulnerability": {"vulnId": "CVE-2021-48008", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f3db3454-5e05-426b-9952-73c9165409df"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T19:10:54+00:00"}, "timestamps": {"asserted_at": "2026-09-18T19:10:54+00:00", "recorded_at": "2026-09-19T20:00:01+00:00", "first_seen_at": "2026-09-18T19:10:54+00:00"}, "scope": {"notes": "Chanjet CRM SQL Injection via get_usedspace.php | Affected: Chanjet Information Technology / CRM | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Chanjet CRM SQL Injection via get_usedspace.php", "cve_id": "CVE-2021-48008", "vendor": "Chanjet Information Technology", "ghsa_id": "GHSA-X5GC-R7QF-2H87", "product": "CRM", "added_date": "2026-09-18T19:10:54.694Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2021-48008", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-48008", "url": "https://www.cve.org/CVERecord?id=CVE-2021-48008"}, {"id": "GHSA-X5GC-R7QF-2H87", "url": "https://github.com/advisories/GHSA-X5GC-R7QF-2H87"}, {"id": "previdian", "url": "https://previdian.com/CVE-2021-48008"}]}, {"uuid": "d0935fc7-bfd2-4f49-b799-3f280968242c", "vulnerability": {"vulnId": "CVE-2023-54399", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d0935fc7-bfd2-4f49-b799-3f280968242c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T19:10:54+00:00"}, "timestamps": {"asserted_at": "2026-09-18T19:10:54+00:00", "recorded_at": "2026-09-19T20:00:01+00:00", "first_seen_at": "2026-09-18T19:10:54+00:00"}, "scope": {"notes": "Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree | Affected: Hongjing / e-HR | CVSS: 9.3 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree", "cve_id": "CVE-2023-54399", "vendor": "Hongjing", "ghsa_id": "GHSA-6J7F-83XH-J3X3", "product": "e-HR", "added_date": "2026-09-18T19:10:54.907Z", "cvss_score": 9.3, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-54399", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-54399", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54399"}, {"id": "GHSA-6J7F-83XH-J3X3", "url": "https://github.com/advisories/GHSA-6J7F-83XH-J3X3"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-54399"}]}, {"uuid": "67435dfc-7eda-4399-96d1-5714f7249ed0", "vulnerability": {"vulnId": "CVE-2019-25776", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "67435dfc-7eda-4399-96d1-5714f7249ed0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T19:10:53+00:00"}, "timestamps": {"asserted_at": "2026-09-18T19:10:53+00:00", "recorded_at": "2026-09-19T20:00:01+00:00", "first_seen_at": "2026-09-18T19:10:53+00:00"}, "scope": {"notes": "Weaver E-cology SQL Injection via SyncUserInfo.jsp | Affected: Weaver Network / E-cology | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Weaver E-cology SQL Injection via SyncUserInfo.jsp", "cve_id": "CVE-2019-25776", "vendor": "Weaver Network", "ghsa_id": "GHSA-XWCR-FG7M-3JXV", "product": "E-cology", "added_date": "2026-09-18T19:10:53.862Z", "cvss_score": 8.7, "epss_score": null, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2019-25776", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2019-25776", "url": "https://www.cve.org/CVERecord?id=CVE-2019-25776"}, {"id": "GHSA-XWCR-FG7M-3JXV", "url": "https://github.com/advisories/GHSA-XWCR-FG7M-3JXV"}, {"id": "previdian", "url": "https://previdian.com/CVE-2019-25776"}]}, {"uuid": "0cacc1cf-7d26-4edc-b7b2-9e6b38395142", "vulnerability": {"vulnId": "CVE-2026-53266", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "0cacc1cf-7d26-4edc-b7b2-9e6b38395142"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T14:30:43+00:00"}, "timestamps": {"asserted_at": "2026-09-18T14:30:43+00:00", "recorded_at": "2026-09-19T15:00:01+00:00", "first_seen_at": "2026-09-18T14:30:43+00:00"}, "scope": {"notes": "netfilter: bridge: make ebt_snat ARP rewrite writable | Affected: Linux / Linux | CVSS: 8.8 (HIGH) | EPSS: 0.00121 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "netfilter: bridge: make ebt_snat ARP rewrite writable", "cve_id": "CVE-2026-53266", "vendor": "Linux", "ghsa_id": "GHSA-XMHG-RR34-2CHJ", "product": "Linux", "added_date": "2026-09-18T14:30:43.435Z", "cvss_score": 8.8, "epss_score": 0.00121, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.02189, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-53266", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-53266", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53266"}, {"id": "GHSA-XMHG-RR34-2CHJ", "url": "https://github.com/advisories/GHSA-XMHG-RR34-2CHJ"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-53266"}]}, {"uuid": "d09a224d-3ea2-4298-afea-8d04b038d5c5", "vulnerability": {"vulnId": "CVE-2025-39964", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d09a224d-3ea2-4298-afea-8d04b038d5c5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T14:30:42+00:00"}, "timestamps": {"asserted_at": "2026-09-18T14:30:42+00:00", "recorded_at": "2026-09-19T15:00:01+00:00", "first_seen_at": "2026-09-18T14:30:42+00:00"}, "scope": {"notes": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | Affected: Linux / Linux | CVSS: 7.8 (HIGH) | EPSS: 0.00323 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg", "cve_id": "CVE-2025-39964", "vendor": "Linux", "ghsa_id": "GHSA-WR5G-MFHW-RPFJ", "product": "Linux", "added_date": "2026-09-18T14:30:42.702Z", "cvss_score": 7.8, "epss_score": 0.00323, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.25599, "used_in_malware": "unknown", "vulnerability_id": "CVE-2025-39964", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2025-39964", "url": "https://www.cve.org/CVERecord?id=CVE-2025-39964"}, {"id": "GHSA-WR5G-MFHW-RPFJ", "url": "https://github.com/advisories/GHSA-WR5G-MFHW-RPFJ"}, {"id": "previdian", "url": "https://previdian.com/CVE-2025-39964"}]}, {"uuid": "d61bd3c3-3eea-43eb-9154-8efd8afa35d5", "vulnerability": {"vulnId": "CVE-2026-0769", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "d61bd3c3-3eea-43eb-9154-8efd8afa35d5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T07:40:05+00:00"}, "timestamps": {"asserted_at": "2026-09-18T07:40:05+00:00", "recorded_at": "2026-09-19T08:00:01+00:00", "first_seen_at": "2026-09-18T07:40:05+00:00"}, "scope": {"notes": "Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability | Affected: Langflow / Langflow | CVSS: 9.8 (CRITICAL) | EPSS: 0.38639 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability", "cve_id": "CVE-2026-0769", "vendor": "Langflow", "ghsa_id": null, "product": "Langflow", "added_date": "2026-09-18T07:40:05.027Z", "cvss_score": 9.8, "epss_score": 0.38639, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.9851, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-0769", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-0769", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0769"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-0769"}]}, {"uuid": "c02771e9-d70b-4c34-bcba-04562a8fb702", "vulnerability": {"vulnId": "CVE-2026-42796", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c02771e9-d70b-4c34-bcba-04562a8fb702"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-18T00:00:00+00:00", "recorded_at": "2026-09-19T11:00:01+00:00", "first_seen_at": "2026-09-18T00:00:00+00:00"}, "scope": {"notes": "Arelle < 2.39.10 Unauthenticated RCE via /rest/configure | Affected: Arelle / Arelle | CVSS: 9.2 (CRITICAL) | EPSS: 0.02747 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Arelle < 2.39.10 Unauthenticated RCE via /rest/configure", "cve_id": "CVE-2026-42796", "vendor": "Arelle", "ghsa_id": null, "product": "Arelle", "added_date": "2026-09-18T00:00:00.000Z", "cvss_score": 9.2, "epss_score": 0.02747, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.85518, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-42796", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-42796", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42796"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-42796"}]}, {"uuid": "bfc74770-ba37-4a5a-84f0-982b26208464", "vulnerability": {"vulnId": "CVE-2024-53900", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "bfc74770-ba37-4a5a-84f0-982b26208464"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-18T00:00:00+00:00", "recorded_at": "2026-09-19T11:00:01+00:00", "first_seen_at": "2026-09-18T00:00:00+00:00"}, "scope": {"notes": "Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. | Affected: Mongoosejs / Mongoose | CVSS: 9.1 (CRITICAL) | EPSS: 0.03904 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.", "cve_id": "CVE-2024-53900", "vendor": "Mongoosejs", "ghsa_id": null, "product": "Mongoose", "added_date": "2026-09-18T00:00:00.000Z", "cvss_score": 9.1, "epss_score": 0.03904, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.89796, "used_in_malware": "unknown", "vulnerability_id": "CVE-2024-53900", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-53900", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53900"}, {"id": "previdian", "url": "https://previdian.com/CVE-2024-53900"}]}, {"uuid": "bcb878f1-5687-488e-881a-c3cc73c003ff", "vulnerability": {"vulnId": "CVE-2023-46359", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "bcb878f1-5687-488e-881a-c3cc73c003ff"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-18T00:00:00+00:00", "recorded_at": "2026-09-19T11:00:01+00:00", "first_seen_at": "2026-09-18T00:00:00+00:00"}, "scope": {"notes": "An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to... | Affected: Hardy-barth / cph2 Echarge Firmware | CVSS: 9.8 (CRITICAL) | EPSS: 0.87608 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to...", "cve_id": "CVE-2023-46359", "vendor": "Hardy-barth", "ghsa_id": null, "product": "cph2 Echarge Firmware", "added_date": "2026-09-18T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.87608, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.99751, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-46359", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-46359", "url": "https://www.cve.org/CVERecord?id=CVE-2023-46359"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-46359"}]}, {"uuid": "a4c5e9c9-dd7c-499f-a844-d65e4142ca56", "vulnerability": {"vulnId": "CVE-2023-29827", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "a4c5e9c9-dd7c-499f-a844-d65e4142ca56"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-18T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-18T00:00:00+00:00", "recorded_at": "2026-09-19T11:00:01+00:00", "first_seen_at": "2026-09-18T00:00:00+00:00"}, "scope": {"notes": "ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the... | Affected: Ejs / EJS | CVSS: 9.8 (CRITICAL) | EPSS: 0.05552 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the...", "cve_id": "CVE-2023-29827", "vendor": "Ejs", "ghsa_id": null, "product": "EJS", "added_date": "2026-09-18T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.05552, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.92477, "used_in_malware": "unknown", "vulnerability_id": "CVE-2023-29827", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-29827", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29827"}, {"id": "previdian", "url": "https://previdian.com/CVE-2023-29827"}]}, {"uuid": "f1c2c522-1718-4d56-bcfc-c106ad948556", "vulnerability": {"vulnId": "CVE-2026-89013", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "f1c2c522-1718-4d56-bcfc-c106ad948556"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-17T16:42:08+00:00"}, "timestamps": {"asserted_at": "2026-09-17T16:42:08+00:00", "recorded_at": "2026-09-18T17:00:01+00:00", "first_seen_at": "2026-09-17T16:42:08+00:00"}, "scope": {"notes": "Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php | Affected: Dolibarr / Dolibarr | CVSS: 8.7 (HIGH) | EPSS: 0.00373 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php", "cve_id": "CVE-2026-89013", "vendor": "Dolibarr", "ghsa_id": "GHSA-FM6P-42MR-X6JM", "product": "Dolibarr", "added_date": "2026-09-17T16:42:08.068Z", "cvss_score": 8.7, "epss_score": 0.00373, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.30996, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-89013", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-89013", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89013"}, {"id": "GHSA-FM6P-42MR-X6JM", "url": "https://github.com/advisories/GHSA-FM6P-42MR-X6JM"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-89013"}]}, {"uuid": "58eb925f-807c-4a80-aebc-629f77cefdae", "vulnerability": {"vulnId": "CVE-2026-86538", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "58eb925f-807c-4a80-aebc-629f77cefdae"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-17T16:27:22+00:00"}, "timestamps": {"asserted_at": "2026-09-17T16:27:22+00:00", "recorded_at": "2026-09-18T17:00:01+00:00", "first_seen_at": "2026-09-17T16:27:22+00:00"}, "scope": {"notes": "knowns before 0.30.0 Path Traversal via templateFile parameter | Affected: Knowns-dev / knowns | CVSS: 8.7 (HIGH) | EPSS: 0.00736 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "knowns before 0.30.0 Path Traversal via templateFile parameter", "cve_id": "CVE-2026-86538", "vendor": "Knowns-dev", "ghsa_id": null, "product": "knowns", "added_date": "2026-09-17T16:27:22.620Z", "cvss_score": 8.7, "epss_score": 0.00736, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.52732, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-86538", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-86538", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86538"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-86538"}]}, {"uuid": "064ef2a1-8c2d-45c2-a72d-5eef83495155", "vulnerability": {"vulnId": "CVE-2022-25497", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "064ef2a1-8c2d-45c2-a72d-5eef83495155"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-17T10:28:20+00:00"}, "timestamps": {"asserted_at": "2026-09-17T10:28:20+00:00", "recorded_at": "2026-09-18T11:00:01+00:00", "first_seen_at": "2026-09-17T10:28:20+00:00"}, "scope": {"notes": "CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function. | Affected: Cuppa CMS / Cuppacms | CVSS: 5.3 (MEDIUM) | EPSS: 0.03642 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.", "cve_id": "CVE-2022-25497", "vendor": "Cuppa CMS", "ghsa_id": null, "product": "Cuppacms", "added_date": "2026-09-17T10:28:20.728Z", "cvss_score": 5.3, "epss_score": 0.03642, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.88999, "used_in_malware": "unknown", "vulnerability_id": "CVE-2022-25497", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-25497", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25497"}, {"id": "previdian", "url": "https://previdian.com/CVE-2022-25497"}]}, {"uuid": "ea57ab35-500c-4ae9-b1cf-963192a75db4", "vulnerability": {"vulnId": "CVE-2022-45362", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "ea57ab35-500c-4ae9-b1cf-963192a75db4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-17T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-17T00:00:00+00:00", "recorded_at": "2026-09-18T11:00:01+00:00", "first_seen_at": "2026-09-17T00:00:00+00:00"}, "scope": {"notes": "WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF) | Affected: Paytm / Paytm Payment Gateway | CVSS: 7.2 (HIGH) | EPSS: 0.41762 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)", "cve_id": "CVE-2022-45362", "vendor": "Paytm", "ghsa_id": null, "product": "Paytm Payment Gateway", "added_date": "2026-09-17T00:00:00.000Z", "cvss_score": 7.2, "epss_score": 0.41762, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.98612, "used_in_malware": "unknown", "vulnerability_id": "CVE-2022-45362", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-45362", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45362"}, {"id": "previdian", "url": "https://previdian.com/CVE-2022-45362"}]}, {"uuid": "e5d8ada1-1a4a-4775-bf91-0b4b6a2616f2", "vulnerability": {"vulnId": "CVE-2026-32255", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "e5d8ada1-1a4a-4775-bf91-0b4b6a2616f2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-17T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-17T00:00:00+00:00", "recorded_at": "2026-09-18T11:00:01+00:00", "first_seen_at": "2026-09-17T00:00:00+00:00"}, "scope": {"notes": "Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint | Affected: Kanbn / kan | CVSS: 8.6 (HIGH) | EPSS: 0.20776 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint", "cve_id": "CVE-2026-32255", "vendor": "Kanbn", "ghsa_id": null, "product": "kan", "added_date": "2026-09-17T00:00:00.000Z", "cvss_score": 8.6, "epss_score": 0.20776, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.97416, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-32255", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-32255", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32255"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-32255"}]}, {"uuid": "c23e0aba-3eb3-4a2a-b1f8-043fcba885ef", "vulnerability": {"vulnId": "CVE-2021-24946", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c23e0aba-3eb3-4a2a-b1f8-043fcba885ef"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-17T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-17T00:00:00+00:00", "recorded_at": "2026-09-18T11:00:01+00:00", "first_seen_at": "2026-09-17T00:00:00+00:00"}, "scope": {"notes": "Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection | Affected: Webnus / Modern Events Calendar Lite | CVSS: 9.8 (CRITICAL) | EPSS: 0.728 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection", "cve_id": "CVE-2021-24946", "vendor": "Webnus", "ghsa_id": null, "product": "Modern Events Calendar Lite", "added_date": "2026-09-17T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.728, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.9942, "used_in_malware": "unknown", "vulnerability_id": "CVE-2021-24946", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-24946", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24946"}, {"id": "previdian", "url": "https://previdian.com/CVE-2021-24946"}]}, {"uuid": "8b655a8e-7b99-4bc4-bf28-08a82a1ca46f", "vulnerability": {"vulnId": "CVE-2016-15043", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "8b655a8e-7b99-4bc4-bf28-08a82a1ca46f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-17T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-17T00:00:00+00:00", "recorded_at": "2026-09-18T11:00:01+00:00", "first_seen_at": "2026-09-17T00:00:00+00:00"}, "scope": {"notes": "WP Mobile Detector <= 3.5 - Arbitrary File Upload | Affected: Websitez.com / WP Mobile Detector | CVSS: 9.8 (CRITICAL) | EPSS: 0.07761 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WP Mobile Detector <= 3.5 - Arbitrary File Upload", "cve_id": "CVE-2016-15043", "vendor": "Websitez.com", "ghsa_id": null, "product": "WP Mobile Detector", "added_date": "2026-09-17T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.07761, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.9433, "used_in_malware": "unknown", "vulnerability_id": "CVE-2016-15043", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2016-15043", "url": "https://www.cve.org/CVERecord?id=CVE-2016-15043"}, {"id": "previdian", "url": "https://previdian.com/CVE-2016-15043"}]}, {"uuid": "7baecb9e-3ec2-47d5-9022-efe61134ef85", "vulnerability": {"vulnId": "CVE-2026-40242", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "7baecb9e-3ec2-47d5-9022-efe61134ef85"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-17T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-09-17T00:00:00+00:00", "recorded_at": "2026-09-18T11:00:01+00:00", "first_seen_at": "2026-09-17T00:00:00+00:00"}, "scope": {"notes": "Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint | Affected: Getarcaneapp / arcane | CVSS: 7.2 (HIGH) | EPSS: 0.00621 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint", "cve_id": "CVE-2026-40242", "vendor": "Getarcaneapp", "ghsa_id": null, "product": "arcane", "added_date": "2026-09-17T00:00:00.000Z", "cvss_score": 7.2, "epss_score": 0.00621, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.48118, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-40242", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-40242", "url": "https://www.cve.org/CVERecord?id=CVE-2026-40242"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-40242"}]}, {"uuid": "c29a0fdb-b5e5-4846-99c4-095d969ae2a1", "vulnerability": {"vulnId": "CVE-2026-76460", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "c29a0fdb-b5e5-4846-99c4-095d969ae2a1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-16T19:21:00+00:00"}, "timestamps": {"asserted_at": "2026-09-16T19:21:00+00:00", "recorded_at": "2026-09-17T20:00:02+00:00", "first_seen_at": "2026-09-16T19:21:00+00:00"}, "scope": {"notes": "Cisco Identity Services Engine Authentication Bypass Vulnerability | Affected: Cisco / Cisco Identity Services Engine Software, Cisco ISE Passive Identity Connector | CVSS: 10.0 (CRITICAL) | Used in malware: unknown | Listed 1 hour ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Cisco Identity Services Engine Authentication Bypass Vulnerability", "cve_id": "CVE-2026-76460", "vendor": "Cisco", "ghsa_id": "GHSA-25WC-3W28-Q6VW", "product": "Cisco Identity Services Engine Software, Cisco ISE Passive Identity Connector", "added_date": "2026-09-16T19:21:00.000Z", "cvss_score": 10.0, "epss_score": null, "previous_ids": [], "cvss_severity": "CRITICAL", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": null, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-76460", "ahead_of_cisa_kev": {"unit": "hour", "count": 1}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-76460", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76460"}, {"id": "GHSA-25WC-3W28-Q6VW", "url": "https://github.com/advisories/GHSA-25WC-3W28-Q6VW"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-76460"}]}, {"uuid": "981aac5c-5075-4d2d-b365-6ed8b27d86d0", "vulnerability": {"vulnId": "CVE-2026-54196", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "981aac5c-5075-4d2d-b365-6ed8b27d86d0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-16T11:50:30+00:00"}, "timestamps": {"asserted_at": "2026-09-16T11:50:30+00:00", "recorded_at": "2026-09-17T12:00:02+00:00", "first_seen_at": "2026-09-16T11:50:30+00:00"}, "scope": {"notes": "WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability | Affected: Jetmonsters / JetFormBuilder | CVSS: 6.8 (MEDIUM) | EPSS: 0.00236 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability", "cve_id": "CVE-2026-54196", "vendor": "Jetmonsters", "ghsa_id": "GHSA-C56P-W54Q-P2C5", "product": "JetFormBuilder", "added_date": "2026-09-16T11:50:30.268Z", "cvss_score": 6.8, "epss_score": 0.00236, "previous_ids": [], "cvss_severity": "MEDIUM", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.14784, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-54196", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-54196", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54196"}, {"id": "GHSA-C56P-W54Q-P2C5", "url": "https://github.com/advisories/GHSA-C56P-W54Q-P2C5"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-54196"}]}, {"uuid": "205d0b98-2c28-42a6-8044-942eb89ba636", "vulnerability": {"vulnId": "CVE-2026-58704", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "gna": 1, "object_uuid": "205d0b98-2c28-42a6-8044-942eb89ba636"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-16T08:15:00+00:00"}, "timestamps": {"asserted_at": "2026-09-16T08:15:00+00:00", "recorded_at": "2026-09-17T09:00:02+00:00", "first_seen_at": "2026-09-16T08:15:00+00:00"}, "scope": {"notes": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation... | Affected: Google / Android | CVSS: 8.8 (HIGH) | EPSS: 0.00112 | Used in malware: unknown | Listed 6 hours ahead of CISA KEV | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation...", "cve_id": "CVE-2026-58704", "vendor": "Google", "ghsa_id": "GHSA-CHQ2-JXGV-5VFW", "product": "Android", "added_date": "2026-09-16T08:15:00.000Z", "cvss_score": 8.8, "epss_score": 0.00112, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.01564, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-58704", "ahead_of_cisa_kev": {"unit": "hour", "count": 6}, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-58704", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58704"}, {"id": "GHSA-CHQ2-JXGV-5VFW", "url": "https://github.com/advisories/GHSA-CHQ2-JXGV-5VFW"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-58704"}]}]}