Vulnerabilities
Fixes & KEVSeverity
NovDecJanFebMarAprMayJunJulAugSepOct
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
CyStack continuously tracks the latest global threats and develops solutions that help identify new vulnerabilities across your websites and systems.
Data is updated in the system
Data is updated in the CyStack VulnScan system.Learn more
| Vulnerability | Exploitation status | Fix | Provider | Affected product | Published | Severity |
|---|---|---|---|---|---|---|
CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | Exploitation statusPublic exploit | FixYes | ProviderCitrix NetScaler | Affected productADC | Published09/27/2026 | SeverityCritical |
CVE-2026-85706Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | Exploitation statusKEV | FixYes | ProviderGitLab | Affected productGitLab | Published09/12/2026 | SeverityCritical |
CVE-2026-87902 | Exploitation statusNot known exploited | FixYes | ProviderWordPress | Affected productWordPress | Published09/22/2026 | SeverityHigh |
CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Exploitation statusKEV | FixYes | ProviderCitrix NetScaler | Affected productADC | Published09/27/2026 | SeverityCritical |
CVE-2026-94127BIG-IP APM OAuth vulnerability | Exploitation statusKEV | FixYes | ProviderF5 | Affected productBIG-IP | Published09/22/2026 | SeverityCritical |
CVE-2026-86950 | Exploitation statusNot known exploited | FixYes | ProviderApple | Affected productiOS and iPadOS | Published09/28/2026 | SeverityHigh |
CVE-2026-104286 | Exploitation statusPublic exploit | FixYes | ProviderFortinet | Affected productFortiMail | Published10/01/2026 | SeverityCritical |
CVE-2026-76460Cisco Identity Services Engine Authentication Bypass Vulnerability | Exploitation statusNot confirmed | FixNot confirmed | ProviderCisco | Affected productCisco Identity Services Engine Software | Published09/16/2026 | SeverityCritical |
CVE-2026-76461Cisco Secure Email Gateway SQL Injection Vulnerability | Exploitation statusKEV | FixNot confirmed | ProviderCisco | Affected productCisco Secure Email | Published09/14/2026 | SeverityCritical |
CVE-2026-75650Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Exploitation statusKEV | FixYes | ProviderAdobe | Affected productAdobe Commerce | Published09/07/2026 | SeverityCritical |
CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability | Exploitation statusKEV | FixNot confirmed | ProviderCisco | Affected productCisco Secure Firewall Management Center (FMC) | Published03/04/2026 | SeverityCritical |
CVE-2026-88779Memory overflow vulnerability leading to Denial of Service | Exploitation statusKEV | FixYes | ProviderNetScaler | Affected productADC | Published10/04/2026 | SeverityHigh |
CVE-2026-76504Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability | Exploitation statusKEV | FixNot confirmed | ProviderCisco | Affected productCisco Catalyst SD-WAN Manager | Published09/30/2026 | SeverityCritical |
CVE-2026-86218Pre-authentication remote code execution in N-able N-central | Exploitation statusKEV | FixYes | ProviderN-able | Affected productN-central | Published09/06/2026 | SeverityCritical |
CVE-2026-85102Improper Certificate Validation in Quantum Security Gateway | Exploitation statusKEV | FixNot confirmed | Providercheckpoint | Affected productQuantum Security Gateway | Published09/09/2026 | SeverityCritical |
CVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login Flow | Exploitation statusKEV | FixYes | ProviderWebpros | Affected productcPanel | Published04/29/2026 | SeverityCritical |
CVE-2026-85046 | Exploitation statusKEV | FixYes | ProviderGoogle | Affected productChrome | Published09/03/2026 | SeverityHigh |
CVE-2026-43499rtmutex: Use waiter::task instead of current in remove_waiter() | Exploitation statusPublic exploit | FixYes | ProviderLinux | Affected productLinux | Published05/21/2026 | SeverityHigh |
CVE-2026-93616Directory Traversal and File upload allows execution of arbitrary script on the Management Server | Exploitation statusKEV | FixNot confirmed | Providercheckpoint | Affected productQuantum Security Management | Published09/22/2026 | SeverityCritical |
CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productWindows 10 Version 1607 | Published09/08/2026 | SeverityHigh |
CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints | Exploitation statusKEV | FixYes | ProviderApache Software Foundation | Affected productApache Log4j2 | Published12/10/2021 | SeverityCritical |
CVE-2026-65660Microsoft SharePoint Server Remote Code Execution Vulnerability | Exploitation statusPublic exploit | FixYes | ProviderMicrosoft | Affected productMicrosoft SharePoint Enterprise Server 2016 | Published08/11/2026 | SeverityHigh |
CVE-2026-87491 | Exploitation statusKEV | FixYes | ProviderGoogle | Affected productChrome | Published09/09/2026 | SeverityHigh |
CVE-2026-58704 | Exploitation statusNot known exploited | FixNot confirmed | ProviderGoogle | Affected productAndroid | Published09/15/2026 | SeverityHigh |
CVE-2026-35273 | Exploitation statusKEV | FixNot confirmed | ProviderOracle Corporation | Affected productPeopleSoft Enterprise PeopleTools | Published06/11/2026 | SeverityCritical |
CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | Exploitation statusKEV | FixYes | ProviderMikroTik | Affected productRouterOS | Published09/05/2026 | SeverityCritical |
CVE-2026-19490NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 | Exploitation statusKEV | FixYes | ProviderNetScaler | Affected productADC | Published08/19/2026 | SeverityCritical |
CVE-2026-3055Insufficient input validation leading to memory overread | Exploitation statusKEV | FixYes | ProviderNetScaler | Affected productADC | Published03/23/2026 | SeverityCritical |
CVE-2026-48842 | Exploitation statusNot known exploited | FixYes | ProviderRoundcube | Affected productWebmail | Published05/25/2026 | SeverityHigh |
CVE-2026-67276SSH user impersonation possible in Mikrotik RouterOS | Exploitation statusPublic exploit | FixYes | ProviderMikroTik | Affected productRouterOS | Published09/05/2026 | SeverityCritical |
CVE-2026-81963Local privilege escalation through link following in Microsoft Windows Update Stack | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productWindows 11 Version 23H2 | Published09/08/2026 | SeverityHigh |
CVE-2026-73570 | Exploitation statusKEV | FixYes | ProviderZimbra | Affected productCollaboration | Published08/13/2026 | SeverityHigh |
CVE-2026-40639 | Exploitation statusNot known exploited | FixYes | ProviderDell | Affected productDell Edge Gateway 3000 | Published06/09/2026 | SeverityMedium |
CVE-2026-28576SQL Injection in Android Contacts Provider Can Expose the Contacts Database | Exploitation statusNot known exploited | FixNot confirmed | ProviderAndroid | Affected productAndroid | Published06/17/2026 | SeverityCritical |
CVE-2026-85103Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding | Exploitation statusNot known exploited | FixNot confirmed | Providercheckpoint | Affected productQuantum Security Gateway | Published09/09/2026 | SeverityCritical |
CVE-2026-5430Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | Exploitation statusKEV | FixYes | ProviderWSO2 | Affected productWSO2 API Control Plane | Published08/06/2026 | SeverityCritical |
CVE-2026-93952Security Advisory 0183 | Exploitation statusKEV | FixYes | ProviderArista Networks | Affected productVeloCloud Orchestrator (VCO) On-Prem | Published09/22/2026 | SeverityCritical |
CVE-2026-61500Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key | Exploitation statusNot known exploited | FixYes | Providerrejetto | Affected producthfs | Published07/13/2026 | SeverityCritical |
CVE-2026-51990 | Exploitation statusNot known exploited | FixYes | ProviderNot confirmed | Affected productNot confirmed | Published09/16/2026 | SeverityCritical |
CVE-2026-90970Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway | Exploitation statusNot known exploited | FixYes | ProviderGitLab | Affected productGitLab AI Gateway | Published10/02/2026 | SeverityCritical |
CVE-2025-25249 | Exploitation statusKEV | FixYes | ProviderFortinet | Affected productFortiOS | Published01/13/2026 | SeverityHigh |
CVE-2026-96940Microsoft Exchange Server Elevation of Privilege Vulnerability | Exploitation statusNot known exploited | FixYes | ProviderMicrosoft | Affected productMicrosoft Exchange Server 2016 Cumulative Update 23 | Published10/02/2026 | SeverityHigh |
CVE-2025-55182 | Exploitation statusKEV | FixYes | ProviderMeta | Affected productreact-server-dom-parcel | Published12/03/2025 | SeverityCritical |
CVE-2026-67279SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | Exploitation statusKEV | FixYes | ProviderMikroTik | Affected productRouterOS | Published09/05/2026 | SeverityMedium |
CVE-2026-72898Metabase SQL injection via password reset endpoint | Exploitation statusKEV | FixYes | ProviderMetabase | Affected productMetabase | Published08/10/2026 | SeverityCritical |
CVE-2026-44756Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing | Exploitation statusNot known exploited | FixNot confirmed | ProviderSAP_SE | Affected productSAP Extended Passport (EPP) Processing | Published09/08/2026 | SeverityCritical |
CVE-2026-7273 | Exploitation statusKEV | FixNot confirmed | Providerzyxel | Affected productGS1900-10HP firmware | Published06/16/2026 | SeverityHigh |
CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactory | Exploitation statusKEV | FixYes | Providerjfrog | Affected productartifactory | Published08/28/2026 | SeverityCritical |
CVE-2026-84869ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | Exploitation statusKEV | FixYes | ProviderConnectWise | Affected productScreenConnect | Published09/08/2026 | SeverityCritical |
CVE-2026-53266netfilter: bridge: make ebt_snat ARP rewrite writable | Exploitation statusKEV | FixYes | ProviderLinux | Affected productLinux | Published06/25/2026 | SeverityHigh |
CVE-2015-2051 | Exploitation statusKEV | FixNot confirmed | Providerdlink | Affected productdir-645_firmware | Published02/23/2015 | SeverityHigh |
CVE-2026-2699EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC) | Exploitation statusPublic exploit | FixYes | ProviderProgress | Affected productShareFile Storage Zones Controller | Published04/02/2026 | SeverityCritical |
CVE-2025-39964crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | Exploitation statusKEV | FixYes | ProviderLinux | Affected productLinux | Published10/13/2025 | SeverityHigh |
CVE-2026-91843Stack overflow in login process to the Security Management and Log Servers | Exploitation statusNot known exploited | FixNot confirmed | Providercheckpoint | Affected productQuantum Security Management | Published09/16/2026 | SeverityCritical |
CVE-2024-12847NETGEAR DGN setup.cgi OS Command Injection | Exploitation statusPublic exploit | FixYes | ProviderNETGEAR | Affected productDGN1000 | Published01/10/2025 | SeverityCritical |
CVE-2026-2652Authentication Bypass in mlflow/mlflow | Exploitation statusPublic exploit | FixYes | ProviderMLflow | Affected productmlflow/mlflow | Published05/15/2026 | SeverityHigh |
CVE-2026-81578PaperCut MF/NG: Authentication Bypass | Exploitation statusKEV | FixYes | ProviderPaperCut | Affected productPaperCut MF/NG | Published08/28/2026 | SeverityHigh |
CVE-2026-87886 | Exploitation statusNot confirmed | FixYes | ProviderAcronis | Affected productAcronis Backup extension for Plesk | Published09/17/2026 | SeverityHigh |
CVE-2026-86296D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | ProviderD-Link | Affected productDIR-822A | Published09/07/2026 | SeverityCritical |
CVE-2026-82078PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector | Exploitation statusKEV | FixYes | ProviderPaperCut | Affected productPaperCut MF/NG | Published08/28/2026 | SeverityCritical |
CVE-2026-8037OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF | Exploitation statusKEV | FixYes | ProviderProgress Software | Affected productECS Connections Manager | Published06/04/2026 | SeverityCritical |
CVE-2026-69414Microsoft Defender Elevation of Privilege Vulnerability | Exploitation statusPublic exploit | FixYes | ProviderMicrosoft | Affected productMicrosoft Malware Protection Engine | Published08/14/2026 | SeverityHigh |
CVE-2026-39987marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass | Exploitation statusKEV | FixYes | Providermarimo-team | Affected productmarimo | Published04/09/2026 | SeverityCritical |
CVE-2025-39682tls: fix handling of zero-length records on the rx_list | Exploitation statusPublic exploit | FixYes | ProviderLinux | Affected productLinux | Published09/05/2025 | SeverityCritical |
CVE-2026-102489Undisclosed RCE in Zammad v6.3 and higher | Exploitation statusKEV | FixYes | ProviderZammad GmbH | Affected productZammad | Published09/30/2026 | SeverityCritical |
CVE-2026-67401 | Exploitation statusNot known exploited | FixYes | ProviderWebpros | Affected productcPanel | Published09/09/2026 | SeverityCritical |
CVE-2021-40444Microsoft MSHTML Remote Code Execution Vulnerability | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productWindows 10 Version 1507 | Published09/15/2021 | SeverityHigh |
CVE-2025-43529 | Exploitation statusKEV | FixYes | ProviderApple | Affected productiOS and iPadOS | Published12/17/2025 | SeverityHigh |
CVE-2026-42018Anonymous user token generation exposure in JFrog Artifactory | Exploitation statusKEV | FixYes | Providerjfrog | Affected productartifactory | Published08/12/2026 | SeverityHigh |
CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productMicrosoft Exchange Server 2013 Cumulative Update 21 | Published03/02/2021 | SeverityCritical |
CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | Exploitation statusKEV | FixYes | ProviderWordPress | Affected productWordPress | Published07/17/2026 | SeverityCritical |
CVE-2026-20253Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise | Exploitation statusKEV | FixYes | ProviderSplunk | Affected productSplunk Enterprise | Published06/10/2026 | SeverityCritical |
CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread | Exploitation statusKEV | FixYes | ProviderNetScaler | Affected productADC | Published06/17/2025 | SeverityCritical |
CVE-2026-42016Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation | Exploitation statusKEV | FixYes | Providerjfrog | Affected productartifactory | Published07/27/2026 | SeverityHigh |
CVE-2025-34036Shenzhen TVT CCTV-DVR Command Injection | Exploitation statusPublic exploit | FixNot confirmed | ProviderShenzhen TVT | Affected productCCTV-DVR | Published06/24/2025 | SeverityCritical |
CVE-2018-10562 | Exploitation statusKEV | FixNot confirmed | Providerdasannetworks | Affected productgpon_router_firmware | Published05/04/2018 | SeverityCritical |
CVE-2026-58138Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators | Exploitation statusNot known exploited | FixYes | Providerconductor-oss | Affected productconductor | Published06/30/2026 | SeverityCritical |
CVE-2026-83548 | Exploitation statusKEV | FixNot confirmed | ProviderSonicWall | Affected productSMA1000 | Published09/01/2026 | SeverityCritical |
CVE-2026-20316Cisco Secure Firewall Management Center Software Static Credential Vulnerability | Exploitation statusKEV | FixNot confirmed | ProviderCisco | Affected productCisco Secure Firewall Management Center (FMC) | Published07/29/2026 | SeverityMedium |
CVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile Access | Exploitation statusKEV | FixYes | Providercheckpoint | Affected productQuantum Security Gateway | Published06/08/2026 | SeverityCritical |
CVE-2026-89026Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate | Exploitation statusNot known exploited | FixYes | ProviderIssabel Foundation | Affected productIssabel Framework | Published09/15/2026 | SeverityCritical |
CVE-2018-7600 | Exploitation statusKEV | FixYes | ProviderDrupal | Affected productDrupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 | Published03/29/2018 | SeverityCritical |
CVE-2026-78006The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution | Exploitation statusNot known exploited | FixYes | Providerstellarwp | Affected productThe Events Calendar | Published09/12/2026 | SeverityCritical |
CVE-2026-102490Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha | Exploitation statusKEV | FixYes | ProviderZammad GmbH | Affected productZammad | Published09/30/2026 | SeverityCritical |
CVE-2026-86206Access control filter bypass allows unauthorised access to APIs | Exploitation statusNot known exploited | FixYes | ProviderN-able | Affected productN-central | Published09/05/2026 | SeverityMedium |
CVE-2025-47827 | Exploitation statusKEV | FixNot confirmed | Providerigel | Affected productigel_os | Published06/05/2025 | SeverityMedium |
CVE-2026-94545Satori-generated SVG has improper escaping | Exploitation statusNot known exploited | FixNot confirmed | Providervercel | Affected productnext | Published09/30/2026 | SeverityMedium |
CVE-2026-67277Unauthenticated bandwidth-test memory disclosure and kernel restart in MikroTik RouterOS | Exploitation statusKEV | FixYes | ProviderMikroTik | Affected productRouterOS | Published09/05/2026 | SeverityHigh |
CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | Exploitation statusKEV | FixYes | ProviderWordPress | Affected productWordPress | Published07/17/2026 | SeverityCritical |
CVE-2019-2215 | Exploitation statusKEV | FixYes | ProviderGoogle | Affected productAndroid | Published10/11/2019 | SeverityHigh |
CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code | Exploitation statusKEV | FixYes | Providerlangflow-ai | Affected productlangflow | Published04/07/2025 | SeverityCritical |
CVE-2023-20198 | Exploitation statusKEV | FixNot confirmed | ProviderCisco | Affected productCisco IOS XE Software | Published10/16/2023 | SeverityCritical |
CVE-2017-18368 | Exploitation statusKEV | FixNot confirmed | Providerbillion | Affected product5200w-t_firmware | Published05/02/2019 | SeverityCritical |
CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) | Exploitation statusKEV | FixNot confirmed | ProviderApache Software Foundation | Affected productApache HTTP Server | Published10/07/2021 | SeverityCritical |
CVE-2026-86207Authentication bypass leads to unauthorised access to N-central | Exploitation statusNot known exploited | FixYes | ProviderN-able | Affected productN-central | Published09/05/2026 | SeverityHigh |
CVE-2011-3600 | Exploitation statusNot confirmed | FixYes | ProviderOFBiz | Affected productOFBiz | Published11/26/2019 | SeverityHigh |
CVE-2026-63077 | Exploitation statusKEV | FixYes | ProviderJetBrains | Affected productTeamCity | Published07/27/2026 | SeverityCritical |
CVE-2026-84411MikroTik RouterOS Integer Underflow | Exploitation statusNot known exploited | FixYes | ProviderMikroTik | Affected productRouterOS | Published10/02/2026 | SeverityCritical |
CVE-2026-88778TCP Initial Sequence Number (ISN) prediction | Exploitation statusNot known exploited | FixYes | ProviderCitrix NetScaler | Affected productADC | Published09/27/2026 | SeverityHigh |
CVE-2026-31431crypto: algif_aead - Revert to operating out-of-place | Exploitation statusKEV | FixYes | ProviderLinux | Affected productLinux | Published04/22/2026 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
Review CyStack's security rating and practical recommendations for websites and edge assets.
Explore cybersecurity research from our team of security specialists.
Browse practical cybersecurity knowledge across CyStack's articles and guides.
%20On-Prem.svg){kind=icon}
%20Processing.svg){kind=icon}
