| CVE-2026-77463Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment umputun remark42 Versions & vendor guidance → |
Not in downloaded KEV |
6.5Medium |
| CVE-2026-76893tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients tsparticles tsparticles, @tsparticles mcp-server Versions & vendor guidance → |
Not in downloaded KEV |
6.9Medium |
| CVE-2026-76519Cisco Secure Email Gateway Arbitrary File Write Vulnerability Cisco Cisco Secure Email Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-76418Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Cisco Secure Firewall Threat Defense (FTD) Software Versions & vendor guidance → |
Known exploitedCISA KEV |
8.6High |
| CVE-2026-75598Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization GradleUp shadow Versions & vendor guidance → |
Not in downloaded KEV |
6.3Medium |
| CVE-2026-73697Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV |
8.7High |
| CVE-2026-73696Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV |
8.6High |
| CVE-2026-73695Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV |
8.7High |
| CVE-2026-7273Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Zyxel GS1900-48HPv2 firmware, Zyxel GS1900-8 firmware, Zyxel GS1900-8HP firmware, Zyxel GS1900-10HP firmware, Zyxel GS1900-16 firmware, Zyxel GS1900-24 firmware, Zyxel GS1900-24E firmware, Zyxel GS1900-24EP firmware, Zyxel GS1900-24HPv2 firmware, Zyxel GS1900-48 firmware Versions & vendor guidance → |
Known exploitedCISA KEV |
8.8High |
| CVE-2026-72718goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor aaif-goose goose Versions & vendor guidance → |
Not in downloaded KEV |
7High |
| CVE-2026-71963Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection NousResearch hermes-agent Versions & vendor guidance → |
Not in downloaded KEV |
8.6High |
| CVE-2026-70003JDBC Driver for SQL Server Security Feature Bypass Vulnerability Microsoft Microsoft JDBC Driver for SQL Server 13.4 Versions & vendor guidance → |
Not in downloaded KEV |
8.7High |
| CVE-2026-65339CVE-2026-65339 Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS Versions & vendor guidance → |
Not in downloaded KEV |
5Medium |
| CVE-2026-63288CVE-2026-63288 Axis Communications AB AXIS A1210 - Secure Entry, Axis Communications AB AXIS A1601 - Secure Entry, Axis Communications AB AXIS A1610 - Secure Entry, Axis Communications AB AXIS A1710, Axis Communications AB AXIS A1810 - Secure Entry Versions & vendor guidance → |
Not in downloaded KEV |
8.3High |
| CVE-2026-63183OmniAuth: Host Header Injection Vulnerability omniauth omniauth Versions & vendor guidance → |
Not in downloaded KEV |
6.9Medium |
| CVE-2026-63077JetBrains TeamCity Deserialization of Untrusted Data Vulnerability JetBrains TeamCity Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-62848Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution metalama Metalama Versions & vendor guidance → |
Not in downloaded KEV |
7.3High |
| CVE-2026-62662Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences pocket-id pocket-id Versions & vendor guidance → |
Not in downloaded KEV |
7.7High |
| CVE-2026-62374SD JWT JS: Tampered disclosures silently dropped instead of rejected openwallet-foundation @sd-jwt/core, openwallet-foundation @sd-jwt/decode Versions & vendor guidance → |
Not in downloaded KEV |
7.1High |
| CVE-2026-62361listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials knadh listmonk Versions & vendor guidance → |
Not in downloaded KEV |
5.5Medium |
| CVE-2026-62331praktor: Telegram upload traversal permits persistent agent instruction injection mtzanidakis praktor Versions & vendor guidance → |
Not in downloaded KEV |
8.2High |
| CVE-2026-62300Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources filecoin-project filecoin-pin Versions & vendor guidance → |
Not in downloaded KEV |
6.5Medium |
| CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy osac-project osac-operator Versions & vendor guidance → |
Not in downloaded KEV |
8.6High |
| CVE-2026-61536Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE masci banks Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |
| CVE-2026-59886pyasn1: Uncontrolled resource consumption when converting decoded REAL values pyasn1 pyasn1 Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |