Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,052 alerts · page 52 of 53

  1. CISA KEV addition Published · updated

    CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

    CriticalCVSS 9.3 EPSS 79.5% CISA KEV added 2026-10-16 · due 2026-10-19 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: BeyondTrust Remote Support

    The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

  2. New public exploit Published · updated

    CVE-2026-109413 Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

    HighCVSS 8.7 EPSS 0.40% PoC

    Exploit status: Proof-of-concept only

    Affects: symfony/symfony, symfony/yaml, debian/symfony and 1 more

    In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with...

  3. New public exploit Published · updated

    CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

    HighCVSS 8.7 EPSS 0.48% PoC

    Exploit status: Proof-of-concept only

    Affects: symfony/http-foundation, symfony/symfony, debian/symfony and 1 more

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) l...

  4. CISA KEV addition Published · updated

    CVE-2026-110936 A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allo...

    HighCVSS 8.4 EPSS 0.97% CISA KEV added 2026-10-20 · due 2026-11-03 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Siemens Software Center, Siemens software center

    A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a director...

  5. CISA KEV addition Published · updated

    CVE-2026-106931 SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected....

    HighCVSS 8.5 EPSS 2.5% CISA KEV added 2026-10-20 · due 2026-10-23 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx, EG Secure Solutions Inc. SiteGuard Server Edition for IIS and 3 more

    SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

  6. CISA KEV addition Published · updated

    CVE-2026-110447 Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerabil...

    CriticalCVSS 9.2 EPSS 73.3% CISA KEV added 2026-10-23 · due 2026-10-26 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Collabora Online - Built-in CODE Server

    Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the C...

  7. CISA KEV addition Published · updated

    CVE-2026-97229 Integer Overflow or Wraparound in GitLab

    CriticalCVSS 10.0 EPSS 69.3% CISA KEV added 2026-10-29 · due 2026-11-01 Exploited in the wild Framework module PoC

    Exploit status: Exploited in the wild (confirmed)

    Affects: debian/ruby3.1, debian/ruby3.3, azure linux ruby and 16 more

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially craf...

  8. CISA KEV addition Published · updated

    CVE-2026-21589 This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. T...

    CriticalCVSS 9.3 EPSS 99.7% CISA KEV added 2026-10-15 · due 2026-10-18 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: atlassian Confluence Data Center, atlassian Bamboo Data Center, atlassian Crowd Data Center and 13 more

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to ac...

  9. CISA KEV addition Published · updated

    CVE-2026-96656 Plex Media Server arbitrary file write

    HighCVSS 8.6 EPSS 1.8% CISA KEV added 2026-10-20 · due 2026-10-23 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Plex Media Server

    Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit...

  10. CISA KEV addition Published · updated

    CVE-2026-96655 Plex Media Server arbitrary-host SSRF

    MediumCVSS 5.3 EPSS 10.7% CISA KEV added 2026-10-20 · due 2026-11-03 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Plex Media Server

    Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

  11. CISA KEV addition Published · updated

    CVE-2026-96654 Plex Media Server URL injection

    MediumCVSS 6.9 EPSS 1.9% CISA KEV added 2026-10-20 · due 2026-10-23 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Plex Media Server

    Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

  12. CISA KEV addition Published · updated

    CVE-2026-96652 Plex Media Server SSRF

    MediumCVSS 5.3 EPSS 11.9% CISA KEV added 2026-10-20 · due 2026-11-03 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Plex Media Server

    Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

  13. CISA KEV addition Published · updated

    CVE-2026-20320 A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. Thi...

    HighCVSS 7.5 EPSS 0.82% CISA KEV added 2026-11-10 · due 2026-11-24 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Cisco BroadWorks, cisco broadworks application server, cisco broadworks application delivery platform and 2 more

    A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external...

  14. CISA KEV addition Published · updated

    CVE-2026-41709 ESX insufficient logging vulnerability

    LowCVSS 2.7 EPSS 0.69% CISA KEV added 2026-10-28 · due 2026-11-11 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: VMware Cloud Foundation, VMware vSphere Foundation, VMware ESX and 2 more

    VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

  15. CISA KEV addition Published · updated

    CVE-2026-48356 Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

    CriticalCVSS 9.3 EPSS 47.5% CISA KEV added 2026-10-27 · due 2026-11-10 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Adobe Commerce, Adobe Commerce B2B, Adobe Magento Open Source and 5 more

    Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of th...

  16. New public exploit Published · updated

    CVE-2026-59726 Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

    CriticalCVSS 10.0 EPSS 6.2% Public exploit

    Exploit status: Public exploit available

    Affects: ruvnet ruflo

    Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to termin...

  17. CISA KEV addition Published · updated

    CVE-2026-46300 net: skbuff: preserve shared-frag marker during coalescing

    HighCVSS 7.8 EPSS 16.1% CISA KEV added 2026-10-28 · due 2026-10-31 Exploited in the wild Framework module Public exploit

    Exploit status: Exploited in the wild (confirmed)

    Affects: debian/linux, azure linux kernel, Linux kernel and 24 more

    In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-ow...

  18. CISA KEV addition Published · updated

    CVE-2025-61624 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions,...

    MediumCVSS 6.5 EPSS 1.4% CISA KEV added 2026-10-16 · due 2026-10-19 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: fortinet fortios, fortinet fortiproxy, Siemens RUGGEDCOM APE1808 and 3 more

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1....

  19. CISA KEV addition Published · updated

    CVE-2024-27834 The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with a...

    MediumCVSS 5.5 EPSS 1.5% CISA KEV added 2026-11-04 · due 2026-11-18 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: debian/webkit2gtk, debian/wpewebkit, ubuntu/qtwebkit-opensource-src and 12 more

    The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

  20. New public exploit Published · updated

    CVE-2024-3094 Xz: malicious code in distributed source

    CriticalCVSS 10.0 EPSS 90.9% PoC

    Exploit status: Proof-of-concept only

    Affects: debian/xz-utils, redhat rhel els, redhat enterprise linux and 4 more

    Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify spec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).