https://patchbulletin.com/ CVEs added to CISA's Known Exploited Vulnerabilities catalog, with severity, EPSS and fixed versions. en Thu, 29 Oct 2026 00:00:00 GMT https://patchbulletin.com/cve/CVE-2026-97229/ kev-added:CVE-2026-97229 Thu, 29 Oct 2026 00:00:00 GMT GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability. CVSS 10.0. EPSS 18.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-11-01. https://patchbulletin.com/cve/CVE-2026-76418/ kev-added:CVE-2026-76418 Thu, 29 Oct 2026 00:00:00 GMT Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability. CVSS 8.6. EPSS 0.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-11-01. https://patchbulletin.com/cve/CVE-2026-46300/ kev-added:CVE-2026-46300 Wed, 28 Oct 2026 00:00:00 GMT Linux Kernel Missing Initialization of a Variable Vulnerability. CVSS 7.8. EPSS 15.7%. Ransomware use: Unknown. Fixed in: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1, 0:6.12.0-211.8.el10nv, 0:6.12.0-231.12.el10nv, 0:6.12.0-211.16.1.el10_2, 0:6.12.0-55.75.1.el10_0, 0:4.18.0-553.125.1.rt7.466.el8_10, 0:4.18.0-553.125.1.el8_10, 0:4.18.0-305.192.1.el8_4, 0:4.18.0-305.192.1.el8_4, 0:4.18.0-372.193.1.el8_6, 0:4.18.0-372.193.1.el8_6, 0:4.18.0-372.193.1.el8_6, 0:4.18.0-477.143.1.el8_8, 0:4.18.0-477.143.1.el8_8, 0:5.14.0-687.10.1.el9_8, 0:5.14.0-70.180.1.el9_0, 0:5.14.0-70.180.1.rt21.252.el9_0, 0:5.14.0-284.172.1.el9_2, 0:5.14.0-284.172.1.rt14.457.el9_2, 0:5.14.0-427.126.1.el9_4, 0:5.14.0-570.116.1.el9_6, 412.86.202605271418-0, 413.92.202605271328-0, 414.92.202606231112-0, 415.92.202606030318-0, 416.94.202605200242-0, 416.94.202606051757-0, 417.94.202606250942-0, 418.94.202605260517-0, 4.19.9.6.202606031700-0, 4.20.9.6.202605270908-0, 0:5.14.0-570.116.1.el9_6, 0:4.21.0-202605142021.p2.geab2218.assembly.stream.el10, 4.21.9.6.202606030721-0. CISA due date 2026-10-31. https://patchbulletin.com/cve/CVE-2026-41709/ kev-added:CVE-2026-41709 Wed, 28 Oct 2026 00:00:00 GMT Broadcom VMWare ESX Insufficient Logging Vulnerability. CVSS 2.7. EPSS 0.8%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-11-11. https://patchbulletin.com/cve/CVE-2026-48356/ kev-added:CVE-2026-48356 Tue, 27 Oct 2026 00:00:00 GMT Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability. CVSS 9.3. EPSS 44.6%. Ransomware use: Unknown. Fixed in: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul, 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul, 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 1.21.0. CISA due date 2026-11-10. https://patchbulletin.com/cve/CVE-2026-111497/ kev-added:CVE-2026-111497 Tue, 27 Oct 2026 00:00:00 GMT Google Brotli Unchecked Return Value Vulnerability. CVSS 9.8. EPSS 82.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-11-10. https://patchbulletin.com/cve/CVE-2026-109619/ kev-added:CVE-2026-109619 Mon, 26 Oct 2026 00:00:00 GMT PHP Stale Internal Request-State Vulnerability. CVSS 8.1. EPSS 100.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-29. https://patchbulletin.com/cve/CVE-2026-109618/ kev-added:CVE-2026-109618 Mon, 26 Oct 2026 00:00:00 GMT PHP Memory Corruption Vulnerability. CVSS 9.8. EPSS 100.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-29. https://patchbulletin.com/cve/CVE-2026-114625/ kev-added:CVE-2026-114625 Fri, 23 Oct 2026 00:00:00 GMT Arista VeloCloud Orchestrator SQL Injection Vulnerability. CVSS 9.9. EPSS 1.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-26. https://patchbulletin.com/cve/CVE-2026-110447/ kev-added:CVE-2026-110447 Fri, 23 Oct 2026 00:00:00 GMT Collabora Online – Built-in CODE Server OS Command Injection Vulnerability. CVSS 9.8. EPSS 73.3%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-26. https://patchbulletin.com/cve/CVE-2026-96656/ kev-added:CVE-2026-96656 Tue, 20 Oct 2026 00:00:00 GMT Plex Media Server External Control of File Name or Path Vulnerability. CVSS 7.2. EPSS 1.8%. Ransomware use: Unknown. Fixed in: 1.43.3.10861. CISA due date 2026-10-23. https://patchbulletin.com/cve/CVE-2026-96655/ kev-added:CVE-2026-96655 Tue, 20 Oct 2026 00:00:00 GMT Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. CVSS 4.3. EPSS 1.6%. Ransomware use: Unknown. Fixed in: 1.43.3.10861. CISA due date 2026-11-03. https://patchbulletin.com/cve/CVE-2026-96654/ kev-added:CVE-2026-96654 Tue, 20 Oct 2026 00:00:00 GMT Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability. CVSS 6.5. EPSS 1.9%. Ransomware use: Unknown. Fixed in: 1.43.3.10861. CISA due date 2026-10-23. https://patchbulletin.com/cve/CVE-2026-96652/ kev-added:CVE-2026-96652 Tue, 20 Oct 2026 00:00:00 GMT Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. CVSS 4.3. EPSS 1.8%. Ransomware use: Unknown. Fixed in: 1.43.3.10861. CISA due date 2026-11-03. https://patchbulletin.com/cve/CVE-2026-110936/ kev-added:CVE-2026-110936 Tue, 20 Oct 2026 00:00:00 GMT Siemens Software Center Uncontrolled Search Path Element Vulnerability. CVSS 6.7. EPSS 1.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-11-03. https://patchbulletin.com/cve/CVE-2026-106931/ kev-added:CVE-2026-106931 Tue, 20 Oct 2026 00:00:00 GMT EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability. CVSS 8.5. EPSS 2.5%. Ransomware use: Unknown. Fixed in: Ver3.10. CISA due date 2026-10-23. https://patchbulletin.com/cve/CVE-2026-102764/ kev-added:CVE-2026-102764 Fri, 16 Oct 2026 00:00:00 GMT BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability. CVSS 9.8. EPSS 18.9%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-19. https://patchbulletin.com/cve/CVE-2025-61624/ kev-added:CVE-2025-61624 Fri, 16 Oct 2026 00:00:00 GMT Fortinet Multiple Products Path Traversal Vulnerability. CVSS 6.5. EPSS 1.3%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-19. https://patchbulletin.com/cve/CVE-2026-21589/ kev-added:CVE-2026-21589 Thu, 15 Oct 2026 00:00:00 GMT Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability. CVSS 7.5. EPSS 99.5%. Ransomware use: Unknown. Fixed in: Patch version 10.2.24 and later, Patch version 12.1.12 and later, Patch version 10.2.8 and later, Patch version 10.5.1 and later, Patch version 9.4.26 and later, Patch version 10.2.19 and later, Patch version 9.2.26 and later, Patch version 7.2.4 and later, Patch version 7.1.7 and later, Patch version 7.0.3 and later, Patch version 6.3.7 and later, Patch version 4.9.15 and later, Patch version 4.9.15 and later, Patch version 11.3.12 and later, Patch version 10.3.26 and later, Patch version 5.12.40 and later, Patch version 11.3.12 and later, Patch version 10.3.26 and later, Patch version 9.12.40 and later. CISA due date 2026-10-18. https://patchbulletin.com/cve/CVE-2026-76519/ kev-added:CVE-2026-76519 Wed, 14 Oct 2026 00:00:00 GMT Cisco Secure Email Gateway Relative Path Traversal Vulnerability. CVSS 9.8. EPSS 2.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-17. https://patchbulletin.com/cve/CVE-2026-105134/ kev-added:CVE-2026-105134 Wed, 14 Oct 2026 00:00:00 GMT Ahsay AhsayCBS Command Injection Vulnerability. CVSS 10.0. EPSS 81.8%. Ransomware use: Unknown. Fixed in: 9.15.2.70, 10.3.4.45. CISA due date 2026-10-17. https://patchbulletin.com/cve/CVE-2026-105133/ kev-added:CVE-2026-105133 Wed, 14 Oct 2026 00:00:00 GMT Ahsay AhsayCBS Improper Authentication Vulnerability. CVSS 7.3. EPSS 79.5%. Ransomware use: Unknown. Fixed in: 9.15.2.70, 10.3.4.45. CISA due date 2026-10-17. https://patchbulletin.com/cve/CVE-2026-0322/ kev-added:CVE-2026-0322 Wed, 14 Oct 2026 00:00:00 GMT Palo Alto Networks PAN-OS Code Injection Vulnerability. CVSS 7.2. EPSS 1.7%. Ransomware use: Unknown. Fixed in: All, 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12, All. CISA due date 2026-10-17. https://patchbulletin.com/cve/CVE-2026-96951/ kev-added:CVE-2026-96951 Tue, 13 Oct 2026 00:00:00 GMT Microsoft Windows Command Injection Vulnerability. CVSS 8.8. EPSS 9.8%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-16. https://patchbulletin.com/cve/CVE-2026-104935/ kev-added:CVE-2026-104935 Tue, 13 Oct 2026 00:00:00 GMT Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. CVSS 8.6. EPSS 86.8%. Ransomware use: Unknown. Fixed in: 25.1.3.0, 25.1.3.1, 22.8R2.5, 22.7R2.14. CISA due date 2026-10-16. https://patchbulletin.com/cve/CVE-2023-22894/ kev-added:CVE-2023-22894 Thu, 08 Oct 2026 00:00:00 GMT Strapi Cleartext Storage of Sensitive Information Vulnerability. CVSS 4.9. EPSS 4.1%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-11. https://patchbulletin.com/cve/CVE-2021-3199/ kev-added:CVE-2021-3199 Thu, 08 Oct 2026 00:00:00 GMT ONLYOFFICE Docs Server Path Traversal Vulnerability. CVSS 9.8. EPSS 30.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-11. https://patchbulletin.com/cve/CVE-2016-3081/ kev-added:CVE-2016-3081 Thu, 08 Oct 2026 00:00:00 GMT Apache Struts Command Injection Vulnerability. CVSS 8.1. EPSS 96.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-11. https://patchbulletin.com/cve/CVE-2015-5477/ kev-added:CVE-2015-5477 Thu, 08 Oct 2026 00:00:00 GMT ISC BIND Data Processing Errors Vulnerability. CVSS 7.5. EPSS 99.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-11. https://patchbulletin.com/cve/CVE-2015-3306/ kev-added:CVE-2015-3306 Thu, 08 Oct 2026 00:00:00 GMT ProFTPD Improper Access Control Vulnerability. CVSS 10.0. EPSS 99.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-11. https://patchbulletin.com/cve/CVE-2026-88779/ kev-added:CVE-2026-88779 Sun, 04 Oct 2026 00:00:00 GMT Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability. CVSS 7.5. EPSS 11.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-07. https://patchbulletin.com/cve/CVE-2026-102490/ kev-added:CVE-2026-102490 Fri, 02 Oct 2026 00:00:00 GMT Zammad GmbH Zammad Improper Privilege Management Vulnerability. CVSS 7.8. EPSS 10.9%. Ransomware use: Unknown. Fixed in: 7.2.2. CISA due date 2026-10-05. https://patchbulletin.com/cve/CVE-2026-102489/ kev-added:CVE-2026-102489 Fri, 02 Oct 2026 00:00:00 GMT Zammad GmbH Zammad Session Fixation Vulnerability. CVSS 9.8. EPSS 22.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-05. https://patchbulletin.com/cve/CVE-2026-104286/ kev-added:CVE-2026-104286 Thu, 01 Oct 2026 00:00:00 GMT Fortinet FortiMail Path Traversal Vulnerability. CVSS 9.8. EPSS 4.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-04. https://patchbulletin.com/cve/CVE-2026-76504/ kev-added:CVE-2026-76504 Wed, 30 Sep 2026 00:00:00 GMT Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability. CVSS 9.8. EPSS 38.9%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-03. https://patchbulletin.com/cve/CVE-2026-86950/ kev-added:CVE-2026-86950 Tue, 29 Sep 2026 00:00:00 GMT Apple Multiple Products Out-of-Bounds Write Vulnerability. CVSS 8.8. EPSS 26.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-10-13. https://patchbulletin.com/cve/CVE-2026-88772/ kev-added:CVE-2026-88772 Sun, 27 Sep 2026 00:00:00 GMT Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability. CVSS 8.1. EPSS 78.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-30. https://patchbulletin.com/cve/CVE-2026-88771/ kev-added:CVE-2026-88771 Sun, 27 Sep 2026 00:00:00 GMT Citrix NetScaler Improper Input Validation Vulnerability. CVSS 9.8. EPSS 82.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-30. https://patchbulletin.com/cve/CVE-2026-87902/ kev-added:CVE-2026-87902 Fri, 25 Sep 2026 00:00:00 GMT WordPress Core Remote File Inclusion Vulnerability. CVSS 8.1. EPSS 95.8%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-28. https://patchbulletin.com/cve/CVE-2026-67279/ kev-added:CVE-2026-67279 Fri, 25 Sep 2026 00:00:00 GMT Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability. CVSS 6.5. EPSS 2.3%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-28. https://patchbulletin.com/cve/CVE-2026-65660/ kev-added:CVE-2026-65660 Fri, 25 Sep 2026 00:00:00 GMT Microsoft SharePoint Code Injection Vulnerability. CVSS 8.8. EPSS 8.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-28. https://patchbulletin.com/cve/CVE-2026-71362/ kev-added:CVE-2026-71362 Thu, 24 Sep 2026 00:00:00 GMT Adobe Commerce and Magento Incorrect Authorization Vulnerability . CVSS 9.1. EPSS 90.5%. Ransomware use: Unknown. Fixed in: 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug, 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug, 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug. CISA due date 2026-09-27. https://patchbulletin.com/cve/CVE-2026-5430/ kev-added:CVE-2026-5430 Thu, 24 Sep 2026 00:00:00 GMT WSO2 Multiple Products Path Traversal Vulnerability . CVSS 10.0. EPSS 22.4%. Ransomware use: Unknown. Fixed in: 9.33.106. CISA due date 2026-09-27. https://patchbulletin.com/cve/CVE-2026-94127/ kev-added:CVE-2026-94127 Tue, 22 Sep 2026 00:00:00 GMT F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability. CVSS 9.8. EPSS 24.9%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-25. https://patchbulletin.com/cve/CVE-2026-93952/ kev-added:CVE-2026-93952 Tue, 22 Sep 2026 00:00:00 GMT Arista VeloCloud Orchestrator Improper Input Validation Vulnerability. CVSS 10.0. EPSS 1.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-25. https://patchbulletin.com/cve/CVE-2026-93616/ kev-added:CVE-2026-93616 Tue, 22 Sep 2026 00:00:00 GMT Check Point Multiple Products Path Traversal Vulnerability. CVSS 9.8. EPSS 91.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-25. https://patchbulletin.com/cve/CVE-2026-85102/ kev-added:CVE-2026-85102 Tue, 22 Sep 2026 00:00:00 GMT Check Point Multiple Products Improper Certificate Validation Vulnerability. CVSS 9.8. EPSS 54.1%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-25. https://patchbulletin.com/cve/CVE-2026-7273/ kev-added:CVE-2026-7273 Mon, 21 Sep 2026 00:00:00 GMT Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability. CVSS 8.8. EPSS 2.8%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-24. https://patchbulletin.com/cve/CVE-2026-53266/ kev-added:CVE-2026-53266 Fri, 18 Sep 2026 00:00:00 GMT Linux Kernel Out-of-Bounds Write Vulnerability. CVSS 8.8. EPSS 0.9%. Ransomware use: Unknown. Fixed in: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, 7.1. CISA due date 2026-09-21. https://patchbulletin.com/cve/CVE-2025-39964/ kev-added:CVE-2025-39964 Fri, 18 Sep 2026 00:00:00 GMT Linux Kernel Race Condition Vulnerability. CVSS 5.5. EPSS 1.6%. Ransomware use: Unknown. Fixed in: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17. CISA due date 2026-09-21. https://patchbulletin.com/cve/CVE-2025-39682/ kev-added:CVE-2025-39682 Fri, 18 Sep 2026 00:00:00 GMT Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability. CVSS 9.8. EPSS 3.3%. Ransomware use: Unknown. Fixed in: 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17. CISA due date 2026-09-21. https://patchbulletin.com/cve/CVE-2026-87886/ kev-added:CVE-2026-87886 Wed, 16 Sep 2026 00:00:00 GMT Acronis Backup Incorrect Default Permissions Vulnerability. CVSS 7.8. EPSS 0.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-19. https://patchbulletin.com/cve/CVE-2026-76460/ kev-added:CVE-2026-76460 Wed, 16 Sep 2026 00:00:00 GMT Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability. CVSS 10.0. EPSS 75.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-19. https://patchbulletin.com/cve/CVE-2026-58704/ kev-added:CVE-2026-58704 Wed, 16 Sep 2026 00:00:00 GMT Google Pixel Improper Authorization Vulnerability. CVSS 8.8. EPSS 0.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-19. https://patchbulletin.com/cve/CVE-2026-76461/ kev-added:CVE-2026-76461 Mon, 14 Sep 2026 00:00:00 GMT Cisco Secure Email Gateway SQL Injection Vulnerability. CVSS 9.8. EPSS 29.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-17. https://patchbulletin.com/cve/CVE-2026-85706/ kev-added:CVE-2026-85706 Fri, 11 Sep 2026 00:00:00 GMT GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability. CVSS 10.0. EPSS 97.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-14. https://patchbulletin.com/cve/CVE-2026-84869/ kev-added:CVE-2026-84869 Fri, 11 Sep 2026 00:00:00 GMT ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability. CVSS 9.9. EPSS 0.9%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-14. https://patchbulletin.com/cve/CVE-2026-42018/ kev-added:CVE-2026-42018 Fri, 11 Sep 2026 00:00:00 GMT JFrog Artifactory Improper Authentication Vulnerability. CVSS 7.5. EPSS 9.8%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-25. https://patchbulletin.com/cve/CVE-2026-42016/ kev-added:CVE-2026-42016 Fri, 11 Sep 2026 00:00:00 GMT JFrog Artifactory Incorrect Authorization Vulnerability. CVSS 8.8. EPSS 8.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-25. https://patchbulletin.com/cve/CVE-2026-86060/ kev-added:CVE-2026-86060 Thu, 10 Sep 2026 00:00:00 GMT MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability. CVSS 9.8. EPSS 6.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-13. https://patchbulletin.com/cve/CVE-2026-67277/ kev-added:CVE-2026-67277 Thu, 10 Sep 2026 00:00:00 GMT MikroTik RouterOS Missing Authentication for Critical Function Vulnerability. CVSS 8.2. EPSS 1.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-13. https://patchbulletin.com/cve/CVE-2026-87491/ kev-added:CVE-2026-87491 Wed, 09 Sep 2026 00:00:00 GMT Google Chromium V8 Out of Bounds Write Vulnerability. CVSS 8.8. EPSS 3.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-23. https://patchbulletin.com/cve/CVE-2026-20079/ kev-added:CVE-2026-20079 Wed, 09 Sep 2026 00:00:00 GMT Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability. CVSS 10.0. EPSS 88.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-12. https://patchbulletin.com/cve/CVE-2026-19490/ kev-added:CVE-2026-19490 Wed, 09 Sep 2026 00:00:00 GMT Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability. CVSS 9.8. EPSS 32.7%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-12. https://patchbulletin.com/cve/CVE-2025-25249/ kev-added:CVE-2025-25249 Wed, 09 Sep 2026 00:00:00 GMT Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability. CVSS 9.8. EPSS 3.7%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-12. https://patchbulletin.com/cve/CVE-2026-86218/ kev-added:CVE-2026-86218 Tue, 08 Sep 2026 00:00:00 GMT N-able N-central Static Code Injection Vulnerability. CVSS 9.8. EPSS 15.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-11. https://patchbulletin.com/cve/CVE-2026-85880/ kev-added:CVE-2026-85880 Tue, 08 Sep 2026 00:00:00 GMT Microsoft Windows Heap-Based Buffer Overflow Vulnerability. CVSS 7.8. EPSS 0.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-22. https://patchbulletin.com/cve/CVE-2026-81963/ kev-added:CVE-2026-81963 Tue, 08 Sep 2026 00:00:00 GMT Microsoft Windows Link Following Vulnerability. CVSS 7.8. EPSS 0.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-22. https://patchbulletin.com/cve/CVE-2026-75650/ kev-added:CVE-2026-75650 Tue, 08 Sep 2026 00:00:00 GMT Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability. CVSS 10.0. EPSS 3.9%. Ransomware use: Unknown. Fixed in: Hotfix for CVE-2026-7565, Hotfix for CVE-2026-7565, Hotfix for CVE-2026-7565. CISA due date 2026-09-11. https://patchbulletin.com/cve/CVE-2026-85046/ kev-added:CVE-2026-85046 Fri, 04 Sep 2026 00:00:00 GMT Google Chromium V8 Type Confusion Vulnerability. CVSS 8.8. EPSS 1.8%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-18. https://patchbulletin.com/cve/CVE-2026-9586/ kev-added:CVE-2026-9586 Wed, 02 Sep 2026 00:00:00 GMT Sangoma Switchvox SQL Injection Vulnerability. CVSS 9.8. EPSS 19.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-05. https://patchbulletin.com/cve/CVE-2026-83549/ kev-added:CVE-2026-83549 Wed, 02 Sep 2026 00:00:00 GMT SonicWall SMA1000 Appliances OS Command Injection Vulnerability. CVSS 7.8. EPSS 9.9%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-05. https://patchbulletin.com/cve/CVE-2026-83548/ kev-added:CVE-2026-83548 Wed, 02 Sep 2026 00:00:00 GMT SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability. CVSS 10.0. EPSS 8.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-05. https://patchbulletin.com/cve/CVE-2026-82329/ kev-added:CVE-2026-82329 Wed, 02 Sep 2026 00:00:00 GMT JFrog Artifactory Improper Authentication Vulnerability. CVSS 9.8. EPSS 14.4%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-05. https://patchbulletin.com/cve/CVE-2026-59822/ kev-added:CVE-2026-59822 Wed, 02 Sep 2026 00:00:00 GMT BerriAI LiteLLM Improper Authentication Vulnerability. CVSS 8.2. EPSS 0.8%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-16. https://patchbulletin.com/cve/CVE-2026-49869/ kev-added:CVE-2026-49869 Wed, 02 Sep 2026 00:00:00 GMT Kestra OSS OS Command Injection Vulnerability. CVSS 10.0. EPSS 2.1%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-05. https://patchbulletin.com/cve/CVE-2026-48710/ kev-added:CVE-2026-48710 Wed, 02 Sep 2026 00:00:00 GMT Kludex Starlette HTTP Request/Response Smuggling Vulnerability. CVSS 6.5. EPSS 70.3%. Ransomware use: Unknown. Fixed in: 1782353093, 1782352847, 1780102732, 1780099185, 1784109883, 1782997656, 1782471672, 1782471731, 1782471732, 1782471849, 1782471734, 1782991170, 1782472374, 1782471796, 1782471661, 1782471753, 1782471740, 1782471834, 1782471730, 1782132126, 1782132686, 1782132403, 1782132444, 1782132767, 1782132493, 1782132379, 1782133907, 1782420349, 1782133865, 1782133337, 1782132473, 1782132660, 1782301637, 1782132564, 1782135300, 1786612415, 1787068065, 1784834402, 1780492008, 1780414237, 1784554123, 1780492012, 1782139619, 1780403026, 1788190224. CISA due date 2026-09-16. https://patchbulletin.com/cve/CVE-2026-82078/ kev-added:CVE-2026-82078 Mon, 31 Aug 2026 00:00:00 GMT PaperCut NG/MF Unsafe Reflection Vulnerability. CVSS 9.1. EPSS 60.9%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-14. https://patchbulletin.com/cve/CVE-2026-81578/ kev-added:CVE-2026-81578 Mon, 31 Aug 2026 00:00:00 GMT PaperCut NG/MF Missing Authentication for Critical Function Vulnerability. CVSS 9.8. EPSS 83.7%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-14. https://patchbulletin.com/cve/CVE-2026-66384/ kev-added:CVE-2026-66384 Thu, 27 Aug 2026 00:00:00 GMT JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability. CVSS 5.3. EPSS 0.7%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-10. https://patchbulletin.com/cve/CVE-2026-53362/ kev-added:CVE-2026-53362 Thu, 27 Aug 2026 00:00:00 GMT Linux Kernel Unspecified Vulnerability. CVSS 7.8. EPSS 0.7%. Ransomware use: Unknown. Fixed in: 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2. CISA due date 2026-08-30. https://patchbulletin.com/cve/CVE-2023-49105/ kev-added:CVE-2023-49105 Thu, 27 Aug 2026 00:00:00 GMT ownCloud Improper Authentication Vulnerability. CVSS 9.8. EPSS 43.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-30. https://patchbulletin.com/cve/CVE-2026-8452/ kev-added:CVE-2026-8452 Wed, 26 Aug 2026 00:00:00 GMT Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability. CVSS 9.8. EPSS 1.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-29. https://patchbulletin.com/cve/CVE-2022-0995/ kev-added:CVE-2022-0995 Wed, 26 Aug 2026 00:00:00 GMT Linux Kernel Out-of-Bounds Write Vulnerability. CVSS 7.8. EPSS 8.9%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-29. https://patchbulletin.com/cve/CVE-2021-23758/ kev-added:CVE-2021-23758 Wed, 26 Aug 2026 00:00:00 GMT Ajax.NET Professional Deserialization of Untrusted Data Vulnerability. CVSS 9.8. EPSS 82.6%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-09. https://patchbulletin.com/cve/CVE-2019-1068/ kev-added:CVE-2019-1068 Wed, 26 Aug 2026 00:00:00 GMT Microsoft SQL Server Remote Code Execution Vulnerability. CVSS 8.8. EPSS 57.3%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-29. https://patchbulletin.com/cve/CVE-2015-5287/ kev-added:CVE-2015-5287 Wed, 26 Aug 2026 00:00:00 GMT Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability. CVSS 7.8. EPSS 5.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-09. https://patchbulletin.com/cve/CVE-2015-3246/ kev-added:CVE-2015-3246 Wed, 26 Aug 2026 00:00:00 GMT Red Hat Libuser Race Condition Vulnerability. CVSS 7.4. EPSS 8.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-09. https://patchbulletin.com/cve/CVE-2026-60004/ kev-added:CVE-2026-60004 Tue, 25 Aug 2026 00:00:00 GMT Gitea Code Injection Vulnerability. CVSS 9.8. EPSS 24.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-28. https://patchbulletin.com/cve/CVE-2026-21962/ kev-added:CVE-2026-21962 Mon, 24 Aug 2026 00:00:00 GMT Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability. CVSS 10.0. EPSS 73.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-27. https://patchbulletin.com/cve/CVE-2026-73570/ kev-added:CVE-2026-73570 Fri, 21 Aug 2026 00:00:00 GMT Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability. CVSS 8.9. EPSS 71.7%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-24. https://patchbulletin.com/cve/CVE-2026-72530/ kev-added:CVE-2026-72530 Thu, 20 Aug 2026 00:00:00 GMT TrueConf Server Code Injection Vulnerability. CVSS 9.0. EPSS 1.7%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-03. https://patchbulletin.com/cve/CVE-2026-72529/ kev-added:CVE-2026-72529 Thu, 20 Aug 2026 00:00:00 GMT TrueConf Server Missing Authentication for Critical Function Vulnerability. CVSS 9.8. EPSS 1.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-23. https://patchbulletin.com/cve/CVE-2026-64849/ kev-added:CVE-2026-64849 Wed, 19 Aug 2026 00:00:00 GMT MLflow Server-Side Request Forgery Vulnerability. CVSS 9.3. EPSS 10.0%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-09-02. https://patchbulletin.com/cve/CVE-2026-65400/ kev-added:CVE-2026-65400 Tue, 18 Aug 2026 00:00:00 GMT Apple macOS Improper Authentication Vulnerability. CVSS 9.8. EPSS 1.7%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-21. https://patchbulletin.com/cve/CVE-2026-59310/ kev-added:CVE-2026-59310 Tue, 18 Aug 2026 00:00:00 GMT Broadcom VMware vCenter Path Traversal Vulnerability. CVSS 9.8. EPSS 2.6%. Ransomware use: Known. Fixed in: Unknown. CISA due date 2026-08-21. https://patchbulletin.com/cve/CVE-2026-55040/ kev-added:CVE-2026-55040 Tue, 18 Aug 2026 00:00:00 GMT Microsoft SharePoint Weak Authentication Vulnerability. CVSS 9.1. EPSS 69.5%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-21. https://patchbulletin.com/cve/CVE-2026-33824/ kev-added:CVE-2026-33824 Tue, 18 Aug 2026 00:00:00 GMT Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability. CVSS 9.8. EPSS 77.1%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-21. https://patchbulletin.com/cve/CVE-2025-62593/ kev-added:CVE-2025-62593 Mon, 17 Aug 2026 00:00:00 GMT Ray-Project Ray Code Injection Vulnerability. CVSS 8.8. EPSS 60.2%. Ransomware use: Unknown. Fixed in: Unknown. CISA due date 2026-08-20. https://patchbulletin.com/cve/CVE-2026-72898/ kev-added:CVE-2026-72898 Tue, 11 Aug 2026 00:00:00 GMT Metabase SQL Injection Vulnerability. CVSS 10.0. EPSS 98.6%. Ransomware use: Unknown. Fixed in: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5. CISA due date 2026-08-14.