CVEs: o que está sendo explorado agora.
Dados do CVE Program (cve.org) e do catálogo KEV da CISA.
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust · Remote SupportThe vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
No KEV desde 16 de out. de 2026Fortinet Multiple Products Path Traversal Vulnerability
Fortinet · Multiple ProductsAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versio…
No KEV desde 16 de out. de 2026Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian · Multiple ProductsMultiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attac…
No KEV desde 15 de out. de 2026Ahsay AhsayCBS Command Injection Vulnerability
Ahsay · AhsayCBSA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit h…
No KEV desde 14 de out. de 2026Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco · Secure Email GatewayA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An…
No KEV desde 14 de out. de 2026Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay · AhsayCBSA vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit i…
No KEV desde 14 de out. de 2026Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks · PAN-OSA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management…
No KEV desde 14 de out. de 2026Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti · Connect SecureAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
No KEV desde 13 de out. de 2026Microsoft Windows Command Injection Vulnerability
Microsoft · WindowsImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
No KEV desde 13 de out. de 2026ISC BIND Data Processing Errors Vulnerability
ISC · BINDnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
No KEV desde 08 de out. de 2026Apache Struts Command Injection Vulnerability
Apache · StrutsApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
No KEV desde 08 de out. de 2026Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi · StrapiStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited…
No KEV desde 08 de out. de 2026ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE · DocsDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
No KEV desde 08 de out. de 2026ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPDThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
No KEV desde 08 de out. de 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScalerVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
No KEV desde 04 de out. de 2026Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH · ZammadZammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by th…
No KEV desde 02 de out. de 2026Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH · ZammadZammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
No KEV desde 02 de out. de 2026Fortinet FortiMail Path Traversal Vulnerability
Fortinet · FortiMailAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system…
No KEV desde 01 de out. de 2026O KEV lista falhas com exploração confirmada, mantido pela CISA. A nota CVSS vem do registro no CVE.org.