{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: newest CISA KEV additions","home_page_url":"https://patchfirst.co/insights/","feed_url":"https://patchfirst.co/feed/kev.json","description":"The 50 most recent additions to the CISA Known Exploited Vulnerabilities catalogue, with EPSS, ransomware use and ATT&CK context.","language":"en-GB","items":[{"id":"CVE-2026-111357#kev","url":"https://patchfirst.co/cve/CVE-2026-111357/","title":"[KEV] CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-30. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 24.6% of CVEs). CVSS 7.0 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 57.0 of 100.","summary":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-31T04:18:16.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":57,"kev":{"dateAdded":"2026-10-30","ransomware":false},"epss":{"score":0.00316,"percentile":0.24569},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-118527#kev","url":"https://patchfirst.co/cve/CVE-2026-118527/","title":"[KEV] CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-30. No EPSS score. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 45.0 of 100.","summary":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-30T00:00:00.000Z","tags":["kev","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":45,"kev":{"dateAdded":"2026-10-30","ransomware":false},"epss":null,"cvss":null,"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-97229#kev","url":"https://patchfirst.co/cve/CVE-2026-97229/","title":"[KEV] CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","content_text":"GitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-10-29. ENISA EUVD lists it as exploited. EPSS 26.6% (higher than 98% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-31T00:16:52.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-10-29","ransomware":false},"epss":{"score":0.26569,"percentile":0.98015},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community Edition and Enterprise Edition","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76418#kev","url":"https://patchfirst.co/cve/CVE-2026-76418/","title":"[KEV] CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…","content_text":"Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software. In CISA KEV since 2026-10-29. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 59.9% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 64.4 of 100.","summary":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T10:36:01.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.4,"kev":{"dateAdded":"2026-10-29","ransomware":false},"epss":{"score":0.0091,"percentile":0.59949},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall ASA Software and Cisco Secure FTD Software","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-46300#kev","url":"https://patchfirst.co/cve/CVE-2026-46300/","title":"[KEV] CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-10-28. ENISA EUVD lists it as exploited. EPSS 16.1% (higher than 96.9% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 77.5 of 100.","summary":"Linux Kernel Missing Initialization of a Variable Vulnerability","date_published":"2026-10-28T00:00:00.000Z","date_modified":"2026-10-29T17:30:34.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":77.5,"kev":{"dateAdded":"2026-10-28","ransomware":false},"epss":{"score":0.1613,"percentile":0.96923},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-41709#kev","url":"https://patchfirst.co/cve/CVE-2026-41709/","title":"[KEV] CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability","content_text":"Broadcom · VMware ESX. In CISA KEV since 2026-10-28. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 52.7% of CVEs). CVSS 2.7 LOW. ATT&CK: T1078 Valid Accounts. Priority 59.8 of 100.","summary":"Broadcom VMWare ESX Insufficient Logging Vulnerability","date_published":"2026-10-28T00:00:00.000Z","date_modified":"2026-10-29T17:29:11.000Z","tags":["kev","T1078"],"_patchfirst":{"reason":"kev","priority":59.8,"kev":{"dateAdded":"2026-10-28","ransomware":false},"epss":{"score":0.00689,"percentile":0.52718},"cvss":{"score":2.7,"severity":"LOW","version":"3.1"},"vendor":"Broadcom","product":"VMware ESX","techniqueIds":["T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-111497#kev","url":"https://patchfirst.co/cve/CVE-2026-111497/","title":"[KEV] CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability","content_text":"Google · Brotli. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 79.8 of 100.","summary":"Google Brotli Unchecked Return Value Vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-30T20:30:11.000Z","tags":["kev","public-exploit","T1190","T1005","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-10-27","ransomware":false},"epss":{"score":0.82641,"percentile":0.99666},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Google","product":"Brotli","techniqueIds":["T1190","T1005","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-48356#kev","url":"https://patchfirst.co/cve/CVE-2026-48356/","title":"[KEV] CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","content_text":"Adobe · Commerce and Magento. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 44.6% (higher than 98.8% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter. Priority 78.3 of 100.","summary":"Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T13:34:50.000Z","tags":["kev","public-exploit","T1189","T1059"],"_patchfirst":{"reason":"kev","priority":78.3,"kev":{"dateAdded":"2026-10-27","ransomware":false},"epss":{"score":0.44579,"percentile":0.98767},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento","techniqueIds":["T1189","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-109618#kev","url":"https://patchfirst.co/cve/CVE-2026-109618/","title":"[KEV] CVE-2026-109618: PHP Memory Corruption Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2026-10-26. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"PHP Memory Corruption Vulnerability","date_published":"2026-10-26T00:00:00.000Z","date_modified":"2026-10-30T19:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2026-10-26","ransomware":false},"epss":{"score":0.99999,"percentile":0.99998},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-109619#kev","url":"https://patchfirst.co/cve/CVE-2026-109619/","title":"[KEV] CVE-2026-109619: PHP Stale Internal Request-State Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2026-10-26. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.7 of 100.","summary":"PHP Stale Internal Request-State Vulnerability","date_published":"2026-10-26T00:00:00.000Z","date_modified":"2026-10-30T19:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.7,"kev":{"dateAdded":"2026-10-26","ransomware":false},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-110447#kev","url":"https://patchfirst.co/cve/CVE-2026-110447/","title":"[KEV] CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","content_text":"Collabora · Collabora Online – Built-in CODE Server. In CISA KEV since 2026-10-23. ENISA EUVD lists it as exploited. EPSS 73.3% (higher than 99.46% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 89.4 of 100.","summary":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","date_published":"2026-10-23T00:00:00.000Z","date_modified":"2026-10-30T16:32:46.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":89.4,"kev":{"dateAdded":"2026-10-23","ransomware":false},"epss":{"score":0.73307,"percentile":0.9946},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-114625#kev","url":"https://patchfirst.co/cve/CVE-2026-114625/","title":"[KEV] CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability","content_text":"Arista · VeloCloud Orchestrator. In CISA KEV since 2026-10-23. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.5% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application. Priority 72.5 of 100.","summary":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","date_published":"2026-10-23T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1078","T1068","T1190"],"_patchfirst":{"reason":"kev","priority":72.5,"kev":{"dateAdded":"2026-10-23","ransomware":false},"epss":{"score":0.01025,"percentile":0.63541},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Arista","product":"VeloCloud Orchestrator","techniqueIds":["T1078","T1068","T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96656#kev","url":"https://patchfirst.co/cve/CVE-2026-96656/","title":"[KEV] CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.3% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.1 of 100.","summary":"Plex Media Server External Control of File Name or Path Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:18.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":73.1,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01785,"percentile":0.78279},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96652#kev","url":"https://patchfirst.co/cve/CVE-2026-96652/","title":"[KEV] CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 71.2 of 100.","summary":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:44.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":71.2,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01821,"percentile":0.78731},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-106931#kev","url":"https://patchfirst.co/cve/CVE-2026-106931/","title":"[KEV] CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","content_text":"EG Secure Solutions · SiteGuard Server Edition. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.9% of CVEs). CVSS 8.5 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 70.7 of 100.","summary":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T15:42:24.000Z","tags":["kev","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":70.7,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.02528,"percentile":0.84877},"cvss":{"score":8.5,"severity":"HIGH","version":"4.0"},"vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-96654#kev","url":"https://patchfirst.co/cve/CVE-2026-96654/","title":"[KEV] CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 80.2% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.0 of 100.","summary":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:37.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01949,"percentile":0.80195},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-96655#kev","url":"https://patchfirst.co/cve/CVE-2026-96655/","title":"[KEV] CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.3% of CVEs). CVSS 4.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 65.7 of 100.","summary":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:29.000Z","tags":["kev","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":65.7,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01637,"percentile":0.7631},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-110936#kev","url":"https://patchfirst.co/cve/CVE-2026-110936/","title":"[KEV] CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability","content_text":"Siemens · Software Center. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 61.7% of CVEs). CVSS 6.7 MEDIUM. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1574.008 Path Interception by Search Order Hijacking. Priority 65.0 of 100.","summary":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:10:11.000Z","tags":["kev","T1078","T1059","T1574.008"],"_patchfirst":{"reason":"kev","priority":65,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.00967,"percentile":0.6171},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1"},"vendor":"Siemens","product":"Software Center","techniqueIds":["T1078","T1059","T1574.008"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-102764#kev","url":"https://patchfirst.co/cve/CVE-2026-102764/","title":"[KEV] CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","content_text":"BeyondTrust · Remote Support. In CISA KEV since 2026-10-16. ENISA EUVD lists it as exploited. EPSS 18.9% (higher than 97.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.3 of 100.","summary":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","date_published":"2026-10-16T00:00:00.000Z","date_modified":"2026-10-17T04:16:47.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-10-16","ransomware":false},"epss":{"score":0.1895,"percentile":0.97297},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"BeyondTrust","product":"Remote Support","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-61624#kev","url":"https://patchfirst.co/cve/CVE-2025-61624/","title":"[KEV] CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2026-10-16. ENISA EUVD lists it as exploited. EPSS 1.3% (higher than 71.3% of CVEs). CVSS 6.5 MEDIUM. Priority 66.8 of 100.","summary":"Fortinet Multiple Products Path Traversal Vulnerability","date_published":"2026-10-16T00:00:00.000Z","date_modified":"2026-10-17T04:16:43.000Z","tags":["kev"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2026-10-16","ransomware":false},"epss":{"score":0.01343,"percentile":0.71332},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-21589#kev","url":"https://patchfirst.co/cve/CVE-2026-21589/","title":"[KEV] CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","content_text":"Atlassian · Multiple Products. In CISA KEV since 2026-10-15. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.2 of 100.","summary":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","date_published":"2026-10-15T00:00:00.000Z","date_modified":"2026-10-29T13:17:09.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2026-10-15","ransomware":false},"epss":{"score":0.99477,"percentile":0.99943},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Atlassian","product":"Multiple Products","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-105134#kev","url":"https://patchfirst.co/cve/CVE-2026-105134/","title":"[KEV] CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability","content_text":"Ahsay · AhsayCBS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 81.8% (higher than 99.64% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"Ahsay AhsayCBS Command Injection Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-26T18:06:57.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.81763,"percentile":0.99644},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ahsay","product":"AhsayCBS","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-105133#kev","url":"https://patchfirst.co/cve/CVE-2026-105133/","title":"[KEV] CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability","content_text":"Ahsay · AhsayCBS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 79.5% (higher than 99.6% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.0 of 100.","summary":"Ahsay AhsayCBS Improper Authentication Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-26T18:07:09.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":78,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.7947,"percentile":0.99602},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"Ahsay","product":"AhsayCBS","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76519#kev","url":"https://patchfirst.co/cve/CVE-2026-76519/","title":"[KEV] CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability","content_text":"Cisco · Secure Email Gateway. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 2.2% (higher than 82.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 76.3 of 100.","summary":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-15T13:47:19.000Z","tags":["kev","public-exploit","T1190","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":76.3,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.02152,"percentile":0.82127},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Secure Email Gateway","techniqueIds":["T1190","T1059","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-0322#kev","url":"https://patchfirst.co/cve/CVE-2026-0322/","title":"[KEV] CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability","content_text":"Palo Alto Networks · PAN-OS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.7% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.","summary":"Palo Alto Networks PAN-OS Code Injection Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-15T13:47:26.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":73.6,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.0174,"percentile":0.77702},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Palo Alto Networks","product":"PAN-OS","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-104935#kev","url":"https://patchfirst.co/cve/CVE-2026-104935/","title":"[KEV] CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-13. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.0 of 100.","summary":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-13T19:24:36.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79,"kev":{"dateAdded":"2026-10-13","ransomware":false},"epss":{"score":0.86766,"percentile":0.99742},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96951#kev","url":"https://patchfirst.co/cve/CVE-2026-96951/","title":"[KEV] CVE-2026-96951: Microsoft Windows Command Injection Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-10-13. ENISA EUVD lists it as exploited. EPSS 9.8% (higher than 95.5% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.001 Malicious Link; T1059 Command and Scripting Interpreter. Priority 73.3 of 100.","summary":"Microsoft Windows Command Injection Vulnerability","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-29T16:20:22.000Z","tags":["kev","T1204.001","T1059"],"_patchfirst":{"reason":"kev","priority":73.3,"kev":{"dateAdded":"2026-10-13","ransomware":false},"epss":{"score":0.09813,"percentile":0.95543},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.001","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2015-3306#kev","url":"https://patchfirst.co/cve/CVE-2015-3306/","title":"[KEV] CVE-2015-3306: ProFTPD Improper Access Control Vulnerability","content_text":"ProFTPD · ProFTPD. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.","summary":"ProFTPD Improper Access Control Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T16:17:18.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.99497,"percentile":0.99945},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"ProFTPD","product":"ProFTPD","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-3199#kev","url":"https://patchfirst.co/cve/CVE-2021-3199/","title":"[KEV] CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability","content_text":"ONLYOFFICE · Docs. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 30.2% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"ONLYOFFICE Docs Server Path Traversal Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:20:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.30244,"percentile":0.98219},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ONLYOFFICE","product":"Docs","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-22894#kev","url":"https://patchfirst.co/cve/CVE-2023-22894/","title":"[KEV] CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability","content_text":"Strapi · Strapi. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.8% of CVEs). CVSS 4.9 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access. Priority 74.6 of 100.","summary":"Strapi Cleartext Storage of Sensitive Information Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:20:41.000Z","tags":["kev","public-exploit","T1078","T1212"],"_patchfirst":{"reason":"kev","priority":74.6,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.04114,"percentile":0.90767},"cvss":{"score":4.9,"severity":"MEDIUM","version":"3.1"},"vendor":"Strapi","product":"Strapi","techniqueIds":["T1078","T1212"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-3081#kev","url":"https://patchfirst.co/cve/CVE-2016-3081/","title":"[KEV] CVE-2016-3081: Apache Struts Command Injection Vulnerability","content_text":"Apache · Struts. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 96.5% (higher than 99.88% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.","summary":"Apache Struts Command Injection Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:43:05.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.6,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.96525,"percentile":0.99882},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Struts","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-5477#kev","url":"https://patchfirst.co/cve/CVE-2015-5477/","title":"[KEV] CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability","content_text":"ISC · BIND. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 68.2 of 100.","summary":"ISC BIND Data Processing Errors Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T19:12:37.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.99584,"percentile":0.99947},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"ISC","product":"BIND","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88779#kev","url":"https://patchfirst.co/cve/CVE-2026-88779/","title":"[KEV] CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-10-04. ENISA EUVD lists it as exploited. EPSS 11.4% (higher than 96% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application. Priority 72.4 of 100.","summary":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","date_published":"2026-10-04T00:00:00.000Z","date_modified":"2026-10-05T13:35:24.000Z","tags":["kev","T1190"],"_patchfirst":{"reason":"kev","priority":72.4,"kev":{"dateAdded":"2026-10-04","ransomware":false},"epss":{"score":0.11388,"percentile":0.95988},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-102489#kev","url":"https://patchfirst.co/cve/CVE-2026-102489/","title":"[KEV] CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability","content_text":"Zammad GmbH · Zammad. In CISA KEV since 2026-10-02. ENISA EUVD lists it as exploited. EPSS 22.5% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"Zammad GmbH Zammad Session Fixation Vulnerability","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-10T04:18:08.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.4,"kev":{"dateAdded":"2026-10-02","ransomware":false},"epss":{"score":0.22478,"percentile":0.97703},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zammad GmbH","product":"Zammad","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-102490#kev","url":"https://patchfirst.co/cve/CVE-2026-102490/","title":"[KEV] CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability","content_text":"Zammad GmbH · Zammad. In CISA KEV since 2026-10-02. ENISA EUVD lists it as exploited. EPSS 10.9% (higher than 95.9% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 72.6 of 100.","summary":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-09T14:21:05.000Z","tags":["kev","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":72.6,"kev":{"dateAdded":"2026-10-02","ransomware":false},"epss":{"score":0.10936,"percentile":0.95877},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Zammad GmbH","product":"Zammad","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-104286#kev","url":"https://patchfirst.co/cve/CVE-2026-104286/","title":"[KEV] CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability","content_text":"Fortinet · FortiMail. In CISA KEV since 2026-10-01. ENISA EUVD lists it as exploited. EPSS 4.6% (higher than 91.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 78.2 of 100.","summary":"Fortinet FortiMail Path Traversal Vulnerability","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-28T20:09:29.000Z","tags":["kev","public-exploit","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2026-10-01","ransomware":false},"epss":{"score":0.04573,"percentile":0.91609},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiMail","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76504#kev","url":"https://patchfirst.co/cve/CVE-2026-76504/","title":"[KEV] CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","content_text":"Cisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-09-30. ENISA EUVD lists it as exploited. EPSS 38.9% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.6 of 100.","summary":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","date_published":"2026-09-30T00:00:00.000Z","date_modified":"2026-10-03T00:16:39.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.6,"kev":{"dateAdded":"2026-09-30","ransomware":false},"epss":{"score":0.38928,"percentile":0.98587},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Manager","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-86950#kev","url":"https://patchfirst.co/cve/CVE-2026-86950/","title":"[KEV] CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-09-29. ENISA EUVD lists it as exploited. EPSS 26.2% (higher than 98% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 78.8 of 100.","summary":"Apple Multiple Products Out-of-Bounds Write Vulnerability","date_published":"2026-09-29T00:00:00.000Z","date_modified":"2026-10-27T12:29:30.000Z","tags":["kev","public-exploit","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":78.8,"kev":{"dateAdded":"2026-09-29","ransomware":false},"epss":{"score":0.26166,"percentile":0.97992},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88771#kev","url":"https://patchfirst.co/cve/CVE-2026-88771/","title":"[KEV] CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 82.2% (higher than 99.66% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Citrix NetScaler Improper Input Validation Vulnerability","date_published":"2026-09-27T00:00:00.000Z","date_modified":"2026-09-29T04:18:01.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-09-27","ransomware":false},"epss":{"score":0.8216,"percentile":0.99655},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88772#kev","url":"https://patchfirst.co/cve/CVE-2026-88772/","title":"[KEV] CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 78.2% (higher than 99.58% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.","summary":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","date_published":"2026-09-27T00:00:00.000Z","date_modified":"2026-09-28T12:26:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-27","ransomware":false},"epss":{"score":0.78162,"percentile":0.99577},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-87902#kev","url":"https://patchfirst.co/cve/CVE-2026-87902/","title":"[KEV] CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability","content_text":"WordPress · Core. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 95.8% (higher than 99.87% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.","summary":"WordPress Core Remote File Inclusion Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-28T12:20:54.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.95769,"percentile":0.99872},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"WordPress","product":"Core","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-65660#kev","url":"https://patchfirst.co/cve/CVE-2026-65660/","title":"[KEV] CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 8.2% (higher than 94.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.1 of 100.","summary":"Microsoft SharePoint Code Injection Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.1,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.08189,"percentile":0.94862},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67279#kev","url":"https://patchfirst.co/cve/CVE-2026-67279/","title":"[KEV] CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.1% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1565.001 Stored Data Manipulation. Priority 74.2 of 100.","summary":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-26T04:17:47.000Z","tags":["kev","public-exploit","T1190","T1059","T1565.001"],"_patchfirst":{"reason":"kev","priority":74.2,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.02277,"percentile":0.83093},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1059","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-5430#kev","url":"https://patchfirst.co/cve/CVE-2026-5430/","title":"[KEV] CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability","content_text":"WSO2 · Multiple Products. In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 22.4% (higher than 97.7% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1550 Use Alternate Authentication Material. Priority 79.5 of 100.","summary":"WSO2 Multiple Products Path Traversal Vulnerability","date_published":"2026-09-24T00:00:00.000Z","date_modified":"2026-09-25T12:53:05.000Z","tags":["kev","public-exploit","T1190","T1078","T1550"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-09-24","ransomware":false},"epss":{"score":0.2239,"percentile":0.97691},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"WSO2","product":"Multiple Products","techniqueIds":["T1190","T1078","T1550"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-71362#kev","url":"https://patchfirst.co/cve/CVE-2026-71362/","title":"[KEV] CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability","content_text":"Adobe · Commerce and Magento . In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 90.5% (higher than 99.8% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 79.3 of 100.","summary":"Adobe Commerce and Magento Incorrect Authorization Vulnerability","date_published":"2026-09-24T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-09-24","ransomware":false},"epss":{"score":0.90491,"percentile":0.99801},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento ","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-93616#kev","url":"https://patchfirst.co/cve/CVE-2026-93616/","title":"[KEV] CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability","content_text":"Check Point · Multiple Products. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 91.6% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Check Point Multiple Products Path Traversal Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T16:38:38.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.91605,"percentile":0.99813},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"Multiple Products","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-85102#kev","url":"https://patchfirst.co/cve/CVE-2026-85102/","title":"[KEV] CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability","content_text":"Check Point · Multiple Products. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 54.1% (higher than 99.01% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.7 of 100.","summary":"Check Point Multiple Products Improper Certificate Validation Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T18:22:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.7,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.5414,"percentile":0.99006},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"Multiple Products","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-94127#kev","url":"https://patchfirst.co/cve/CVE-2026-94127/","title":"[KEV] CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","content_text":"F5 · BIG-IP APM. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 24.9% (higher than 97.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T14:32:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.4,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.24938,"percentile":0.97912},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP APM","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-93952#kev","url":"https://patchfirst.co/cve/CVE-2026-93952/","title":"[KEV] CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","content_text":"Arista · VeloCloud Orchestrator. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.2% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 69.4 of 100.","summary":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T14:32:12.000Z","tags":["kev","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.01384,"percentile":0.72172},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Arista","product":"VeloCloud Orchestrator","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-7273#kev","url":"https://patchfirst.co/cve/CVE-2026-7273/","title":"[KEV] CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","content_text":"Zyxel · GS1900 Series Switches. In CISA KEV since 2026-09-21. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 76.4 of 100.","summary":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","date_published":"2026-09-21T00:00:00.000Z","date_modified":"2026-10-25T23:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":76.4,"kev":{"dateAdded":"2026-09-21","ransomware":false},"epss":{"score":0.02778,"percentile":0.86351},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"GS1900 Series Switches","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}