{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1005 Data from Local System","home_page_url":"https://patchfirst.co/technique/T1005/","feed_url":"https://patchfirst.co/feed/technique/T1005.json","description":"New and newly exploited CVEs that lead to ATT&CK T1005 Data from Local System, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-111497#kev","url":"https://patchfirst.co/cve/CVE-2026-111497/","title":"[KEV] CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability","content_text":"Google · Brotli. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 79.8 of 100.","summary":"Google Brotli Unchecked Return Value Vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-30T20:30:11.000Z","tags":["kev","public-exploit","T1190","T1005","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-10-27","ransomware":false},"epss":{"score":0.82641,"percentile":0.99666},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Google","product":"Brotli","techniqueIds":["T1190","T1005","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-102764#kev","url":"https://patchfirst.co/cve/CVE-2026-102764/","title":"[KEV] CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","content_text":"BeyondTrust · Remote Support. In CISA KEV since 2026-10-16. ENISA EUVD lists it as exploited. EPSS 18.9% (higher than 97.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.3 of 100.","summary":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","date_published":"2026-10-16T00:00:00.000Z","date_modified":"2026-10-17T04:16:47.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-10-16","ransomware":false},"epss":{"score":0.1895,"percentile":0.97297},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"BeyondTrust","product":"Remote Support","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21589#kev","url":"https://patchfirst.co/cve/CVE-2026-21589/","title":"[KEV] CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","content_text":"Atlassian · Multiple Products. In CISA KEV since 2026-10-15. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.2 of 100.","summary":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","date_published":"2026-10-15T00:00:00.000Z","date_modified":"2026-10-29T13:17:09.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2026-10-15","ransomware":false},"epss":{"score":0.99477,"percentile":0.99943},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Atlassian","product":"Multiple Products","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-3306#kev","url":"https://patchfirst.co/cve/CVE-2015-3306/","title":"[KEV] CVE-2015-3306: ProFTPD Improper Access Control Vulnerability","content_text":"ProFTPD · ProFTPD. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.","summary":"ProFTPD Improper Access Control Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T16:17:18.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.99497,"percentile":0.99945},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"ProFTPD","product":"ProFTPD","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-85706","url":"https://patchfirst.co/cve/CVE-2026-85706/","title":"CVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","content_text":"GitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 97.4% (higher than 99.9% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.","summary":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","date_published":"2026-09-12T00:00:00.000Z","date_modified":"2026-09-24T12:52:28.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"published","priority":80,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.97355,"percentile":0.99898},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community Edition and Enterprise Edition","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67277#kev","url":"https://patchfirst.co/cve/CVE-2026-67277/","title":"[KEV] CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-10. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1499.004 Application or System Exploitation. Priority 73.8 of 100.","summary":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","date_published":"2026-09-10T00:00:00.000Z","date_modified":"2026-09-11T12:52:29.000Z","tags":["kev","public-exploit","T1190","T1005","T1499.004"],"_patchfirst":{"reason":"kev","priority":73.8,"kev":{"dateAdded":"2026-09-10","ransomware":false},"epss":{"score":0.0156,"percentile":0.75209},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1005","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-49105#kev","url":"https://patchfirst.co/cve/CVE-2023-49105/","title":"[KEV] CVE-2023-49105: ownCloud Improper Authentication Vulnerability","content_text":"ownCloud · ownCloud. In CISA KEV since 2026-08-27. ENISA EUVD lists it as exploited. EPSS 43.2% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1485 Data Destruction. Priority 79.6 of 100.","summary":"ownCloud Improper Authentication Vulnerability","date_published":"2026-08-27T00:00:00.000Z","date_modified":"2026-08-28T12:21:09.000Z","tags":["kev","public-exploit","T1190","T1005","T1485"],"_patchfirst":{"reason":"kev","priority":79.6,"kev":{"dateAdded":"2026-08-27","ransomware":false},"epss":{"score":0.4319,"percentile":0.98723},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ownCloud","product":"ownCloud","techniqueIds":["T1190","T1005","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21962#kev","url":"https://patchfirst.co/cve/CVE-2026-21962/","title":"[KEV] CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability","content_text":"Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in. In CISA KEV since 2026-08-24. ENISA EUVD lists it as exploited. EPSS 73.2% (higher than 99.46% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.9 of 100.","summary":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability","date_published":"2026-08-24T00:00:00.000Z","date_modified":"2026-08-25T04:18:11.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":74.9,"kev":{"dateAdded":"2026-08-24","ransomware":false},"epss":{"score":0.73192,"percentile":0.99456},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Oracle","product":"HTTP Server and Oracle Weblogic Server Proxy Plug-in","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20316#kev","url":"https://patchfirst.co/cve/CVE-2026-20316/","title":"[KEV] CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","content_text":"Cisco · Secure Firewall Management Center (FMC). In CISA KEV since 2026-07-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 35.1% (higher than 98.4% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Named in 1 threat report. Priority 80.3 of 100.","summary":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","date_published":"2026-07-29T00:00:00.000Z","date_modified":"2026-10-24T13:10:00.000Z","tags":["kev","ransomware","T1078","T1005"],"_patchfirst":{"reason":"kev","priority":80.3,"kev":{"dateAdded":"2026-07-29","ransomware":true},"epss":{"score":0.35096,"percentile":0.98435},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall Management Center (FMC)","techniqueIds":["T1078","T1005"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-68686#kev","url":"https://patchfirst.co/cve/CVE-2025-68686/","title":"[KEV] CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","content_text":"Fortinet · FortiOS. In CISA KEV since 2026-07-27. ENISA EUVD lists it as exploited. EPSS 29.5% (higher than 98.2% of CVEs). CVSS 5.9 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 66.8 of 100.","summary":"Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","date_published":"2026-07-27T00:00:00.000Z","date_modified":"2026-07-28T05:17:04.000Z","tags":["kev","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2026-07-27","ransomware":false},"epss":{"score":0.29499,"percentile":0.98182},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1"},"vendor":"Fortinet","product":"FortiOS","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-60137#kev","url":"https://patchfirst.co/cve/CVE-2026-60137/","title":"[KEV] CVE-2026-60137: WordPress Core SQL Injection Vulnerability","content_text":"WordPress · Core. In CISA KEV since 2026-07-21. ENISA EUVD lists it as exploited. EPSS 5.3% (higher than 92.6% of CVEs). CVSS 5.9 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Named in 1 threat report. Priority 74.5 of 100.","summary":"WordPress Core SQL Injection Vulnerability","date_published":"2026-07-21T00:00:00.000Z","date_modified":"2026-10-08T10:35:47.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":74.5,"kev":{"dateAdded":"2026-07-21","ransomware":false},"epss":{"score":0.05323,"percentile":0.92598},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1"},"vendor":"WordPress","product":"Core","techniqueIds":["T1190","T1005"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-55255#kev","url":"https://patchfirst.co/cve/CVE-2026-55255/","title":"[KEV] CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability","content_text":"Langflow · Langflow. In CISA KEV since 2026-07-07. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 59.2% of CVEs). CVSS 8.4 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 65.7 of 100.","summary":"Langflow Authorization Bypass Through User-Controlled Key Vulnerability","date_published":"2026-07-07T00:00:00.000Z","date_modified":"2026-10-25T23:10:00.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":65.7,"kev":{"dateAdded":"2026-07-07","ransomware":false},"epss":{"score":0.00887,"percentile":0.59248},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1"},"vendor":"Langflow","product":"Langflow","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-34909#kev","url":"https://patchfirst.co/cve/CVE-2026-34909/","title":"[KEV] CVE-2026-34909: Ubiquiti UniFi OS Path Traversal Vulnerability","content_text":"Ubiquiti · UniFi OS. In CISA KEV since 2026-06-23. ENISA EUVD lists it as exploited. EPSS 68.0% (higher than 99.32% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.9 of 100.","summary":"Ubiquiti UniFi OS Path Traversal Vulnerability","date_published":"2026-06-23T00:00:00.000Z","date_modified":"2026-07-23T16:10:00.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":74.9,"kev":{"dateAdded":"2026-06-23","ransomware":false},"epss":{"score":0.68033,"percentile":0.99323},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ubiquiti","product":"UniFi OS","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-54420#kev","url":"https://patchfirst.co/cve/CVE-2026-54420/","title":"[KEV] CVE-2026-54420: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability","content_text":"LiteSpeed · cPanel Plugin. In CISA KEV since 2026-06-15. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 73.1% of CVEs). CVSS 8.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.6 of 100.","summary":"LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability","date_published":"2026-06-15T00:00:00.000Z","date_modified":"2026-07-23T09:10:00.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.6,"kev":{"dateAdded":"2026-06-15","ransomware":false},"epss":{"score":0.01439,"percentile":0.73133},"cvss":{"score":8.5,"severity":"HIGH","version":"3.1"},"vendor":"LiteSpeed","product":"cPanel Plugin","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21182#kev","url":"https://patchfirst.co/cve/CVE-2024-21182/","title":"[KEV] CVE-2024-21182: Oracle WebLogic Server Unspecified Vulnerability","content_text":"Oracle · WebLogic Server. In CISA KEV since 2026-06-01. ENISA EUVD lists it as exploited. EPSS 74.2% (higher than 99.48% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 73.1 of 100.","summary":"Oracle WebLogic Server Unspecified Vulnerability","date_published":"2026-06-01T00:00:00.000Z","date_modified":"2026-06-17T07:08:41.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":73.1,"kev":{"dateAdded":"2026-06-01","ransomware":false},"epss":{"score":0.74162,"percentile":0.99485},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Oracle","product":"WebLogic Server","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-42208#kev","url":"https://patchfirst.co/cve/CVE-2026-42208/","title":"[KEV] CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability","content_text":"BerriAI · LiteLLM. In CISA KEV since 2026-05-08. ENISA EUVD lists it as exploited. EPSS 89.4% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 74.8 of 100.","summary":"BerriAI LiteLLM SQL Injection Vulnerability","date_published":"2026-05-08T00:00:00.000Z","date_modified":"2026-10-26T20:10:00.000Z","tags":["kev","public-exploit","T1190","T1005","T1565.001"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-05-08","ransomware":false},"epss":{"score":0.8942,"percentile":0.99785},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"BerriAI","product":"LiteLLM","techniqueIds":["T1190","T1005","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20133#kev","url":"https://patchfirst.co/cve/CVE-2026-20133/","title":"[KEV] CVE-2026-20133: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","content_text":"Cisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 31.5% (higher than 98.3% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 67.9 of 100.","summary":"Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-06-17T10:17:11.000Z","tags":["kev","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":67.9,"kev":{"dateAdded":"2026-04-20","ransomware":false},"epss":{"score":0.31479,"percentile":0.98282},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Manager","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-3055#kev","url":"https://patchfirst.co/cve/CVE-2026-3055/","title":"[KEV] CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-03-30. ENISA EUVD lists it as exploited. EPSS 91.5% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.8 of 100.","summary":"Citrix NetScaler Out-of-Bounds Read Vulnerability","date_published":"2026-03-30T00:00:00.000Z","date_modified":"2026-06-17T10:42:58.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-03-30","ransomware":false},"epss":{"score":0.91491,"percentile":0.99812},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-1603#kev","url":"https://patchfirst.co/cve/CVE-2026-1603/","title":"[KEV] CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability","content_text":"Ivanti ·  Endpoint Manager (EPM). In CISA KEV since 2026-03-09. ENISA EUVD lists it as exploited. EPSS 88.3% (higher than 99.77% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 73.2 of 100.","summary":"Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability","date_published":"2026-03-09T00:00:00.000Z","date_modified":"2026-06-17T10:16:09.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2026-03-09","ransomware":false},"epss":{"score":0.88335,"percentile":0.99769},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":" Endpoint Manager (EPM)","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22054#kev","url":"https://patchfirst.co/cve/CVE-2021-22054/","title":"[KEV] CVE-2021-22054: Omnissa Workspace ONE Server-Side Request Forgery","content_text":"Omnissa · Workspace One UEM. In CISA KEV since 2026-03-09. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Omnissa Workspace ONE Server-Side Request Forgery","date_published":"2026-03-09T00:00:00.000Z","date_modified":"2026-10-01T19:17:13.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2026-03-09","ransomware":false},"epss":{"score":0.99677,"percentile":0.9995},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Omnissa","product":"Workspace One UEM","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-19006#kev","url":"https://patchfirst.co/cve/CVE-2019-19006/","title":"[KEV] CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability","content_text":"Sangoma · FreePBX. In CISA KEV since 2026-02-03. ENISA EUVD lists it as exploited. EPSS 55.9% (higher than 99.05% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.7 of 100.","summary":"Sangoma FreePBX Improper Authentication Vulnerability","date_published":"2026-02-03T00:00:00.000Z","date_modified":"2026-06-17T15:45:04.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2026-02-03","ransomware":false},"epss":{"score":0.55946,"percentile":0.99045},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sangoma","product":"FreePBX","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-68645#kev","url":"https://patchfirst.co/cve/CVE-2025-68645/","title":"[KEV] CVE-2025-68645: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability","content_text":"Synacor ·  Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1005 Data from Local System. Priority 73.9 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability","date_published":"2026-01-22T00:00:00.000Z","date_modified":"2026-06-17T09:59:22.000Z","tags":["kev","public-exploit","T1005"],"_patchfirst":{"reason":"kev","priority":73.9,"kev":{"dateAdded":"2026-01-22","ransomware":false},"epss":{"score":0.48873,"percentile":0.98876},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Synacor","product":" Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-31125#kev","url":"https://patchfirst.co/cve/CVE-2025-31125/","title":"[KEV] CVE-2025-31125: Vite Vitejs Improper Access Control Vulnerability","content_text":"Vite · Vitejs. In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 74.9% (higher than 99.5% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Vite Vitejs Improper Access Control Vulnerability","date_published":"2026-01-22T00:00:00.000Z","date_modified":"2026-06-17T09:09:54.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2026-01-22","ransomware":false},"epss":{"score":0.74939,"percentile":0.99505},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Vite","product":"Vitejs","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-34026#kev","url":"https://patchfirst.co/cve/CVE-2025-34026/","title":"[KEV] CVE-2025-34026: Versa Concerto Improper Authentication Vulnerability","content_text":"Versa · Concerto. In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 81.8% (higher than 99.64% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1078 Valid Accounts. Priority 68.2 of 100.","summary":"Versa Concerto Improper Authentication Vulnerability","date_published":"2026-01-22T00:00:00.000Z","date_modified":"2026-06-17T09:13:19.000Z","tags":["kev","public-exploit","T1190","T1005","T1078"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2026-01-22","ransomware":false},"epss":{"score":0.8178,"percentile":0.99645},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Versa","product":"Concerto","techniqueIds":["T1190","T1005","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20805#kev","url":"https://patchfirst.co/cve/CVE-2026-20805/","title":"[KEV] CVE-2026-20805: Microsoft Windows Information Disclosure Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-01-13. ENISA EUVD lists it as exploited. EPSS 7.5% (higher than 94.5% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Priority 70.7 of 100.","summary":"Microsoft Windows Information Disclosure Vulnerability","date_published":"2026-01-13T00:00:00.000Z","date_modified":"2026-07-30T21:16:56.000Z","tags":["kev","public-exploit","T1078","T1005"],"_patchfirst":{"reason":"kev","priority":70.7,"kev":{"dateAdded":"2026-01-13","ransomware":false},"epss":{"score":0.07463,"percentile":0.94456},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1078","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-14847#kev","url":"https://patchfirst.co/cve/CVE-2025-14847/","title":"[KEV] CVE-2025-14847: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability","content_text":"MongoDB · MongoDB and MongoDB Server. In CISA KEV since 2025-12-29. ENISA EUVD lists it as exploited. EPSS 83.2% (higher than 99.68% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 73.2 of 100.","summary":"MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability","date_published":"2025-12-29T00:00:00.000Z","date_modified":"2026-06-17T08:36:38.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2025-12-29","ransomware":false},"epss":{"score":0.83218,"percentile":0.99677},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"MongoDB","product":"MongoDB and MongoDB Server","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-14611#kev","url":"https://patchfirst.co/cve/CVE-2025-14611/","title":"[KEV] CVE-2025-14611: Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability","content_text":"Gladinet · CentreStack and Triofox. In CISA KEV since 2025-12-15. ENISA EUVD lists it as exploited. EPSS 53.3% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.7 of 100.","summary":"Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability","date_published":"2025-12-15T00:00:00.000Z","date_modified":"2026-10-07T20:10:01.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":74.7,"kev":{"dateAdded":"2025-12-15","ransomware":false},"epss":{"score":0.53302,"percentile":0.98983},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Gladinet","product":"CentreStack and Triofox","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-58360#kev","url":"https://patchfirst.co/cve/CVE-2025-58360/","title":"[KEV] CVE-2025-58360: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability","content_text":"OSGeo · GeoServer. In CISA KEV since 2025-12-11. ENISA EUVD lists it as exploited. EPSS 61.2% (higher than 99.16% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.7 of 100.","summary":"OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability","date_published":"2025-12-11T00:00:00.000Z","date_modified":"2026-10-18T20:10:00.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":74.7,"kev":{"dateAdded":"2025-12-11","ransomware":false},"epss":{"score":0.61169,"percentile":0.9916},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"OSGeo","product":"GeoServer","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-11371#kev","url":"https://patchfirst.co/cve/CVE-2025-11371/","title":"[KEV] CVE-2025-11371: Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability","content_text":"Gladinet · CentreStack and Triofox. In CISA KEV since 2025-11-04. ENISA EUVD lists it as exploited. EPSS 92.1% (higher than 99.82% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.2 of 100.","summary":"Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability","date_published":"2025-11-04T00:00:00.000Z","date_modified":"2026-10-08T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2025-11-04","ransomware":false},"epss":{"score":0.92137,"percentile":0.99821},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Gladinet","product":"CentreStack and Triofox","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-61884#kev","url":"https://patchfirst.co/cve/CVE-2025-61884/","title":"[KEV] CVE-2025-61884: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Oracle · E-Business Suite. In CISA KEV since 2025-10-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.9% (higher than 99.87% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.2 of 100.","summary":"Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2025-10-20T00:00:00.000Z","date_modified":"2026-10-08T13:10:00.000Z","tags":["kev","ransomware","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2025-10-20","ransomware":true},"epss":{"score":0.95891,"percentile":0.99873},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Oracle","product":"E-Business Suite","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-43798#kev","url":"https://patchfirst.co/cve/CVE-2021-43798/","title":"[KEV] CVE-2021-43798: Grafana Path Traversal Vulnerability","content_text":"Grafana Labs · Grafana. In CISA KEV since 2025-10-09. ENISA EUVD lists it as exploited. EPSS 88.5% (higher than 99.77% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Grafana Path Traversal Vulnerability","date_published":"2025-10-09T00:00:00.000Z","date_modified":"2026-06-17T04:11:27.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-10-09","ransomware":false},"epss":{"score":0.88503,"percentile":0.99771},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Grafana Labs","product":"Grafana","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-25078#kev","url":"https://patchfirst.co/cve/CVE-2020-25078/","title":"[KEV] CVE-2020-25078: D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability","content_text":"D-Link · DCS-2530L and DCS-2670L Devices. In CISA KEV since 2025-08-05. ENISA EUVD lists it as exploited. EPSS 97.5% (higher than 99.9% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability","date_published":"2025-08-05T00:00:00.000Z","date_modified":"2026-06-17T03:06:20.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-08-05","ransomware":false},"epss":{"score":0.97511,"percentile":0.999},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"D-Link","product":"DCS-2530L and DCS-2670L Devices","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-2776#kev","url":"https://patchfirst.co/cve/CVE-2025-2776/","title":"[KEV] CVE-2025-2776: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability","content_text":"SysAid · SysAid On-Prem. In CISA KEV since 2025-07-22. ENISA EUVD lists it as exploited. EPSS 64.7% (higher than 99.24% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.7 of 100.","summary":"SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability","date_published":"2025-07-22T00:00:00.000Z","date_modified":"2026-06-17T09:07:36.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2025-07-22","ransomware":false},"epss":{"score":0.64726,"percentile":0.99242},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SysAid","product":"SysAid On-Prem","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-2775#kev","url":"https://patchfirst.co/cve/CVE-2025-2775/","title":"[KEV] CVE-2025-2775: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability","content_text":"SysAid · SysAid On-Prem. In CISA KEV since 2025-07-22. ENISA EUVD lists it as exploited. EPSS 42.6% (higher than 98.7% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.0 of 100.","summary":"SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability","date_published":"2025-07-22T00:00:00.000Z","date_modified":"2026-06-17T09:07:36.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2025-07-22","ransomware":false},"epss":{"score":0.42612,"percentile":0.9871},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SysAid","product":"SysAid On-Prem","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-5418#kev","url":"https://patchfirst.co/cve/CVE-2019-5418/","title":"[KEV] CVE-2019-5418: Rails Ruby on Rails Path Traversal Vulnerability","content_text":"Rails · Ruby on Rails. In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Rails Ruby on Rails Path Traversal Vulnerability","date_published":"2025-07-07T00:00:00.000Z","date_modified":"2026-06-17T02:37:39.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-07-07","ransomware":false},"epss":{"score":0.98507,"percentile":0.9992},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Rails","product":"Ruby on Rails","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-48927#kev","url":"https://patchfirst.co/cve/CVE-2025-48927/","title":"[KEV] CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability","content_text":"TeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 11.6% (higher than 96% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 60.9 of 100.","summary":"TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability","date_published":"2025-07-01T00:00:00.000Z","date_modified":"2026-06-17T09:30:29.000Z","tags":["kev","T1212","T1005","T1555"],"_patchfirst":{"reason":"kev","priority":60.9,"kev":{"dateAdded":"2025-07-01","ransomware":false},"epss":{"score":0.11567,"percentile":0.96029},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"TeleMessage","product":"TM SGNL","techniqueIds":["T1212","T1005","T1555"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-48928#kev","url":"https://patchfirst.co/cve/CVE-2025-48928/","title":"[KEV] CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability","content_text":"TeleMessage · TM SGNL. In CISA KEV since 2025-07-01. ENISA EUVD lists it as exploited. EPSS 0.6% (higher than 47.5% of CVEs). CVSS 4.0 MEDIUM. ATT&CK: T1212 Exploitation for Credential Access; T1005 Data from Local System; T1555 Credentials from Password Stores. Priority 50.3 of 100.","summary":"TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability","date_published":"2025-07-01T00:00:00.000Z","date_modified":"2026-06-17T09:30:30.000Z","tags":["kev","T1212","T1005","T1555"],"_patchfirst":{"reason":"kev","priority":50.3,"kev":{"dateAdded":"2025-07-01","ransomware":false},"epss":{"score":0.00577,"percentile":0.47534},"cvss":{"score":4,"severity":"MEDIUM","version":"3.1"},"vendor":"TeleMessage","product":"TM SGNL","techniqueIds":["T1212","T1005","T1555"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-0769#kev","url":"https://patchfirst.co/cve/CVE-2024-0769/","title":"[KEV] CVE-2024-0769: D-Link DIR-859 Router Path Traversal Vulnerability","content_text":"D-Link · DIR-859 Router. In CISA KEV since 2025-06-25. ENISA EUVD lists it as exploited. EPSS 82.7% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.8 of 100.","summary":"D-Link DIR-859 Router Path Traversal Vulnerability","date_published":"2025-06-25T00:00:00.000Z","date_modified":"2026-06-17T06:54:13.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-06-25","ransomware":false},"epss":{"score":0.82714,"percentile":0.99667},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"D-Link","product":"DIR-859 Router","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-43200#kev","url":"https://patchfirst.co/cve/CVE-2025-43200/","title":"[KEV] CVE-2025-43200: Apple Multiple Products Unspecified Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2025-06-16. ENISA EUVD lists it as exploited. EPSS 1.2% (higher than 67.9% of CVEs). CVSS 4.2 MEDIUM. ATT&CK: T1203 Exploitation for Client Execution; T1105 Ingress Tool Transfer; T1005 Data from Local System. Priority 54.5 of 100.","summary":"Apple Multiple Products Unspecified Vulnerability","date_published":"2025-06-16T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","T1203","T1105","T1005"],"_patchfirst":{"reason":"kev","priority":54.5,"kev":{"dateAdded":"2025-06-16","ransomware":false},"epss":{"score":0.01191,"percentile":0.67933},"cvss":{"score":4.2,"severity":"MEDIUM","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1203","T1105","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-38950#kev","url":"https://patchfirst.co/cve/CVE-2023-38950/","title":"[KEV] CVE-2023-38950: ZKTeco BioTime Path Traversal Vulnerability","content_text":"ZKTeco · BioTime. In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 92.5% (higher than 99.83% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"ZKTeco BioTime Path Traversal Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-07-09T13:57:25.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.92468,"percentile":0.99825},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"ZKTeco","product":"BioTime","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-27920#kev","url":"https://patchfirst.co/cve/CVE-2025-27920/","title":"[KEV] CVE-2025-27920: Srimax Output Messenger Directory Traversal Vulnerability","content_text":"Srimax · Output Messenger. In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 79.3% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 60.0 of 100.","summary":"Srimax Output Messenger Directory Traversal Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T09:04:23.000Z","tags":["kev","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":60,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.01865,"percentile":0.79262},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Srimax","product":"Output Messenger","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-47729#kev","url":"https://patchfirst.co/cve/CVE-2025-47729/","title":"[KEV] CVE-2025-47729: TeleMessage TM SGNL Hidden Functionality Vulnerability","content_text":"TeleMessage · TM SGNL. In CISA KEV since 2025-05-12. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 38.9% of CVEs). CVSS 4.9 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 49.2 of 100.","summary":"TeleMessage TM SGNL Hidden Functionality Vulnerability","date_published":"2025-05-12T00:00:00.000Z","date_modified":"2026-06-17T09:28:37.000Z","tags":["kev","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":49.2,"kev":{"dateAdded":"2025-05-12","ransomware":false},"epss":{"score":0.00447,"percentile":0.38852},"cvss":{"score":4.9,"severity":"MEDIUM","version":"3.1"},"vendor":"TeleMessage","product":"TM SGNL","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-38475#kev","url":"https://patchfirst.co/cve/CVE-2024-38475/","title":"[KEV] CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability","content_text":"Apache · HTTP Server. In CISA KEV since 2025-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1528 Steal Application Access Token. Priority 69.4 of 100.","summary":"Apache HTTP Server Improper Escaping of Output Vulnerability","date_published":"2025-05-01T00:00:00.000Z","date_modified":"2026-06-17T07:40:21.000Z","tags":["kev","public-exploit","T1190","T1005","T1059","T1528"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-05-01","ransomware":false},"epss":{"score":0.99957,"percentile":0.99975},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"HTTP Server","techniqueIds":["T1190","T1005","T1059","T1528"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-53150#kev","url":"https://patchfirst.co/cve/CVE-2024-53150/","title":"[KEV] CVE-2024-53150: Linux Kernel Out-of-Bounds Read Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2025-04-09. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 71.6% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1005 Data from Local System; T1011 Exfiltration Over Other Network Medium. Priority 57.3 of 100.","summary":"Linux Kernel Out-of-Bounds Read Vulnerability","date_published":"2025-04-09T00:00:00.000Z","date_modified":"2026-06-17T08:08:25.000Z","tags":["kev","T1005","T1011"],"_patchfirst":{"reason":"kev","priority":57.3,"kev":{"dateAdded":"2025-04-09","ransomware":false},"epss":{"score":0.01354,"percentile":0.71556},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1005","T1011"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-24813#kev","url":"https://patchfirst.co/cve/CVE-2025-24813/","title":"[KEV] CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability","content_text":"Apache · Tomcat. In CISA KEV since 2025-04-01. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Apache Tomcat Path Equivalence Vulnerability","date_published":"2025-04-01T00:00:00.000Z","date_modified":"2026-06-17T08:59:39.000Z","tags":["kev","public-exploit","T1190","T1005","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2025-04-01","ransomware":false},"epss":{"score":0.99942,"percentile":0.99972},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"Tomcat","techniqueIds":["T1190","T1005","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-48248#kev","url":"https://patchfirst.co/cve/CVE-2024-48248/","title":"[KEV] CVE-2024-48248: NAKIVO Backup and Replication Absolute Path Traversal Vulnerability","content_text":"NAKIVO · Backup and Replication. In CISA KEV since 2025-03-19. ENISA EUVD lists it as exploited. EPSS 94.4% (higher than 99.85% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1003 OS Credential Dumping. Priority 69.0 of 100.","summary":"NAKIVO Backup and Replication Absolute Path Traversal Vulnerability","date_published":"2025-03-19T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1005","T1003"],"_patchfirst":{"reason":"kev","priority":69,"kev":{"dateAdded":"2025-03-19","ransomware":false},"epss":{"score":0.94356,"percentile":0.99851},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"NAKIVO","product":"Backup and Replication","techniqueIds":["T1190","T1005","T1003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-24991#kev","url":"https://patchfirst.co/cve/CVE-2025-24991/","title":"[KEV] CVE-2025-24991: Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.9% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1005 Data from Local System. Priority 58.0 of 100.","summary":"Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability","date_published":"2025-03-11T00:00:00.000Z","date_modified":"2026-06-17T08:59:56.000Z","tags":["kev","T1091","T1005"],"_patchfirst":{"reason":"kev","priority":58,"kev":{"dateAdded":"2025-03-11","ransomware":false},"epss":{"score":0.02018,"percentile":0.8091},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1091","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-24984#kev","url":"https://patchfirst.co/cve/CVE-2025-24984/","title":"[KEV] CVE-2025-24984: Microsoft Windows NTFS Information Disclosure Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.7% of CVEs). CVSS 4.6 MEDIUM. ATT&CK: T1200 Hardware Additions; T1005 Data from Local System. Priority 57.4 of 100.","summary":"Microsoft Windows NTFS Information Disclosure Vulnerability","date_published":"2025-03-11T00:00:00.000Z","date_modified":"2026-06-17T08:59:55.000Z","tags":["kev","T1200","T1005"],"_patchfirst":{"reason":"kev","priority":57.4,"kev":{"dateAdded":"2025-03-11","ransomware":false},"epss":{"score":0.01994,"percentile":0.80677},"cvss":{"score":4.6,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1200","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-22226#kev","url":"https://patchfirst.co/cve/CVE-2025-22226/","title":"[KEV] CVE-2025-22226: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability","content_text":"VMware · ESXi, Workstation, and Fusion. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.2% of CVEs). CVSS 6.0 MEDIUM. ATT&CK: T1005 Data from Local System; T1611 Escape to Host. Priority 67.4 of 100.","summary":"VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-06-17T08:45:44.000Z","tags":["kev","T1005","T1611"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2025-03-04","ransomware":false},"epss":{"score":0.01633,"percentile":0.7624},"cvss":{"score":6,"severity":"MEDIUM","version":"3.1"},"vendor":"VMware","product":"ESXi, Workstation, and Fusion","techniqueIds":["T1005","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-50302#kev","url":"https://patchfirst.co/cve/CVE-2024-50302/","title":"[KEV] CVE-2024-50302: Linux Kernel Use of Uninitialized Resource Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 0.8% (higher than 56.9% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1005 Data from Local System; T1011 Exfiltration Over Other Network Medium. Priority 53.2 of 100.","summary":"Linux Kernel Use of Uninitialized Resource Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-10-15T01:19:12.000Z","tags":["kev","T1005","T1011"],"_patchfirst":{"reason":"kev","priority":53.2,"kev":{"dateAdded":"2025-03-04","ransomware":false},"epss":{"score":0.00811,"percentile":0.56898},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1005","T1011"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}}]}