{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1056 Input Capture","home_page_url":"https://patchfirst.co/technique/T1056/","feed_url":"https://patchfirst.co/feed/technique/T1056.json","description":"New and newly exploited CVEs that lead to ATT&CK T1056 Input Capture, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-48700#kev","url":"https://patchfirst.co/cve/CVE-2025-48700/","title":"[KEV] CVE-2025-48700: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.4% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1059.007 JavaScript. Priority 62.7 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-06-17T09:30:11.000Z","tags":["kev","T1566.002","T1056","T1059.007"],"_patchfirst":{"reason":"kev","priority":62.7,"kev":{"dateAdded":"2026-04-20","ransomware":false},"epss":{"score":0.01713,"percentile":0.77356},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1566.002","T1056","T1059.007"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-42009#kev","url":"https://patchfirst.co/cve/CVE-2024-42009/","title":"[KEV] CVE-2024-42009: RoundCube Webmail Cross-Site Scripting Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2025-06-09. ENISA EUVD lists it as exploited. EPSS 82.9% (higher than 99.67% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1114 Email Collection. Priority 69.4 of 100.","summary":"RoundCube Webmail Cross-Site Scripting Vulnerability","date_published":"2025-06-09T00:00:00.000Z","date_modified":"2026-06-17T07:48:37.000Z","tags":["kev","public-exploit","T1566.002","T1056","T1114"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-06-09","ransomware":false},"epss":{"score":0.82882,"percentile":0.99671},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1566.002","T1056","T1114"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8195#kev","url":"https://patchfirst.co/cve/CVE-2020-8195/","title":"[KEV] CVE-2020-8195: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 33.0% (higher than 98.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1005 Data from Local System; T1082 System Information Discovery. Priority 77.2 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:01.000Z","tags":["kev","public-exploit","T1056","T1005","T1082"],"_patchfirst":{"reason":"kev","priority":77.2,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.33029,"percentile":0.98359},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1056","T1005","T1082"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8196#kev","url":"https://patchfirst.co/cve/CVE-2020-8196/","title":"[KEV] CVE-2020-8196: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 26.3% (higher than 98% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1082 System Information Discovery; T1005 Data from Local System. Priority 75.6 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:02.000Z","tags":["kev","public-exploit","T1056","T1082","T1005"],"_patchfirst":{"reason":"kev","priority":75.6,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.26333,"percentile":0.98003},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1056","T1082","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}