{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1190 Exploit Public-Facing Application","home_page_url":"https://patchfirst.co/technique/T1190/","feed_url":"https://patchfirst.co/feed/technique/T1190.json","description":"New and newly exploited CVEs that lead to ATT&CK T1190 Exploit Public-Facing Application, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-118527#kev","url":"https://patchfirst.co/cve/CVE-2026-118527/","title":"[KEV] CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-30. No EPSS score. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 45.0 of 100.","summary":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-30T00:00:00.000Z","tags":["kev","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":45,"kev":{"dateAdded":"2026-10-30","ransomware":false},"epss":null,"cvss":null,"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-97229#kev","url":"https://patchfirst.co/cve/CVE-2026-97229/","title":"[KEV] CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","content_text":"GitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-10-29. ENISA EUVD lists it as exploited. EPSS 26.6% (higher than 98% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-31T00:16:52.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-10-29","ransomware":false},"epss":{"score":0.26569,"percentile":0.98015},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community Edition and Enterprise Edition","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76418#kev","url":"https://patchfirst.co/cve/CVE-2026-76418/","title":"[KEV] CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…","content_text":"Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software. In CISA KEV since 2026-10-29. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 59.9% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 64.4 of 100.","summary":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T10:36:01.000Z","tags":["kev","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.4,"kev":{"dateAdded":"2026-10-29","ransomware":false},"epss":{"score":0.0091,"percentile":0.59949},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall ASA Software and Cisco Secure FTD Software","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-111497#kev","url":"https://patchfirst.co/cve/CVE-2026-111497/","title":"[KEV] CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability","content_text":"Google · Brotli. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 79.8 of 100.","summary":"Google Brotli Unchecked Return Value Vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-30T20:30:11.000Z","tags":["kev","public-exploit","T1190","T1005","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-10-27","ransomware":false},"epss":{"score":0.82641,"percentile":0.99666},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Google","product":"Brotli","techniqueIds":["T1190","T1005","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-109618#kev","url":"https://patchfirst.co/cve/CVE-2026-109618/","title":"[KEV] CVE-2026-109618: PHP Memory Corruption Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2026-10-26. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"PHP Memory Corruption Vulnerability","date_published":"2026-10-26T00:00:00.000Z","date_modified":"2026-10-30T19:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2026-10-26","ransomware":false},"epss":{"score":0.99999,"percentile":0.99998},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-109619#kev","url":"https://patchfirst.co/cve/CVE-2026-109619/","title":"[KEV] CVE-2026-109619: PHP Stale Internal Request-State Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2026-10-26. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.7 of 100.","summary":"PHP Stale Internal Request-State Vulnerability","date_published":"2026-10-26T00:00:00.000Z","date_modified":"2026-10-30T19:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.7,"kev":{"dateAdded":"2026-10-26","ransomware":false},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-110447#kev","url":"https://patchfirst.co/cve/CVE-2026-110447/","title":"[KEV] CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","content_text":"Collabora · Collabora Online – Built-in CODE Server. In CISA KEV since 2026-10-23. ENISA EUVD lists it as exploited. EPSS 73.3% (higher than 99.46% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 89.4 of 100.","summary":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","date_published":"2026-10-23T00:00:00.000Z","date_modified":"2026-10-30T16:32:46.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":89.4,"kev":{"dateAdded":"2026-10-23","ransomware":false},"epss":{"score":0.73307,"percentile":0.9946},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-114625#kev","url":"https://patchfirst.co/cve/CVE-2026-114625/","title":"[KEV] CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability","content_text":"Arista · VeloCloud Orchestrator. In CISA KEV since 2026-10-23. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.5% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application. Priority 72.5 of 100.","summary":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","date_published":"2026-10-23T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1078","T1068","T1190"],"_patchfirst":{"reason":"kev","priority":72.5,"kev":{"dateAdded":"2026-10-23","ransomware":false},"epss":{"score":0.01025,"percentile":0.63541},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Arista","product":"VeloCloud Orchestrator","techniqueIds":["T1078","T1068","T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96652#kev","url":"https://patchfirst.co/cve/CVE-2026-96652/","title":"[KEV] CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.7% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 71.2 of 100.","summary":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:44.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":71.2,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01821,"percentile":0.78731},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96654#kev","url":"https://patchfirst.co/cve/CVE-2026-96654/","title":"[KEV] CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 80.2% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.0 of 100.","summary":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:37.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01949,"percentile":0.80195},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-96655#kev","url":"https://patchfirst.co/cve/CVE-2026-96655/","title":"[KEV] CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.3% of CVEs). CVSS 4.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 65.7 of 100.","summary":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:29.000Z","tags":["kev","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":65.7,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01637,"percentile":0.7631},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-102764#kev","url":"https://patchfirst.co/cve/CVE-2026-102764/","title":"[KEV] CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","content_text":"BeyondTrust · Remote Support. In CISA KEV since 2026-10-16. ENISA EUVD lists it as exploited. EPSS 18.9% (higher than 97.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.3 of 100.","summary":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","date_published":"2026-10-16T00:00:00.000Z","date_modified":"2026-10-17T04:16:47.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-10-16","ransomware":false},"epss":{"score":0.1895,"percentile":0.97297},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"BeyondTrust","product":"Remote Support","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-21589#kev","url":"https://patchfirst.co/cve/CVE-2026-21589/","title":"[KEV] CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","content_text":"Atlassian · Multiple Products. In CISA KEV since 2026-10-15. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.2 of 100.","summary":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","date_published":"2026-10-15T00:00:00.000Z","date_modified":"2026-10-29T13:17:09.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2026-10-15","ransomware":false},"epss":{"score":0.99477,"percentile":0.99943},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Atlassian","product":"Multiple Products","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-105134#kev","url":"https://patchfirst.co/cve/CVE-2026-105134/","title":"[KEV] CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability","content_text":"Ahsay · AhsayCBS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 81.8% (higher than 99.64% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"Ahsay AhsayCBS Command Injection Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-26T18:06:57.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.81763,"percentile":0.99644},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ahsay","product":"AhsayCBS","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-105133#kev","url":"https://patchfirst.co/cve/CVE-2026-105133/","title":"[KEV] CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability","content_text":"Ahsay · AhsayCBS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 79.5% (higher than 99.6% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.0 of 100.","summary":"Ahsay AhsayCBS Improper Authentication Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-26T18:07:09.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":78,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.7947,"percentile":0.99602},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"Ahsay","product":"AhsayCBS","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76519#kev","url":"https://patchfirst.co/cve/CVE-2026-76519/","title":"[KEV] CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability","content_text":"Cisco · Secure Email Gateway. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 2.2% (higher than 82.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 76.3 of 100.","summary":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-15T13:47:19.000Z","tags":["kev","public-exploit","T1190","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":76.3,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.02152,"percentile":0.82127},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Secure Email Gateway","techniqueIds":["T1190","T1059","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-104935#kev","url":"https://patchfirst.co/cve/CVE-2026-104935/","title":"[KEV] CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-13. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.0 of 100.","summary":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-13T19:24:36.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79,"kev":{"dateAdded":"2026-10-13","ransomware":false},"epss":{"score":0.86766,"percentile":0.99742},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-3306#kev","url":"https://patchfirst.co/cve/CVE-2015-3306/","title":"[KEV] CVE-2015-3306: ProFTPD Improper Access Control Vulnerability","content_text":"ProFTPD · ProFTPD. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.","summary":"ProFTPD Improper Access Control Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T16:17:18.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.99497,"percentile":0.99945},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"ProFTPD","product":"ProFTPD","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-3199#kev","url":"https://patchfirst.co/cve/CVE-2021-3199/","title":"[KEV] CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability","content_text":"ONLYOFFICE · Docs. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 30.2% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"ONLYOFFICE Docs Server Path Traversal Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:20:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.30244,"percentile":0.98219},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ONLYOFFICE","product":"Docs","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-3081#kev","url":"https://patchfirst.co/cve/CVE-2016-3081/","title":"[KEV] CVE-2016-3081: Apache Struts Command Injection Vulnerability","content_text":"Apache · Struts. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 96.5% (higher than 99.88% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.","summary":"Apache Struts Command Injection Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:43:05.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.6,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.96525,"percentile":0.99882},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Struts","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-5477#kev","url":"https://patchfirst.co/cve/CVE-2015-5477/","title":"[KEV] CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability","content_text":"ISC · BIND. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 68.2 of 100.","summary":"ISC BIND Data Processing Errors Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T19:12:37.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.99584,"percentile":0.99947},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"ISC","product":"BIND","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88779#kev","url":"https://patchfirst.co/cve/CVE-2026-88779/","title":"[KEV] CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-10-04. ENISA EUVD lists it as exploited. EPSS 11.4% (higher than 96% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application. Priority 72.4 of 100.","summary":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","date_published":"2026-10-04T00:00:00.000Z","date_modified":"2026-10-05T13:35:24.000Z","tags":["kev","T1190"],"_patchfirst":{"reason":"kev","priority":72.4,"kev":{"dateAdded":"2026-10-04","ransomware":false},"epss":{"score":0.11388,"percentile":0.95988},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-102489#kev","url":"https://patchfirst.co/cve/CVE-2026-102489/","title":"[KEV] CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability","content_text":"Zammad GmbH · Zammad. In CISA KEV since 2026-10-02. ENISA EUVD lists it as exploited. EPSS 22.5% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"Zammad GmbH Zammad Session Fixation Vulnerability","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-10T04:18:08.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.4,"kev":{"dateAdded":"2026-10-02","ransomware":false},"epss":{"score":0.22478,"percentile":0.97703},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zammad GmbH","product":"Zammad","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-104286#kev","url":"https://patchfirst.co/cve/CVE-2026-104286/","title":"[KEV] CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability","content_text":"Fortinet · FortiMail. In CISA KEV since 2026-10-01. ENISA EUVD lists it as exploited. EPSS 4.6% (higher than 91.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 78.2 of 100.","summary":"Fortinet FortiMail Path Traversal Vulnerability","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-28T20:09:29.000Z","tags":["kev","public-exploit","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2026-10-01","ransomware":false},"epss":{"score":0.04573,"percentile":0.91609},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiMail","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76504#kev","url":"https://patchfirst.co/cve/CVE-2026-76504/","title":"[KEV] CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","content_text":"Cisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-09-30. ENISA EUVD lists it as exploited. EPSS 38.9% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.6 of 100.","summary":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","date_published":"2026-09-30T00:00:00.000Z","date_modified":"2026-10-03T00:16:39.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.6,"kev":{"dateAdded":"2026-09-30","ransomware":false},"epss":{"score":0.38928,"percentile":0.98587},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Manager","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88771#kev","url":"https://patchfirst.co/cve/CVE-2026-88771/","title":"[KEV] CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 82.2% (higher than 99.66% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Citrix NetScaler Improper Input Validation Vulnerability","date_published":"2026-09-27T00:00:00.000Z","date_modified":"2026-09-29T04:18:01.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-09-27","ransomware":false},"epss":{"score":0.8216,"percentile":0.99655},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88772#kev","url":"https://patchfirst.co/cve/CVE-2026-88772/","title":"[KEV] CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 78.2% (higher than 99.58% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.","summary":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","date_published":"2026-09-27T00:00:00.000Z","date_modified":"2026-09-28T12:26:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-27","ransomware":false},"epss":{"score":0.78162,"percentile":0.99577},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-87902#kev","url":"https://patchfirst.co/cve/CVE-2026-87902/","title":"[KEV] CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability","content_text":"WordPress · Core. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 95.8% (higher than 99.87% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.","summary":"WordPress Core Remote File Inclusion Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-28T12:20:54.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.95769,"percentile":0.99872},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"WordPress","product":"Core","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-65660#kev","url":"https://patchfirst.co/cve/CVE-2026-65660/","title":"[KEV] CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 8.2% (higher than 94.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.1 of 100.","summary":"Microsoft SharePoint Code Injection Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.1,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.08189,"percentile":0.94862},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67279#kev","url":"https://patchfirst.co/cve/CVE-2026-67279/","title":"[KEV] CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.1% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1565.001 Stored Data Manipulation. Priority 74.2 of 100.","summary":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-26T04:17:47.000Z","tags":["kev","public-exploit","T1190","T1059","T1565.001"],"_patchfirst":{"reason":"kev","priority":74.2,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.02277,"percentile":0.83093},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1059","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-5430#kev","url":"https://patchfirst.co/cve/CVE-2026-5430/","title":"[KEV] CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability","content_text":"WSO2 · Multiple Products. In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 22.4% (higher than 97.7% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1550 Use Alternate Authentication Material. Priority 79.5 of 100.","summary":"WSO2 Multiple Products Path Traversal Vulnerability","date_published":"2026-09-24T00:00:00.000Z","date_modified":"2026-09-25T12:53:05.000Z","tags":["kev","public-exploit","T1190","T1078","T1550"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-09-24","ransomware":false},"epss":{"score":0.2239,"percentile":0.97691},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"WSO2","product":"Multiple Products","techniqueIds":["T1190","T1078","T1550"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-71362#kev","url":"https://patchfirst.co/cve/CVE-2026-71362/","title":"[KEV] CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability","content_text":"Adobe · Commerce and Magento . In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 90.5% (higher than 99.8% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 79.3 of 100.","summary":"Adobe Commerce and Magento Incorrect Authorization Vulnerability","date_published":"2026-09-24T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-09-24","ransomware":false},"epss":{"score":0.90491,"percentile":0.99801},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento ","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-93616#kev","url":"https://patchfirst.co/cve/CVE-2026-93616/","title":"[KEV] CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability","content_text":"Check Point · Multiple Products. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 91.6% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Check Point Multiple Products Path Traversal Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T16:38:38.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.91605,"percentile":0.99813},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"Multiple Products","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-85102#kev","url":"https://patchfirst.co/cve/CVE-2026-85102/","title":"[KEV] CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability","content_text":"Check Point · Multiple Products. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 54.1% (higher than 99.01% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.7 of 100.","summary":"Check Point Multiple Products Improper Certificate Validation Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T18:22:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.7,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.5414,"percentile":0.99006},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"Multiple Products","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-94127#kev","url":"https://patchfirst.co/cve/CVE-2026-94127/","title":"[KEV] CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","content_text":"F5 · BIG-IP APM. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 24.9% (higher than 97.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T14:32:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.4,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.24938,"percentile":0.97912},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP APM","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-93952#kev","url":"https://patchfirst.co/cve/CVE-2026-93952/","title":"[KEV] CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","content_text":"Arista · VeloCloud Orchestrator. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 1.4% (higher than 72.2% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 69.4 of 100.","summary":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T14:32:12.000Z","tags":["kev","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.01384,"percentile":0.72172},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Arista","product":"VeloCloud Orchestrator","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-7273#kev","url":"https://patchfirst.co/cve/CVE-2026-7273/","title":"[KEV] CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","content_text":"Zyxel · GS1900 Series Switches. In CISA KEV since 2026-09-21. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 76.4 of 100.","summary":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","date_published":"2026-09-21T00:00:00.000Z","date_modified":"2026-10-25T23:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":76.4,"kev":{"dateAdded":"2026-09-21","ransomware":false},"epss":{"score":0.02778,"percentile":0.86351},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"GS1900 Series Switches","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-39682#kev","url":"https://patchfirst.co/cve/CVE-2025-39682/","title":"[KEV] CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability","content_text":"Linux · Kernel. In CISA KEV since 2026-09-18. ENISA EUVD lists it as exploited. EPSS 3.3% (higher than 88.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Priority 77.5 of 100.","summary":"Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability","date_published":"2026-09-18T00:00:00.000Z","date_modified":"2026-10-19T21:10:00.000Z","tags":["kev","public-exploit","T1190"],"_patchfirst":{"reason":"kev","priority":77.5,"kev":{"dateAdded":"2026-09-18","ransomware":false},"epss":{"score":0.03252,"percentile":0.88326},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Linux","product":"Kernel","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76460#kev","url":"https://patchfirst.co/cve/CVE-2026-76460/","title":"[KEV] CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","content_text":"Cisco · Identity Services Engine. In CISA KEV since 2026-09-16. ENISA EUVD lists it as exploited. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.9 of 100.","summary":"Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","date_published":"2026-09-16T00:00:00.000Z","date_modified":"2026-10-07T19:17:40.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2026-09-16","ransomware":false},"epss":{"score":0.75599,"percentile":0.99519},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Identity Services Engine","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76461#kev","url":"https://patchfirst.co/cve/CVE-2026-76461/","title":"[KEV] CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability","content_text":"Cisco · Secure Email Gateway. In CISA KEV since 2026-09-14. ENISA EUVD lists it as exploited. EPSS 29.5% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"Cisco Secure Email Gateway SQL Injection Vulnerability","date_published":"2026-09-14T00:00:00.000Z","date_modified":"2026-09-15T12:47:32.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-09-14","ransomware":false},"epss":{"score":0.29543,"percentile":0.98185},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Secure Email Gateway","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-85706","url":"https://patchfirst.co/cve/CVE-2026-85706/","title":"CVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","content_text":"GitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 97.4% (higher than 99.9% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.","summary":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","date_published":"2026-09-12T00:00:00.000Z","date_modified":"2026-09-24T12:52:28.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"published","priority":80,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.97355,"percentile":0.99898},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community Edition and Enterprise Edition","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-42018#kev","url":"https://patchfirst.co/cve/CVE-2026-42018/","title":"[KEV] CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability","content_text":"JFrog · Artifactory. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 9.8% (higher than 95.5% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1528 Steal Application Access Token. Priority 77.4 of 100.","summary":"JFrog Artifactory Improper Authentication Vulnerability","date_published":"2026-09-11T00:00:00.000Z","date_modified":"2026-10-23T19:10:00.000Z","tags":["kev","public-exploit","T1190","T1528"],"_patchfirst":{"reason":"kev","priority":77.4,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.09805,"percentile":0.9554},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"JFrog","product":"Artifactory","techniqueIds":["T1190","T1528"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-86060#kev","url":"https://patchfirst.co/cve/CVE-2026-86060/","title":"[KEV] CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-10. ENISA EUVD lists it as exploited. EPSS 6.4% (higher than 93.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 78.6 of 100.","summary":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","date_published":"2026-09-10T00:00:00.000Z","date_modified":"2026-09-11T12:52:16.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-10","ransomware":false},"epss":{"score":0.06392,"percentile":0.93659},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67277#kev","url":"https://patchfirst.co/cve/CVE-2026-67277/","title":"[KEV] CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-10. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1499.004 Application or System Exploitation. Priority 73.8 of 100.","summary":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","date_published":"2026-09-10T00:00:00.000Z","date_modified":"2026-09-11T12:52:29.000Z","tags":["kev","public-exploit","T1190","T1005","T1499.004"],"_patchfirst":{"reason":"kev","priority":73.8,"kev":{"dateAdded":"2026-09-10","ransomware":false},"epss":{"score":0.0156,"percentile":0.75209},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1005","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20079#kev","url":"https://patchfirst.co/cve/CVE-2026-20079/","title":"[KEV] CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability","content_text":"Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management. In CISA KEV since 2026-09-09. ENISA EUVD lists it as exploited. EPSS 88.7% (higher than 99.77% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 83.8 of 100.","summary":"Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability","date_published":"2026-09-09T00:00:00.000Z","date_modified":"2026-09-16T17:17:16.000Z","tags":["kev","public-exploit","T1190"],"_patchfirst":{"reason":"kev","priority":83.8,"kev":{"dateAdded":"2026-09-09","ransomware":false},"epss":{"score":0.88658,"percentile":0.99774},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","techniqueIds":["T1190"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-25249#kev","url":"https://patchfirst.co/cve/CVE-2025-25249/","title":"[KEV] CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2026-09-09. ENISA EUVD lists it as exploited. EPSS 3.7% (higher than 89.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 77.8 of 100.","summary":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","date_published":"2026-09-09T00:00:00.000Z","date_modified":"2026-10-07T18:17:13.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":77.8,"kev":{"dateAdded":"2026-09-09","ransomware":false},"epss":{"score":0.03742,"percentile":0.89842},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-86218#kev","url":"https://patchfirst.co/cve/CVE-2026-86218/","title":"[KEV] CVE-2026-86218: N-able N-central Static Code Injection Vulnerability","content_text":"N-able · N-central. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 15.4% (higher than 96.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.2 of 100.","summary":"N-able N-central Static Code Injection Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-09T05:18:19.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.2,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.15385,"percentile":0.96781},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"N-able","product":"N-central","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-75650#kev","url":"https://patchfirst.co/cve/CVE-2026-75650/","title":"[KEV] CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","content_text":"Adobe · Commerce and Magento. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 3.9% (higher than 90.4% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.1 of 100.","summary":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-09T05:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.1,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.03949,"percentile":0.90401},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-48710#kev","url":"https://patchfirst.co/cve/CVE-2026-48710/","title":"[KEV] CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability","content_text":"Kludex · Starlette. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 70.3% (higher than 99.38% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Priority 82.4 of 100.","summary":"Kludex Starlette HTTP Request/Response Smuggling Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-10-01T18:17:18.000Z","tags":["kev","public-exploit","T1190"],"_patchfirst":{"reason":"kev","priority":82.4,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.70288,"percentile":0.99382},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Kludex","product":"Starlette","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-9586#kev","url":"https://patchfirst.co/cve/CVE-2026-9586/","title":"[KEV] CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability","content_text":"Sangoma · Switchvox. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 19.0% (higher than 97.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.3 of 100.","summary":"Sangoma Switchvox SQL Injection Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-10-24T20:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.18979,"percentile":0.97299},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sangoma","product":"Switchvox","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}