{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: TrueConf vulnerabilities","home_page_url":"https://patchfirst.co/vendor/trueconf/","feed_url":"https://patchfirst.co/feed/vendor/trueconf.json","description":"New and newly exploited TrueConf CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-72530#kev","url":"https://patchfirst.co/cve/CVE-2026-72530/","title":"[KEV] CVE-2026-72530: TrueConf Server Code Injection Vulnerability","content_text":"TrueConf · Server. In CISA KEV since 2026-08-20. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.7 of 100.","summary":"TrueConf Server Code Injection Vulnerability","date_published":"2026-08-20T00:00:00.000Z","date_modified":"2026-08-21T04:18:15.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.7,"kev":{"dateAdded":"2026-08-20","ransomware":false},"epss":{"score":0.01686,"percentile":0.76994},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"TrueConf","product":"Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-72529#kev","url":"https://patchfirst.co/cve/CVE-2026-72529/","title":"[KEV] CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability","content_text":"TrueConf · Server. In CISA KEV since 2026-08-20. ENISA EUVD lists it as exploited. EPSS 1.5% (higher than 73.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.6 of 100.","summary":"TrueConf Server Missing Authentication for Critical Function Vulnerability","date_published":"2026-08-20T00:00:00.000Z","date_modified":"2026-08-21T04:18:15.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.6,"kev":{"dateAdded":"2026-08-20","ransomware":false},"epss":{"score":0.01464,"percentile":0.73617},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"TrueConf","product":"Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-3502#kev","url":"https://patchfirst.co/cve/CVE-2026-3502/","title":"[KEV] CVE-2026-3502: TrueConf Client Download of Code Without Integrity Check Vulnerability","content_text":"TrueConf · Client. In CISA KEV since 2026-04-02. ENISA EUVD lists it as exploited. EPSS 5.8% (higher than 93.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1557 Adversary-in-the-Middle; T1059 Command and Scripting Interpreter. Priority 72.1 of 100.","summary":"TrueConf Client Download of Code Without Integrity Check Vulnerability","date_published":"2026-04-02T00:00:00.000Z","date_modified":"2026-06-17T10:43:41.000Z","tags":["kev","public-exploit","T1557","T1059"],"_patchfirst":{"reason":"kev","priority":72.1,"kev":{"dateAdded":"2026-04-02","ransomware":false},"epss":{"score":0.05845,"percentile":0.93164},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"TrueConf","product":"Client","techniqueIds":["T1557","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}