cyfenced.com →

[ Vulnerability watch · 22 Oct 2026 ]

Vulnerabilities that matter, today.

Every new CVE from the NVD, joined with what CISA, NCSC-NL, NCSC-UK, CERT-EU, CERT-FR and BSI say about it. The ones being exploited, or likely to be, come first. Where a fix or interim patch is known, we link it.

Updated · 16,702 CVEs in the last 30 days

[ PERIMETER · MONITORED ] 24/7
493New CVEs in the last 24 hours 37Added to CISA's exploited list in 30 days 337Critical (CVSS 9+) in the last 7 days 176Agency advisories in the last 7 days

[ Matters most ]

Act on these first.

Exploited in the wild, likely to be exploited, or flagged as urgent by a national CERT, with activity in the last 30 days. How we rank

All 30 priority CVEs →
01CVE-2026-88771

Unauthenticated command execution in NetScaler ADC and Gateway

An input validation flaw in Citrix NetScaler ADC and NetScaler Gateway lets an attacker run commands on the appliance without logging in. Versions…

Flagged by CERT-EU · CERT-FR · NCSC-NL · BSI CERT-Bund ExploitedCVSS 9.8 Fix available 02CVE-2026-88772

Memory flaw in NetScaler ADC and Gateway allows remote code execution

A memory buffer flaw in Citrix NetScaler ADC and NetScaler Gateway can lead to remote code execution or a denial of service. It affects the same…

Flagged by CERT-EU · CERT-FR · NCSC-NL · BSI CERT-Bund ExploitedCVSS 8.1 Fix available 03CVE-2026-76519

Crafted email attachment gives root on Cisco Secure Email Gateway

A path traversal flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway lets an attacker write files and run commands as root…

Flagged by CERT-EU · CERT-FR · NCSC-NL · BSI CERT-Bund ExploitedCVSS 9.8 Fix available
  1. 04 Ivanti Connect Secure authentication bypass allows remote commandsCVE-2026-104935 · CERT-FR · NCSC-NL · BSI CERT-Bund ExploitedCVSS 8.6 EPSS 26%Fix
  2. 05 Unauthenticated file read in Atlassian Data Center productsCVE-2026-21589 · CERT-EU · CERT-FR · NCSC-NL · BSI CERT-Bund ExploitedCVSS 7.5 EPSS 13%Fix
  3. 06 Authentication bypass in BeyondTrust Remote SupportCVE-2026-102764 · NCSC-NL · BSI CERT-Bund ExploitedCVSS 9.8
  4. 07 ProFTPD mod_copy lets anyone copy files on the serverCVE-2015-3306 ExploitedCVSS 10.0 EPSS 99%
  5. 08 Session hijack leads to code execution in ZammadCVE-2026-102489 · NCSC-NL · BSI CERT-Bund ExploitedCVSS 9.8
  6. 09 Privilege escalation in Adobe Commerce and MagentoCVE-2026-71362 ExploitedCVSS 9.1 EPSS 88%
  7. 10 Command injection in AhsayCBS backup serverCVE-2026-105134 · NCSC-NL ExploitedCVSS 10.0 EPSS 38%
  8. 11 Out-of-memory handling flaw in PHP can lead to remote code executionCVE-2026-109618 · CERT-EU · CERT-FR · NCSC-NL · NCSC-UK · BSI CERT-Bund CVSS 9.8 Fix
  9. 12 Exploited denial of service flaw in NetScaler ADC and GatewayCVE-2026-88779 · CERT-FR · NCSC-NL · BSI CERT-Bund ExploitedCVSS 7.5 Fix

[ Latest ]

Newly published.

The most recent CVEs, newest first. A green bar on the left means it is on the priority list.

All 16,702 recent CVEs →
CVEPublishedSeverityVulnerabilitySignals
CVE-2026-92450 22 Oct 2026 CVSS 7.5 Kiloview E3 FirmwareThe authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as…
CVE-2026-110243 22 Oct 2026 CVSS 9.9 Kiloview E3 FirmwareThe network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link…
CVE-2026-110491 22 Oct 2026 CVSS 7.5 Kiloview E3 FirmwareThe ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service…
CVE-2026-110825 22 Oct 2026 CVSS 7.5 Kiloview E3 FirmwareThe ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring…
CVE-2026-107861 22 Oct 2026 CVSS 9.9 Kiloview E3 FirmwareThe system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming…
CVE-2026-97785 22 Oct 2026 CVSS 10.0 Microsoft Entra application proxyImproper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-96616 22 Oct 2026 CVSS 6.5 Kiloview E3 FirmwareAuthentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime…
CVE-2026-96185 22 Oct 2026 CVSS 7.5 Microsoft Exchange OnlineStack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
CVE-2026-83938 22 Oct 2026 CVSS 10.0 Microsoft Azure Kubernetes Configuration ServiceMissing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a…
CVE-2026-115221 22 Oct 2026 CVSS 5.4 Red Hat Enterprise Linux 10A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to…
CVE-2026-115424 22 Oct 2026 CVSS 5.5 Red Hat OpenShift Container Platform 4A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize…
CVE-2026-115449 22 Oct 2026 CVSS 3.5 Red Hat Enterprise Linux 10A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host…

[ Advisories ]

What national CERTs are saying.

The latest advisories and alerts from European and UK government security teams, linked to the CVEs they cover.

All advisories →