Exploited vulnerabilities (CISA KEV)

CVE-2026-82329 Critical · 9.8 KEV Urgent · 72 Public exploit CWE-287 Aug 28, 2026

JFrog Artifactory Improper Authentication Vulnerability

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

CVE-2026-82078 Critical · 9.1 KEV Urgent · 72 Public exploit CWE-470 Aug 28, 2026

PaperCut NG/MF Unsafe Reflection Vulnerability

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

CVE-2026-81578 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-305 Aug 28, 2026

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

CVE-2026-60004 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-94 Aug 26, 2026

Gitea Code Injection Vulnerability

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

CVE-2026-72530 Critical · 9.0 KEV High · 63 Public exploit CWE-94 Aug 19, 2026

TrueConf Server Code Injection Vulnerability

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

CVE-2026-72529 Critical · 9.8 KEV High · 59 CWE-306 Aug 19, 2026

TrueConf Server Missing Authentication for Critical Function Vulnerability

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

CVE-2026-19490 Critical · 9.8 KEV High · 69 Public exploit CWE-288 Aug 19, 2026

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

CVE-2026-64849 Critical · 9.3 KEV Urgent · 72 Public exploit CWE-918 Aug 17, 2026

MLflow Server-Side Request Forgery Vulnerability

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

CVE-2026-73570 High · 8.9 KEV High · 66 Public exploit CWE-78 Aug 13, 2026

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

CVE-2026-42018 High · 7.5 KEV High · 62 Public exploit CWE-287 Aug 12, 2026

JFrog Artifactory Improper Authentication Vulnerability

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

CVE-2026-66384 Medium · 5.3 KEV High · 52 Public exploit CWE-22 Aug 12, 2026

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

CVE-2026-71362 Critical · 9.1 KEV Urgent · 73 Public exploit CWE-863 Aug 11, 2026

Adobe Commerce and Magento Incorrect Authorization Vulnerability

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

CVE-2026-68820 High · 7.0 KEV High · 51 Public exploit CWE-416 Aug 11, 2026

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-65660 High · 8.8 KEV High · 61 Public exploit CWE-94 Aug 11, 2026

Microsoft SharePoint Code Injection Vulnerability

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-20349 High · 8.6 KEV High · 53 CWE-244 Aug 11, 2026

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

CVE-2026-72898 Critical · 10.0 KEV Urgent · 73 Public exploit CWE-89 Aug 10, 2026

Metabase SQL Injection Vulnerability

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVE-2026-65400 Critical · 9.8 KEV High · 66 Public exploit CWE-287 Aug 6, 2026

Apple macOS Improper Authentication Vulnerability

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

CVE-2026-5430 Critical · 10.0 KEV High · 69 Public exploit CWE-347 Aug 6, 2026

WSO2 Multiple Products Path Traversal Vulnerability

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

CVE-2026-18577 High · 8.1 KEV High · 68 Public exploit CWE-288 Aug 2, 2026

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

CVE-2026-18556 High · 7.4 KEV High · 64 Public exploit CWE-288 Aug 1, 2026

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.