Home / CVEs
Exploited vulnerabilities (CISA KEV)
CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.
CVE-2026-72530
Critical · 9.0
KEV High · 63 Public exploit CWE-94 Aug 19, 2026
TrueConf Server Code Injection Vulnerability
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
CVE-2026-72529
Critical · 9.8
KEV High · 59 CWE-306 Aug 19, 2026
TrueConf Server Missing Authentication for Critical Function Vulnerability
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
CVE-2026-3502
High · 7.8
KEV High · 51 Public exploit CWE-494 Mar 30, 2026
TrueConf Client Download of Code Without Integrity Check Vulnerability
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.