Weekly report — week 2026-38

Added to CISA KEV (confirmed exploitation)

• CVE-2025-39682Critical · 9.8KEVLinux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilitySep 18, 2026
• CVE-2026-53266High · 8.8KEVLinux Kernel Out-of-Bounds Write VulnerabilitySep 18, 2026
• CVE-2025-39964Medium · 5.5KEVLinux Kernel Race Condition VulnerabilitySep 18, 2026
• CVE-2026-76460Critical · 10.0KEVPublic exploitCisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilitySep 16, 2026
• CVE-2026-58704High · 8.8KEVGoogle Pixel Improper Authorization VulnerabilitySep 16, 2026
• CVE-2026-87886High · 7.8KEVAcronis Backup Incorrect Default Permissions VulnerabilitySep 16, 2026
• CVE-2026-76461Critical · 9.8KEVPublic exploitCisco Secure Email Gateway SQL Injection VulnerabilitySep 14, 2026

Critical CVEs published (KEV and highest EPSS first)

• CVE-2026-76461Critical · 9.8KEVPublic exploitCisco Secure Email Gateway SQL Injection VulnerabilityEPSS 29.5%
• CVE-2026-76460Critical · 10.0KEVPublic exploitCisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityEPSS 14%
• CVE-2026-81657Critical · 9.8IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.8%
• CVE-2026-75885Critical · 9.3Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpointEPSS 0.8%
• CVE-2025-59953Critical · 9.8LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeployEPSS 0.8%
• CVE-2026-82967Critical · 9.8IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.8%
• CVE-2026-82340Critical · 9.8IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.7%
• CVE-2025-66455Critical · 9.8LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.pyEPSS 0.7%
• CVE-2026-84082Critical · 9.8IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.7%
• CVE-2025-53837Critical · 9.9org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issueEPSS 0.6%
• CVE-2026-84064Critical · 9.9IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%
• CVE-2026-84031Critical · 9.0IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%
• CVE-2026-82832Critical · 9.6IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%
• CVE-2026-84075Critical · 9.9IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%
• CVE-2026-80441Critical · 9.8IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%
• CVE-2026-83452Critical · 9.8Vulnerability in the Oracle Document Management and Collaboration product of Oracle…EPSS 0.5%
• CVE-2026-83462Critical · 9.8Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite…EPSS 0.5%
• CVE-2025-43936Critical · 9.1Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication...EPSS 0.5%
• CVE-2026-84078Critical · 9.9IBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.5%
• CVE-2026-67100Critical · 9.8HCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.5%

Biggest EPSS increases (30-day exploitation probability)

Nothing this week.

New public exploits and templates

Nothing this week.