Relatório semanal — semana 2026-41

Incluídas na CISA KEV (exploração confirmada)

• CVE-2015-3306Crítica · 10.0KEVExploit públicoProFTPD Improper Access Control Vulnerability08/10/2026
• CVE-2021-3199Crítica · 9.8KEVONLYOFFICE Docs Server Path Traversal Vulnerability08/10/2026
• CVE-2015-5477Alta · 7.5KEVExploit públicoISC BIND Data Processing Errors Vulnerability08/10/2026
• CVE-2016-3081Alta · 8.1KEVExploit públicoApache Struts Command Injection Vulnerability08/10/2026
• CVE-2023-22894Média · 4.9KEVStrapi Cleartext Storage of Sensitive Information Vulnerability08/10/2026

CVEs críticas publicadas (KEV e maior EPSS primeiro)

• CVE-2026-105110Crítica · 9.8Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI ParameterEPSS 2.8%
• CVE-2026-21589Crítica · 9.3Exploit públicoh3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira...EPSS 2.8%
• CVE-2026-93674Crítica · 9.8Exploit públicoLangflow OSS is affected by multiple vulnerabilitiesEPSS 2.7%
• CVE-2026-108576Crítica · 10.0TOZED X300 IPPingDiagnostics process_ping os command injectionEPSS 2.5%
• CVE-2026-105484Crítica · 10.0TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injectionEPSS 2.1%
• CVE-2026-107780Crítica · 9.8Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format ParameterEPSS 2.1%
• CVE-2026-91140Crítica · 9.6OS command injection in Progress Software Autonomous REST Connector GenAI AgentsEPSS 1.9%
• CVE-2026-106126Crítica · 9.9Command InjectionEPSS 1.9%
• CVE-2026-107703Crítica · 9.8@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertToEPSS 1.8%
• CVE-2026-108540Crítica · 9.9OpenSpug File Transfer transfer os command injectionEPSS 1.7%
• CVE-2026-107704Crítica · 9.8image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_formatEPSS 1.7%
• CVE-2026-107699Crítica · 9.8ppt2png through 0.0.6 OS Command Injection via input and output pathsEPSS 1.5%
• CVE-2026-107459Crítica · 9.8Openfind｜SecuShare Pro - OS Command InjectionEPSS 1.5%
• CVE-2026-104711Crítica · 9.8Apache Struts: OGNL injection in the legacy RESTful action mapperEPSS 1.2%
• CVE-2026-105794Crítica · 9.1MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLEPSS 1%
• CVE-2026-105793Crítica · 9.1Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`EPSS 0.9%
• CVE-2026-88131Crítica · 9.8Microsoft Dataverse Remote Code Execution VulnerabilityEPSS 0.8%
• CVE-2026-63688Crítica · 10.0Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing…EPSS 0.8%
• CVE-2026-105284Crítica · 10.0Totolink A3002MU Authentication Check boa sub_40FCFC improper authorizationEPSS 0.8%
• CVE-2026-107202Crítica · 9.1CVE-2026-107202EPSS 0.8%

Maiores altas de EPSS (probabilidade de exploração em 30 dias)

Nada nesta semana.

Novos exploits e templates públicos

Nada nesta semana.