Recent CVE briefs

Direct links to the 100 most recently published RORA Gauge emerging threats briefs — plain-English explanations of who is at risk, attacker behaviour and what to do.

• CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability UNKNOWN2026-11-06
• CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability CRITICAL2026-10-22
• CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability CRITICAL2026-10-22
• CVE-2026-109618 PHP Memory Corruption Vulnerability CRITICAL2026-10-21
• CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability CRITICAL2026-10-15
• CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CRITICAL2026-10-14
• CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability CRITICAL2026-10-14
• CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability CRITICAL2026-10-13
• CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability CRITICAL2026-10-04
• CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability CRITICAL2026-10-01
• CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability CRITICAL2026-09-30
• CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability CRITICAL2026-09-30
• CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability CRITICAL2026-09-27
• CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability CRITICAL2026-09-22
• CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability CRITICAL2026-09-22
• CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability CRITICAL2026-09-22
• CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability CRITICAL2026-09-16
• CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability UNKNOWN2026-09-16
• CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability CRITICAL2026-09-14
• CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability CRITICAL2026-09-12
• CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability CRITICAL2026-09-09
• CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability CRITICAL2026-09-08
• CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CRITICAL2026-09-07
• CVE-2026-86218 N-able N-central Static Code Injection Vulnerability CRITICAL2026-09-06
• CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability CRITICAL2026-09-05
• CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CRITICAL2026-09-01
• CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability CRITICAL2026-08-28
• CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability CRITICAL2026-08-28
• CVE-2026-60004 Gitea Code Injection Vulnerability CRITICAL2026-08-26
• CVE-2026-69836 Microsoft Entra ID Deserialization of Untrusted Data Vulnerability CRITICAL2026-08-20
• CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability CRITICAL2026-08-19
• CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability CRITICAL2026-08-19
• CVE-2026-72898 Metabase SQL Injection Vulnerability CRITICAL2026-08-10
• CVE-2026-65400 Apple macOS Improper Authentication Vulnerability CRITICAL2026-08-06
• CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CRITICAL2026-08-06
• CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability CRITICAL2026-07-30
• CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability CRITICAL2026-07-27
• CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability CRITICAL2026-07-27
• CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability CRITICAL2026-07-22
• CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability CRITICAL2026-07-17
• CVE-2026-9198 IBM Langflow Code Injection Vulnerability CRITICAL2026-07-17
• CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability CRITICAL2026-07-17
• CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CRITICAL2026-07-14
• CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CRITICAL2026-07-14
• CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CRITICAL2026-07-14
• CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability CRITICAL2026-07-09
• CVE-2026-48282 Adobe ColdFusion Path Traversal Vulnerability CRITICAL2026-06-30
• CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CRITICAL2026-06-30
• CVE-2026-56290 Joomlack Page Builder Improper Access Control Vulnerability CRITICAL2026-06-29
• CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability CRITICAL2026-06-26
• CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability CRITICAL2026-06-20
• CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability CRITICAL2026-06-20
• CVE-2026-12569 PTC Windchill and FlexPLM Improper Input Validation Vulnerability CRITICAL2026-06-18
• CVE-2026-48558 SimpleHelp Authentication Bypass Vulnerability CRITICAL2026-06-12
• CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability CRITICAL2026-06-11
• CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical Function Vulnerability CRITICAL2026-06-10
• CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability CRITICAL2026-06-09
• CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability CRITICAL2026-06-09
• CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control Vulnerability CRITICAL2026-06-05
• CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability CRITICAL2026-06-04
• CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability UNKNOWN2026-05-29
• CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability CRITICAL2026-05-28
• CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability UNKNOWN2026-05-28
• CVE-2026-45247 Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability CRITICAL2026-05-26
• CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability CRITICAL2026-05-22
• CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability CRITICAL2026-05-22
• CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability CRITICAL2026-05-22
• CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability CRITICAL2026-05-21
• CVE-2026-9082 Drupal Core SQL Injection Vulnerability CRITICAL2026-05-20
• CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability CRITICAL2026-05-15
• CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability CRITICAL2026-05-14
• CVE-2026-45321 TanStack Unspecified Vulnerability CRITICAL2026-05-12
• CVE-2026-42208 BerriAI LiteLLM SQL Injection Vulnerability CRITICAL2026-05-08
• CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability CRITICAL2026-05-06
• CVE-2026-35616 Fortinet FortiClient EMS access control flaw is listed in CISA KEV UNKNOWN2026-05-03
• CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability UNKNOWN2026-05-03
• CVE-2026-34621 Adobe Acrobat and Reader Prototype Pollution Vulnerability UNKNOWN2026-05-03
• CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Vulnerability UNKNOWN2026-05-03
• CVE-2020-9715 Adobe Acrobat Use-After-Free Vulnerability UNKNOWN2026-05-03
• CVE-2023-36424 Microsoft Windows out-of-bounds read flaw listed in CISA KEV UNKNOWN2026-05-03
• CVE-2025-60710 Microsoft Windows link following vulnerability is listed by CISA as known exploited UNKNOWN2026-05-03
• CVE-2012-1854 Microsoft Visual Basic for Applications (VBA) insecure library loading flaw is listed in CISA KEV UNKNOWN2026-05-03
• CVE-2026-32201 Microsoft SharePoint Server vulnerability listed in CISA KEV UNKNOWN2026-05-03
• CVE-2009-0238 Microsoft Office flaw CVE-2009-0238 is listed by CISA as actively important UNKNOWN2026-05-03
• CVE-2026-34197 Apache ActiveMQ input validation flaw listed by CISA KEV; affected organisations should review urgently UNKNOWN2026-05-03
• CVE-2026-41940 Critical authentication bypass in cpanel, whm and wp_squared could allow unauthorised control panel access UNKNOWN2026-05-03
• CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CRITICAL2026-04-14
• CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability CRITICAL2026-04-14
• CVE-2026-39987 coreweave marimo critical flaw could allow unauthorised remote command execution CRITICAL2026-04-09
• CVE-2025-67038 Lantronix EDS5000 Code Injection Vulnerability CRITICAL2026-03-11
• CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability CRITICAL2026-03-04
• CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CRITICAL2026-01-23
• CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability CRITICAL2026-01-20
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability CRITICAL2025-09-05
• CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) authentication flaw listed in CISA KEV CRITICAL2025-06-24
• CVE-2024-57726 Critical SimpleHelp flaw could let low-privilege technicians gain server admin access CRITICAL2025-01-15
• CVE-2023-49105 ownCloud Improper Authentication Vulnerability CRITICAL2023-11-21
• CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal Vulnerability CRITICAL2021-01-26
• CVE-2015-3306 ProFTPD Improper Access Control Vulnerability CRITICAL2015-05-18
• CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability CRITICAL2008-10-23