{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Exploited and unpatched CVEs",
 "home_page_url": "https://patchwire.jonathanross.dev/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/exploited-unpatched.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-110447/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-110447/",
   "title": "CVE-2026-110447 is exploited and has no fix",
   "content_text": "Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.",
   "date_published": "2026-10-23T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114625/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114625/",
   "title": "CVE-2026-114625 is exploited and has no fix",
   "content_text": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nOn an affected system, any authenticated user can gain operator privileges and masquerade as a local \"superuser operator\" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.",
   "date_published": "2026-10-23T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106931/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106931/",
   "title": "CVE-2026-106931 is exploited and has no fix",
   "content_text": "SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.",
   "date_published": "2026-10-20T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-110936/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-110936/",
   "title": "CVE-2026-110936 is exploited and has no fix",
   "content_text": "A vulnerability has been identified in Siemens Software Center (All versions \u003c V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.",
   "date_published": "2026-10-20T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96652/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96652/",
   "title": "CVE-2026-96652 is exploited and has no fix",
   "content_text": "Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.",
   "date_published": "2026-10-20T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96654/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96654/",
   "title": "CVE-2026-96654 is exploited and has no fix",
   "content_text": "Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.",
   "date_published": "2026-10-20T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96655/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96655/",
   "title": "CVE-2026-96655 is exploited and has no fix",
   "content_text": "Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.",
   "date_published": "2026-10-20T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96656/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96656/",
   "title": "CVE-2026-96656 is exploited and has no fix",
   "content_text": "Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.",
   "date_published": "2026-10-20T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2025-61624/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2025-61624/",
   "title": "CVE-2025-61624 is exploited and has no fix",
   "content_text": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.",
   "date_published": "2026-10-16T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102764/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102764/",
   "title": "CVE-2026-102764 is exploited and has no fix",
   "content_text": "The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.",
   "date_published": "2026-10-16T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-21589/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-21589/",
   "title": "CVE-2026-21589 is exploited and has no fix",
   "content_text": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version \u003e= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version \u003e= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version \u003e= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version \u003e= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version \u003e= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center \u003e= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.",
   "date_published": "2026-10-15T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-0322/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-0322/",
   "title": "CVE-2026-0322 is exploited and has no fix",
   "content_text": "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.\n\n\n\nThe security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\n\n\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.",
   "date_published": "2026-10-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105133/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105133/",
   "title": "CVE-2026-105133 is exploited and has no fix",
   "content_text": "A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.",
   "date_published": "2026-10-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105134/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105134/",
   "title": "CVE-2026-105134 is exploited and has no fix",
   "content_text": "A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.",
   "date_published": "2026-10-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76519/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76519/",
   "title": "CVE-2026-76519 is exploited and has no fix",
   "content_text": "A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.\r\n\r\nThis vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with\u0026nbsp;root privileges on the underlying operating system.",
   "date_published": "2026-10-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104935/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104935/",
   "title": "CVE-2026-104935 is exploited and has no fix",
   "content_text": "Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.",
   "date_published": "2026-10-13T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96951/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96951/",
   "title": "CVE-2026-96951 is exploited and has no fix",
   "content_text": "Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.",
   "date_published": "2026-10-13T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2021-3199/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2021-3199/",
   "title": "CVE-2021-3199 is exploited and has no fix",
   "content_text": "Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.",
   "date_published": "2026-10-08T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88779/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88779/",
   "title": "CVE-2026-88779 is exploited and has no fix",
   "content_text": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.",
   "date_published": "2026-10-04T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102489/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102489/",
   "title": "CVE-2026-102489 is exploited and has no fix",
   "content_text": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.",
   "date_published": "2026-10-02T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102490/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102490/",
   "title": "CVE-2026-102490 is exploited and has no fix",
   "content_text": "Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.",
   "date_published": "2026-10-02T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104286/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104286/",
   "title": "CVE-2026-104286 is exploited and has no fix",
   "content_text": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
   "date_published": "2026-10-01T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76504/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76504/",
   "title": "CVE-2026-76504 is exploited and has no fix",
   "content_text": "A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.",
   "date_published": "2026-09-30T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86950/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86950/",
   "title": "CVE-2026-86950 is exploited and has no fix",
   "content_text": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.",
   "date_published": "2026-09-29T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88771/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88771/",
   "title": "CVE-2026-88771 is exploited and has no fix",
   "content_text": "Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.",
   "date_published": "2026-09-27T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88772/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88772/",
   "title": "CVE-2026-88772 is exploited and has no fix",
   "content_text": "Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service",
   "date_published": "2026-09-27T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-65660/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-65660/",
   "title": "CVE-2026-65660 is exploited and has no fix",
   "content_text": "Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.",
   "date_published": "2026-09-25T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-5430/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-5430/",
   "title": "CVE-2026-5430 is exploited and has no fix",
   "content_text": "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.",
   "date_published": "2026-09-24T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-71362/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-71362/",
   "title": "CVE-2026-71362 is exploited and has no fix",
   "content_text": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.",
   "date_published": "2026-09-24T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85102/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85102/",
   "title": "CVE-2026-85102 is exploited and has no fix",
   "content_text": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.",
   "date_published": "2026-09-22T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-93616/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-93616/",
   "title": "CVE-2026-93616 is exploited and has no fix",
   "content_text": "A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.",
   "date_published": "2026-09-22T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-93952/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-93952/",
   "title": "CVE-2026-93952 is exploited and has no fix",
   "content_text": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.",
   "date_published": "2026-09-22T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94127/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94127/",
   "title": "CVE-2026-94127 is exploited and has no fix",
   "content_text": "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.\n\nImpact:\nThis vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
   "date_published": "2026-09-22T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-7273/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-7273/",
   "title": "CVE-2026-7273 is exploited and has no fix",
   "content_text": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.",
   "date_published": "2026-09-21T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-58704/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-58704/",
   "title": "CVE-2026-58704 is exploited and has no fix",
   "content_text": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
   "date_published": "2026-09-16T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76460/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76460/",
   "title": "CVE-2026-76460 is exploited and has no fix",
   "content_text": "A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.\r\n\r\nThis vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.",
   "date_published": "2026-09-16T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87886/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87886/",
   "title": "CVE-2026-87886 is exploited and has no fix",
   "content_text": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel \u0026 WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.",
   "date_published": "2026-09-16T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-76461/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-76461/",
   "title": "CVE-2026-76461 is exploited and has no fix",
   "content_text": "A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.",
   "date_published": "2026-09-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-42016/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-42016/",
   "title": "CVE-2026-42016 is exploited and has no fix",
   "content_text": "JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.",
   "date_published": "2026-09-11T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-42018/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-42018/",
   "title": "CVE-2026-42018 is exploited and has no fix",
   "content_text": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.",
   "date_published": "2026-09-11T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84869/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84869/",
   "title": "CVE-2026-84869 is exploited and has no fix",
   "content_text": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.",
   "date_published": "2026-09-11T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-67277/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-67277/",
   "title": "CVE-2026-67277 is exploited and has no fix",
   "content_text": "RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)",
   "date_published": "2026-09-10T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86060/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86060/",
   "title": "CVE-2026-86060 is exploited and has no fix",
   "content_text": "RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)",
   "date_published": "2026-09-10T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2025-25249/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2025-25249/",
   "title": "CVE-2025-25249 is exploited and has no fix",
   "content_text": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets",
   "date_published": "2026-09-09T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-19490/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-19490/",
   "title": "CVE-2026-19490 is exploited and has no fix",
   "content_text": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.",
   "date_published": "2026-09-09T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-20079/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-20079/",
   "title": "CVE-2026-20079 is exploited and has no fix",
   "content_text": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.\u0026nbsp;\r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow\u0026nbsp;root access to the device.\u0026nbsp;",
   "date_published": "2026-09-09T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75650/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75650/",
   "title": "CVE-2026-75650 is exploited and has no fix",
   "content_text": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.",
   "date_published": "2026-09-08T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-81963/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-81963/",
   "title": "CVE-2026-81963 is exploited and has no fix",
   "content_text": "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.",
   "date_published": "2026-09-08T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85880/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85880/",
   "title": "CVE-2026-85880 is exploited and has no fix",
   "content_text": "Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.",
   "date_published": "2026-09-08T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86218/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86218/",
   "title": "CVE-2026-86218 is exploited and has no fix",
   "content_text": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.",
   "date_published": "2026-09-08T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-49869/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-49869/",
   "title": "CVE-2026-49869 is exploited and has no fix",
   "content_text": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container.  This vulnerability is fixed in 1.0.45 and 1.3.21.",
   "date_published": "2026-09-02T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82329/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82329/",
   "title": "CVE-2026-82329 is exploited and has no fix",
   "content_text": "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.",
   "date_published": "2026-09-02T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83548/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83548/",
   "title": "CVE-2026-83548 is exploited and has no fix",
   "content_text": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.",
   "date_published": "2026-09-02T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83549/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83549/",
   "title": "CVE-2026-83549 is exploited and has no fix",
   "content_text": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.",
   "date_published": "2026-09-02T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-9586/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-9586/",
   "title": "CVE-2026-9586 is exploited and has no fix",
   "content_text": "An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with \u003cPolycomIPPhone\u003e and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.",
   "date_published": "2026-09-02T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-81578/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-81578/",
   "title": "CVE-2026-81578 is exploited and has no fix",
   "content_text": "An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the  completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.",
   "date_published": "2026-08-31T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82078/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82078/",
   "title": "CVE-2026-82078 is exploited and has no fix",
   "content_text": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.",
   "date_published": "2026-08-31T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2023-49105/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2023-49105/",
   "title": "CVE-2023-49105 is exploited and has no fix",
   "content_text": "An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.",
   "date_published": "2026-08-27T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66384/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66384/",
   "title": "CVE-2026-66384 is exploited and has no fix",
   "content_text": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.",
   "date_published": "2026-08-27T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2019-1068/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2019-1068/",
   "title": "CVE-2019-1068 is exploited and has no fix",
   "content_text": "A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.",
   "date_published": "2026-08-26T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-8452/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-8452/",
   "title": "CVE-2026-8452 is exploited and has no fix",
   "content_text": "Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server",
   "date_published": "2026-08-26T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-21962/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-21962/",
   "title": "CVE-2026-21962 is exploited and has no fix",
   "content_text": "Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).",
   "date_published": "2026-08-24T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-73570/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-73570/",
   "title": "CVE-2026-73570 is exploited and has no fix",
   "content_text": "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
   "date_published": "2026-08-21T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72529/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72529/",
   "title": "CVE-2026-72529 is exploited and has no fix",
   "content_text": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.",
   "date_published": "2026-08-20T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72530/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72530/",
   "title": "CVE-2026-72530 is exploited and has no fix",
   "content_text": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
   "date_published": "2026-08-20T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-33824/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-33824/",
   "title": "CVE-2026-33824 is exploited and has no fix",
   "content_text": "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.",
   "date_published": "2026-08-18T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-55040/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-55040/",
   "title": "CVE-2026-55040 is exploited and has no fix",
   "content_text": "Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.",
   "date_published": "2026-08-18T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-59310/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-59310/",
   "title": "CVE-2026-59310 is exploited and has no fix",
   "content_text": "VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.",
   "date_published": "2026-08-18T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-65400/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-65400/",
   "title": "CVE-2026-65400 is exploited and has no fix",
   "content_text": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.",
   "date_published": "2026-08-18T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-20349/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-20349/",
   "title": "CVE-2026-20349 is exploited and has no fix",
   "content_text": "A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.\u0026nbsp;\r\n\r\nThis vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.",
   "date_published": "2026-08-11T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-68820/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-68820/",
   "title": "CVE-2026-68820 is exploited and has no fix",
   "content_text": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
   "date_published": "2026-08-11T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-8037/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-8037/",
   "title": "CVE-2026-8037 is exploited and has no fix",
   "content_text": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints",
   "date_published": "2026-08-07T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-63077/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-63077/",
   "title": "CVE-2026-63077 is exploited and has no fix",
   "content_text": "In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol",
   "date_published": "2026-08-05T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-18556/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-18556/",
   "title": "CVE-2026-18556 is exploited and has no fix",
   "content_text": "Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1.",
   "date_published": "2026-08-04T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-9198/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-9198/",
   "title": "CVE-2026-9198 is exploited and has no fix",
   "content_text": "IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments",
   "date_published": "2026-08-04T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-18577/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-18577/",
   "title": "CVE-2026-18577 is exploited and has no fix",
   "content_text": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1",
   "date_published": "2026-08-03T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-20316/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-20316/",
   "title": "CVE-2026-20316 is exploited and has no fix",
   "content_text": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user credentials for a low-privileged\u0026nbsp;account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.\u0026nbsp;\r\nNote:\u0026nbsp;If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.\u0026nbsp;\u0026nbsp;\r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.",
   "date_published": "2026-07-29T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2025-68686/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2025-68686/",
   "title": "CVE-2025-68686 is exploited and has no fix",
   "content_text": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.",
   "date_published": "2026-07-27T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-16812/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-16812/",
   "title": "CVE-2026-16812 is exploited and has no fix",
   "content_text": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\n\n\n\n\nThis issue was discovered externally and is known to be actively exploited.",
   "date_published": "2026-07-27T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-16232/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-16232/",
   "title": "CVE-2026-16232 is exploited and has no fix",
   "content_text": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.",
   "date_published": "2026-07-22T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-50522/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-50522/",
   "title": "CVE-2026-50522 is exploited and has no fix",
   "content_text": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
   "date_published": "2026-07-22T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2021-27137/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2021-27137/",
   "title": "CVE-2021-27137 is exploited and has no fix",
   "content_text": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).",
   "date_published": "2026-07-21T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-0770/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-0770/",
   "title": "CVE-2026-0770 is exploited and has no fix",
   "content_text": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.",
   "date_published": "2026-07-21T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-25089/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-25089/",
   "title": "CVE-2026-25089 is exploited and has no fix",
   "content_text": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests",
   "date_published": "2026-07-16T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-39808/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-39808/",
   "title": "CVE-2026-39808 is exploited and has no fix",
   "content_text": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via \u003cinsert attack vector here\u003e",
   "date_published": "2026-07-16T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-58644/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-58644/",
   "title": "CVE-2026-58644 is exploited and has no fix",
   "content_text": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
   "date_published": "2026-07-16T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2023-4346/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2023-4346/",
   "title": "CVE-2023-4346 is exploited and has no fix",
   "content_text": "KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.",
   "date_published": "2026-07-15T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-46817/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-46817/",
   "title": "CVE-2026-46817 is exploited and has no fix",
   "content_text": "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments.  Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
   "date_published": "2026-07-15T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-15409/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-15409/",
   "title": "CVE-2026-15409 is exploited and has no fix",
   "content_text": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.",
   "date_published": "2026-07-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-15410/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-15410/",
   "title": "CVE-2026-15410 is exploited and has no fix",
   "content_text": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.",
   "date_published": "2026-07-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-56155/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-56155/",
   "title": "CVE-2026-56155 is exploited and has no fix",
   "content_text": "Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.",
   "date_published": "2026-07-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-56164/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-56164/",
   "title": "CVE-2026-56164 is exploited and has no fix",
   "content_text": "Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.",
   "date_published": "2026-07-14T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2008-4128/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2008-4128/",
   "title": "CVE-2008-4128 is exploited and has no fix",
   "content_text": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.  NOTE: some of these details are obtained from third party information.",
   "date_published": "2026-07-13T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-48939/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-48939/",
   "title": "CVE-2026-48939 is exploited and has no fix",
   "content_text": "A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.",
   "date_published": "2026-07-10T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-56291/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-56291/",
   "title": "CVE-2026-56291 is exploited and has no fix",
   "content_text": "Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension \u003c 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.",
   "date_published": "2026-07-10T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-48282/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-48282/",
   "title": "CVE-2026-48282 is exploited and has no fix",
   "content_text": "ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.",
   "date_published": "2026-07-07T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-48908/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-48908/",
   "title": "CVE-2026-48908 is exploited and has no fix",
   "content_text": "A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.",
   "date_published": "2026-07-07T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-56290/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-56290/",
   "title": "CVE-2026-56290 is exploited and has no fix",
   "content_text": "Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension \u003c 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.",
   "date_published": "2026-07-07T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-45659/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-45659/",
   "title": "CVE-2026-45659 is exploited and has no fix",
   "content_text": "Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.",
   "date_published": "2026-07-01T00:00:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-48558/exploited-unpatched",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-48558/",
   "title": "CVE-2026-48558 is exploited and has no fix",
   "content_text": "SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.",
   "date_published": "2026-06-29T00:00:00Z"
  }
 ]
}