← Back to Radar

Vulnerability archive

The complete catalogue of actively exploited vulnerabilities (CISA KEV and EUVD/ENISA) tracked by Radar — search by CVE, vendor, or product.

50 of 1851 vulnerabilities

• CVE: CVE-2026-96652

  Vendor / product: Plex · Media Server

  Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

  View source ↗

  Source: CISA KEV

  Added: 10/20/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-96654

  Vendor / product: Plex · Media Server

  Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

  View source ↗

  Source: CISA KEV

  Added: 10/20/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-96655

  Vendor / product: Plex · Media Server

  Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

  View source ↗

  Source: CISA KEV

  Added: 10/20/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-96656

  Vendor / product: Plex · Media Server

  Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

  View source ↗

  Source: CISA KEV

  Added: 10/20/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-106931

  Vendor / product: EG Secure Solutions · SiteGuard Server Edition

  EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

  View source ↗

  Source: CISA KEV

  Added: 10/20/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-110936

  Vendor / product: Siemens · Software Center

  Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

  View source ↗

  Source: CISA KEV

  Added: 10/20/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2025-61624[watched vendor]

  Vendor / product: Fortinet · Multiple Products

  FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

  View source ↗

  Source: CISA KEV

  Added: 10/16/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-102764

  Vendor / product: BeyondTrust · Remote Support

  BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

  View source ↗

  Source: CISA KEV

  Added: 10/16/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-102764

  Vendor / product: BeyondTrust

  The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/15/26

  Severity: [Critical · CVSS 9.3]

• CVE: CVE-2026-110936

  Vendor / product: Siemens

  A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/15/26

  Severity: [High · CVSS 8.4]

• CVE: CVE-2026-21589

  Vendor / product: Atlassian · Multiple Products

  Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

  View source ↗

  Source: CISA KEV

  Added: 10/15/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-0322

  Vendor / product: Palo Alto Networks

  A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/14/26

  Severity: [High · CVSS 8.6]

• CVE: CVE-2026-76519[watched vendor]

  Vendor / product: Cisco

  A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/14/26

  Severity: [Critical · CVSS 9.8]

• CVE: CVE-2026-105133

  Vendor / product: Ahsay · AhsayCBS

  Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

  View source ↗

  Source: CISA KEV

  Added: 10/14/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-76519[watched vendor]

  Vendor / product: Cisco · Secure Email Gateway

  Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

  View source ↗

  Source: CISA KEV

  Added: 10/14/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-105134

  Vendor / product: Ahsay · AhsayCBS

  Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

  View source ↗

  Source: CISA KEV

  Added: 10/14/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-0322

  Vendor / product: Palo Alto Networks · PAN-OS

  Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

  View source ↗

  Source: CISA KEV

  Added: 10/14/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-96951[watched vendor]

  Vendor / product: Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/13/26

  Severity: [High · CVSS 8.8]

• CVE: CVE-2026-104935

  Vendor / product: Ivanti

  Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/13/26

  Severity: [High · CVSS 8.6]

• CVE: CVE-2026-96951[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

  View source ↗

  Source: CISA KEV

  Added: 10/13/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-104935

  Vendor / product: Ivanti · Connect Secure

  Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

  View source ↗

  Source: CISA KEV

  Added: 10/13/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2015-3306

  Vendor / product: ProFTPD · ProFTPD

  ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

  View source ↗

  Source: CISA KEV

  Added: 10/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2021-3199

  Vendor / product: ONLYOFFICE · Docs

  ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 10/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2023-22894

  Vendor / product: Strapi · Strapi

  Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 10/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2016-3081

  Vendor / product: Apache · Struts

  Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

  View source ↗

  Source: CISA KEV

  Added: 10/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2015-5477

  Vendor / product: ISC · BIND

  ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

  View source ↗

  Source: CISA KEV

  Added: 10/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-21589

  Vendor / product: Atlassian

  This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/5/26

  Severity: [Critical · CVSS 9.3]

• CVE: CVE-2026-105134

  Vendor / product: Ahsay

  A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/4/26

  Severity: [Critical · CVSS 10.0]

• CVE: CVE-2026-105133

  Vendor / product: Ahsay

  A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/4/26

  Severity: [Medium · CVSS 6.9]

• CVE: CVE-2026-88779

  Vendor / product: NetScaler

  Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/4/26

  Severity: [High · CVSS 8.7]

• CVE: CVE-2026-88779

  Vendor / product: Citrix · NetScaler

  Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

  View source ↗

  Source: CISA KEV

  Added: 10/4/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-102489

  Vendor / product: Zammad GmbH · Zammad

  Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

  View source ↗

  Source: CISA KEV

  Added: 10/2/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-102490

  Vendor / product: Zammad GmbH · Zammad

  Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

  View source ↗

  Source: CISA KEV

  Added: 10/2/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-104286[watched vendor]

  Vendor / product: Fortinet

  An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

  View source ↗

  Source: EUVD / ENISA

  Added: 10/1/26

  Severity: [Critical · CVSS 9.8]

• CVE: CVE-2026-104286[watched vendor]

  Vendor / product: Fortinet · FortiMail

  Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

  View source ↗

  Source: CISA KEV

  Added: 10/1/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-102490

  Vendor / product: Zammad GmbH

  All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/30/26

  Severity: [High · CVSS 8.5]

• CVE: CVE-2026-102489

  Vendor / product: Zammad GmbH

  Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/30/26

  Severity: [High · CVSS 8.7]

• CVE: CVE-2026-76504[watched vendor]

  Vendor / product: Cisco

  A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/30/26

  Severity: [Critical · CVSS 9.8]

• CVE: CVE-2026-76504[watched vendor]

  Vendor / product: Cisco · Catalyst SD-WAN Manager

  Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.

  View source ↗

  Source: CISA KEV

  Added: 9/30/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-86950

  Vendor / product: Apple · Multiple Products

  Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/29/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-86950

  Vendor / product: Apple

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/28/26

  Severity: [High · CVSS 8.8]

• CVE: CVE-2026-88772

  Vendor / product: Citrix NetScaler

  Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

  View source ↗

  Source: EUVD / ENISA

  Added: 9/27/26

  Severity: [Critical · CVSS 9.5]

• CVE: CVE-2026-88771

  Vendor / product: Citrix NetScaler

  Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/27/26

  Severity: [Critical · CVSS 9.5]

• CVE: CVE-2026-88772

  Vendor / product: Citrix · NetScaler

  Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

  View source ↗

  Source: CISA KEV

  Added: 9/27/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-88771

  Vendor / product: Citrix · NetScaler

  Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

  View source ↗

  Source: CISA KEV

  Added: 9/27/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-87902

  Vendor / product: WordPress · Core

  WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/25/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-65660[watched vendor]

  Vendor / product: Microsoft · SharePoint

  Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.

  View source ↗

  Source: CISA KEV

  Added: 9/25/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-67279

  Vendor / product: MikroTik · RouterOS

  Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.

  View source ↗

  Source: CISA KEV

  Added: 9/25/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-71362

  Vendor / product: Adobe · Commerce and Magento

  Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

  View source ↗

  Source: CISA KEV

  Added: 9/24/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-5430

  Vendor / product: WSO2 · Multiple Products

  WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/24/26

  Severity: [Confirmed active exploitation]