← Back to Radar

Vulnerability archive

The complete catalogue of actively exploited vulnerabilities (CISA KEV and EUVD/ENISA) tracked by Radar — search by CVE, vendor, or product.

50 of 1851 vulnerabilities

• CVE: CVE-2026-96656

  Vendor / product: Plex

  Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/23/26

  Severity: [High · CVSS 8.6]

• CVE: CVE-2026-96655

  Vendor / product: Plex

  Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/23/26

  Severity: [Medium · CVSS 5.3]

• CVE: CVE-2026-96654

  Vendor / product: Plex

  Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/23/26

  Severity: [Medium · CVSS 6.9]

• CVE: CVE-2026-96652

  Vendor / product: Plex

  Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/23/26

  Severity: [Medium · CVSS 5.3]

• CVE: CVE-2026-87902

  Vendor / product: WordPress

  An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/22/26

  Severity: [High · CVSS 8.1]

• CVE: CVE-2026-94127

  Vendor / product: F5

  When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/22/26

  Severity: [Critical · CVSS 9.3]

• CVE: CVE-2026-93616

  Vendor / product: checkpoint

  A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/22/26

  Severity: [Critical · CVSS 9.8]

• CVE: CVE-2026-93952

  Vendor / product: Arista Networks

  VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/22/26

  Severity: [Critical · CVSS 9.5]

• CVE: CVE-2026-85102

  Vendor / product: Check Point · Multiple Products

  Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

  View source ↗

  Source: CISA KEV

  Added: 9/22/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-93616

  Vendor / product: Check Point · Multiple Products

  Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.

  View source ↗

  Source: CISA KEV

  Added: 9/22/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-94127

  Vendor / product: F5 · BIG-IP APM

  F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/22/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-93952

  Vendor / product: Arista · VeloCloud Orchestrator

  Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

  View source ↗

  Source: CISA KEV

  Added: 9/22/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-7273[watched vendor]

  Vendor / product: Zyxel · GS1900 Series Switches

  Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

  View source ↗

  Source: CISA KEV

  Added: 9/21/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2025-39682

  Vendor / product: Linux · Kernel

  Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

  View source ↗

  Source: CISA KEV

  Added: 9/18/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-53266

  Vendor / product: Linux · Kernel

  Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

  View source ↗

  Source: CISA KEV

  Added: 9/18/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2025-39964

  Vendor / product: Linux · Kernel

  Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.

  View source ↗

  Source: CISA KEV

  Added: 9/18/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-87886

  Vendor / product: Acronis

  Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/17/26

  Severity: [High · CVSS 7.8]

• CVE: CVE-2026-76460[watched vendor]

  Vendor / product: Cisco

  A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/16/26

  Severity: [Critical · CVSS 10.0]

• CVE: CVE-2026-87886

  Vendor / product: Acronis · Backup

  Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 9/16/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-76460[watched vendor]

  Vendor / product: Cisco · Identity Services Engine

  Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

  View source ↗

  Source: CISA KEV

  Added: 9/16/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-58704

  Vendor / product: Google · Pixel

  Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.

  View source ↗

  Source: CISA KEV

  Added: 9/16/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-58704

  Vendor / product: Google

  In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/15/26

  Severity: [High · CVSS 8.8]

• CVE: CVE-2026-76461[watched vendor]

  Vendor / product: Cisco

  A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/14/26

  Severity: [Critical · CVSS 9.8]

• CVE: CVE-2026-76461[watched vendor]

  Vendor / product: Cisco · Secure Email Gateway

  Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

  View source ↗

  Source: CISA KEV

  Added: 9/14/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-85706

  Vendor / product: GitLab

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/12/26

  Severity: [Critical · CVSS 10.0]

• CVE: CVE-2026-84869

  Vendor / product: ConnectWise · ScreenConnect

  ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.

  View source ↗

  Source: CISA KEV

  Added: 9/11/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-85706

  Vendor / product: GitLab · Community Edition and Enterprise Edition

  GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.

  View source ↗

  Source: CISA KEV

  Added: 9/11/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-42018

  Vendor / product: JFrog · Artifactory

  JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

  View source ↗

  Source: CISA KEV

  Added: 9/11/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-42016

  Vendor / product: JFrog · Artifactory

  JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

  View source ↗

  Source: CISA KEV

  Added: 9/11/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-67277

  Vendor / product: MikroTik · RouterOS

  MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.

  View source ↗

  Source: CISA KEV

  Added: 9/10/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-86060

  Vendor / product: MikroTik · RouterOS

  MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.

  View source ↗

  Source: CISA KEV

  Added: 9/10/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-85102

  Vendor / product: checkpoint

  Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/9/26

  Severity: [Critical · CVSS 9.8]

• CVE: CVE-2026-19490

  Vendor / product: Citrix · NetScaler

  Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

  View source ↗

  Source: CISA KEV

  Added: 9/9/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-20079[watched vendor]

  Vendor / product: Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management

  Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

  View source ↗

  Source: CISA KEV

  Added: 9/9/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-87491

  Vendor / product: Google · Chromium V8

  Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  View source ↗

  Source: CISA KEV

  Added: 9/9/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2025-25249[watched vendor]

  Vendor / product: Fortinet · Multiple Products

  Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.

  View source ↗

  Source: CISA KEV

  Added: 9/9/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-87491

  Vendor / product: Google

  Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  View source ↗

  Source: EUVD / ENISA

  Added: 9/9/26

  Severity: [High · CVSS 8.8]

• CVE: CVE-2026-84869

  Vendor / product: ConnectWise

  A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/8/26

  Severity: [Critical · CVSS 9.9]

• CVE: CVE-2026-81963[watched vendor]

  Vendor / product: Microsoft

  Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/8/26

  Severity: [High · CVSS 7.8]

• CVE: CVE-2026-85880[watched vendor]

  Vendor / product: Microsoft

  Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/8/26

  Severity: [High · CVSS 7.8]

• CVE: CVE-2026-81963[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.

  View source ↗

  Source: CISA KEV

  Added: 9/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-75650

  Vendor / product: Adobe · Commerce and Magento

  Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

  View source ↗

  Source: CISA KEV

  Added: 9/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-85880[watched vendor]

  Vendor / product: Microsoft · Windows

  Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

  View source ↗

  Source: CISA KEV

  Added: 9/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-86218

  Vendor / product: N-able · N-central

  N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.

  View source ↗

  Source: CISA KEV

  Added: 9/8/26

  Severity: [Confirmed active exploitation]

• CVE: CVE-2026-75650

  Vendor / product: Adobe

  Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/7/26

  Severity: [Critical · CVSS 10.0]

• CVE: CVE-2026-86218

  Vendor / product: N-Able

  N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

  View source ↗

  Source: EUVD / ENISA

  Added: 9/6/26

  Severity: [Critical · CVSS 10.0]

• CVE: CVE-2026-86060

  Vendor / product: MikroTik

  RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

  View source ↗

  Source: EUVD / ENISA

  Added: 9/5/26

  Severity: [Critical · CVSS 9.2]

• CVE: CVE-2026-67279

  Vendor / product: MikroTik

  RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

  View source ↗

  Source: EUVD / ENISA

  Added: 9/5/26

  Severity: [Medium · CVSS 6.9]

• CVE: CVE-2026-67277

  Vendor / product: MikroTik

  RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

  View source ↗

  Source: EUVD / ENISA

  Added: 9/5/26

  Severity: [High · CVSS 8.8]

• CVE: CVE-2026-67276

  Vendor / product: MikroTik

  RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

  View source ↗

  Source: EUVD / ENISA

  Added: 9/5/26

  Severity: [Critical · CVSS 9.2]