← Voltar ao Radar

Arquivo de vulnerabilidades

O catálogo completo de vulnerabilidades exploradas ativamente (CISA KEV e EUVD/ENISA) que o Radar acompanha — pesquise por CVE, fabricante ou produto.

50 de 1851 vulnerabilidades

• CVE: CVE-2026-96652

  Fabricante / produto: Plex · Media Server

  Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 20/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-96654

  Fabricante / produto: Plex · Media Server

  Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 20/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-96655

  Fabricante / produto: Plex · Media Server

  Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 20/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-96656

  Fabricante / produto: Plex · Media Server

  Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 20/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-106931

  Fabricante / produto: EG Secure Solutions · SiteGuard Server Edition

  EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 20/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-110936

  Fabricante / produto: Siemens · Software Center

  Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 20/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2025-61624[fabricante vigiado]

  Fabricante / produto: Fortinet · Multiple Products

  FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 16/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-102764

  Fabricante / produto: BeyondTrust · Remote Support

  BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 16/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-102764

  Fabricante / produto: BeyondTrust

  The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 15/10/26

  Gravidade: [Crítico · CVSS 9.3]

• CVE: CVE-2026-110936

  Fabricante / produto: Siemens

  A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 15/10/26

  Gravidade: [Alto · CVSS 8.4]

• CVE: CVE-2026-21589

  Fabricante / produto: Atlassian · Multiple Products

  Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 15/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-0322

  Fabricante / produto: Palo Alto Networks

  A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 14/10/26

  Gravidade: [Alto · CVSS 8.6]

• CVE: CVE-2026-76519[fabricante vigiado]

  Fabricante / produto: Cisco

  A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 14/10/26

  Gravidade: [Crítico · CVSS 9.8]

• CVE: CVE-2026-105133

  Fabricante / produto: Ahsay · AhsayCBS

  Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 14/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-76519[fabricante vigiado]

  Fabricante / produto: Cisco · Secure Email Gateway

  Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 14/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-105134

  Fabricante / produto: Ahsay · AhsayCBS

  Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 14/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-0322

  Fabricante / produto: Palo Alto Networks · PAN-OS

  Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 14/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-96951[fabricante vigiado]

  Fabricante / produto: Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 13/10/26

  Gravidade: [Alto · CVSS 8.8]

• CVE: CVE-2026-104935

  Fabricante / produto: Ivanti

  Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 13/10/26

  Gravidade: [Alto · CVSS 8.6]

• CVE: CVE-2026-96951[fabricante vigiado]

  Fabricante / produto: Microsoft · Windows

  Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 13/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-104935

  Fabricante / produto: Ivanti · Connect Secure

  Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 13/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2015-3306

  Fabricante / produto: ProFTPD · ProFTPD

  ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 08/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2021-3199

  Fabricante / produto: ONLYOFFICE · Docs

  ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 08/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2023-22894

  Fabricante / produto: Strapi · Strapi

  Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 08/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2016-3081

  Fabricante / produto: Apache · Struts

  Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 08/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2015-5477

  Fabricante / produto: ISC · BIND

  ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 08/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-21589

  Fabricante / produto: Atlassian

  This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 05/10/26

  Gravidade: [Crítico · CVSS 9.3]

• CVE: CVE-2026-105134

  Fabricante / produto: Ahsay

  A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 04/10/26

  Gravidade: [Crítico · CVSS 10.0]

• CVE: CVE-2026-105133

  Fabricante / produto: Ahsay

  A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 04/10/26

  Gravidade: [Médio · CVSS 6.9]

• CVE: CVE-2026-88779

  Fabricante / produto: NetScaler

  Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 04/10/26

  Gravidade: [Alto · CVSS 8.7]

• CVE: CVE-2026-88779

  Fabricante / produto: Citrix · NetScaler

  Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 04/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-102489

  Fabricante / produto: Zammad GmbH · Zammad

  Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 02/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-102490

  Fabricante / produto: Zammad GmbH · Zammad

  Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 02/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-104286[fabricante vigiado]

  Fabricante / produto: Fortinet

  An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 01/10/26

  Gravidade: [Crítico · CVSS 9.8]

• CVE: CVE-2026-104286[fabricante vigiado]

  Fabricante / produto: Fortinet · FortiMail

  Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 01/10/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-102490

  Fabricante / produto: Zammad GmbH

  All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 30/09/26

  Gravidade: [Alto · CVSS 8.5]

• CVE: CVE-2026-102489

  Fabricante / produto: Zammad GmbH

  Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 30/09/26

  Gravidade: [Alto · CVSS 8.7]

• CVE: CVE-2026-76504[fabricante vigiado]

  Fabricante / produto: Cisco

  A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 30/09/26

  Gravidade: [Crítico · CVSS 9.8]

• CVE: CVE-2026-76504[fabricante vigiado]

  Fabricante / produto: Cisco · Catalyst SD-WAN Manager

  Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 30/09/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-86950

  Fabricante / produto: Apple · Multiple Products

  Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 29/09/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-86950

  Fabricante / produto: Apple

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 28/09/26

  Gravidade: [Alto · CVSS 8.8]

• CVE: CVE-2026-88772

  Fabricante / produto: Citrix NetScaler

  Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 27/09/26

  Gravidade: [Crítico · CVSS 9.5]

• CVE: CVE-2026-88771

  Fabricante / produto: Citrix NetScaler

  Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

  Ver na fonte ↗

  Fonte: EUVD / ENISA

  Adicionado: 27/09/26

  Gravidade: [Crítico · CVSS 9.5]

• CVE: CVE-2026-88772

  Fabricante / produto: Citrix · NetScaler

  Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 27/09/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-88771

  Fabricante / produto: Citrix · NetScaler

  Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 27/09/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-87902

  Fabricante / produto: WordPress · Core

  WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 25/09/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-65660[fabricante vigiado]

  Fabricante / produto: Microsoft · SharePoint

  Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 25/09/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-67279

  Fabricante / produto: MikroTik · RouterOS

  Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 25/09/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-71362

  Fabricante / produto: Adobe · Commerce and Magento

  Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 24/09/26

  Gravidade: [Exploração ativa confirmada]

• CVE: CVE-2026-5430

  Fabricante / produto: WSO2 · Multiple Products

  WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.

  Ver na fonte ↗

  Fonte: CISA KEV

  Adicionado: 24/09/26

  Gravidade: [Exploração ativa confirmada]