:: Vulnerabilidades exploradas ativamente

Catálogos CISA KEV e EUVD/ENISA — as dez mais recentes; as que correspondem a um fabricante vigiado aparecem a vermelho.

Última recolha: 23/10/26, 14:05

A mostrar apenas alertas de EUVD / ENISA. Clique outra vez para ver ambas as fontes. Ver as duas fontes

• CVE: CVE-2026-76519[fabricante vigiado]EUVD / ENISA

  Fabricante / produto: Cisco

  A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

  Ver na fonte ↗

  Gravidade: [Crítico · CVSS 9.8]

  Prazo: sem prazo

• CVE: CVE-2026-96951[fabricante vigiado]EUVD / ENISA

  Fabricante / produto: Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

  Ver na fonte ↗

  Gravidade: [Alto · CVSS 8.8]

  Prazo: sem prazo

• CVE: CVE-2026-102764EUVD / ENISA

  Fabricante / produto: BeyondTrust

  The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

  Ver na fonte ↗

  Gravidade: [Crítico · CVSS 9.3]

  Prazo: sem prazo

• CVE: CVE-2026-110936EUVD / ENISA

  Fabricante / produto: Siemens

  A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

  Ver na fonte ↗

  Gravidade: [Alto · CVSS 8.4]

  Prazo: sem prazo

• CVE: CVE-2026-0322EUVD / ENISA

  Fabricante / produto: Palo Alto Networks

  A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

  Ver na fonte ↗

  Gravidade: [Alto · CVSS 8.6]

  Prazo: sem prazo

• CVE: CVE-2026-104935EUVD / ENISA

  Fabricante / produto: Ivanti

  Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

  Ver na fonte ↗

  Gravidade: [Alto · CVSS 8.6]

  Prazo: sem prazo

• CVE: CVE-2026-21589EUVD / ENISA

  Fabricante / produto: Atlassian

  This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

  Ver na fonte ↗

  Gravidade: [Crítico · CVSS 9.3]

  Prazo: sem prazo

• CVE: CVE-2026-105134EUVD / ENISA

  Fabricante / produto: Ahsay

  A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

  Ver na fonte ↗

  Gravidade: [Crítico · CVSS 10.0]

  Prazo: sem prazo

• CVE: CVE-2026-105133EUVD / ENISA

  Fabricante / produto: Ahsay

  A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

  Ver na fonte ↗

  Gravidade: [Médio · CVSS 6.9]

  Prazo: sem prazo

• CVE: CVE-2026-88779EUVD / ENISA

  Fabricante / produto: NetScaler

  Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

  Ver na fonte ↗

  Gravidade: [Alto · CVSS 8.7]

  Prazo: sem prazo

Ver o arquivo completo (1851 vulnerabilidades) →