Ranljivosti, ki jih je treba najprej popraviti: aktivno izkoriščane (seznam CISA KEV) in kritične z oceno CVSS 9,0 ali več. Pri vsaki vidite verjetnost izkoriščanja (EPSS), proizvajalca in povezavo na podrobnosti.
Ranljivosti, ki jih je CISA v zadnjih 14 dneh uvrstila na seznam KEV (izkoriščanje v praksi) ali imajo oceno CVSS 9,0 ali več. EPSS je verjetnost izkoriščanja v naslednjih 30 dneh. Seznam se osvežuje vsakih nekaj minut.
| CVE | CVSS | EPSS | CISA KEV | Proizvajalec | Opis (NVD, angleško) |
|---|---|---|---|---|---|
| CVE-2015-3306 | 10 Kritično | 99,5 % | Aktivno izkoriščana od 8. 10. 2026 | Debian, Fedoraproject, Opensuse, Proftpd | The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. |
| CVE-2026-76504 | 9,8 Kritično | 1,8 % | Aktivno izkoriščana od 30. 9. 2026 | Cisco | A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handlin |
| CVE-2026-86950 | 8,8 Visoko | 1,2 % | Aktivno izkoriščana od 29. 9. 2026 | Apple | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware |
| CVE-2026-88779 | 8,7 Visoko | 0,6 % | Aktivno izkoriščana od 4. 10. 2026 | Citrix | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28. |
| CVE-2016-3081 | 8,1 Visoko | 96,1 % | Aktivno izkoriščana od 8. 10. 2026 | Apache, Huawei, Oracle | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. |
| CVE-2015-5477 | –Ni ocene | 99,4 % | Aktivno izkoriščana od 8. 10. 2026 | – | ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. |
| CVE-2021-3199 | –Ni ocene | 19,4 % | Aktivno izkoriščana od 8. 10. 2026 | – | ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. |
| CVE-2023-22894 | –Ni ocene | 3,6 % | Aktivno izkoriščana od 8. 10. 2026 | – | Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-servi |
| CVE-2026-104286 | –Ni ocene | 2,2 % | Aktivno izkoriščana od 1. 10. 2026 | – | Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. |
| CVE-2026-102489 | –Ni ocene | 1,3 % | Aktivno izkoriščana od 2. 10. 2026 | – | Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. |
| CVE-2026-102490 | –Ni ocene | 0,6 % | Aktivno izkoriščana od 2. 10. 2026 | – | Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. |
| CVE-2026-96207 | 10 Kritično | 0,5 % | – | – | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-102255 | 10 Kritično | 0,5 % | – | – | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the applianc |
| CVE-2026-76482 | 10 Kritično | 0,2 % | – | – | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review re |
| CVE-2026-90970 | 9,9 Kritično | 0,9 % | – | – | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user wit |
| CVE-2026-94510 | 9,9 Kritično | 0,4 % | – | – | Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-62129 | 9,9 Kritično | 0,3 % | – | – | Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. |
| CVE-2026-59124 | 9,8 Kritično | 1,5 % | – | Microsoft | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. |
| CVE-2026-73009 | 9,8 Kritično | 1,0 % | – | Microsoft | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72979 | 9,8 Kritično | 1,0 % | – | Microsoft | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69586 | 9,8 Kritično | 1,0 % | – | Microsoft | Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72982 | 9,8 Kritično | 1,0 % | – | Microsoft | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
| CVE-2026-88131 | 9,8 Kritično | 0,8 % | – | – | Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network. |
| CVE-2026-20272 | 9,8 Kritično | 0,6 % | – | Cisco | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple intern |
| CVE-2026-78401 | 9,8 Kritično | 0,6 % | – | Ibm | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. |
| CVE-2026-76471 | 9,8 Kritično | 0,5 % | – | – | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due t |
| CVE-2026-76485 | 9,8 Kritično | 0,5 % | – | – | A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on |
| CVE-2026-76501 | 9,8 Kritično | 0,5 % | – | – | A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a |
| CVE-2026-76486 | 9,8 Kritično | 0,5 % | – | – | A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on |
| CVE-2026-78406 | 9,8 Kritično | 0,5 % | – | Ibm | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. |
| CVE-2026-77900 | 9,8 Kritično | 0,5 % | – | – | Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network. |
| CVE-2026-106610 | 9,8 Kritično | 0,5 % | – | – | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7. |
| CVE-2026-76465 | 9,8 Kritično | 0,4 % | – | – | A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code wit |
| CVE-2026-105892 | 9,8 Kritično | 0,4 % | – | – | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: f |
| CVE-2026-104398 | 9,8 Kritično | 0,3 % | – | – | Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10. |
| CVE-2026-78533 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. |
| CVE-2026-78535 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. |
| CVE-2026-76480 | 9,8 Kritično | 0,3 % | – | – | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review re |
| CVE-2026-66567 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. |
| CVE-2026-76500 | 9,8 Kritično | 0,3 % | – | – | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening r |
| CVE-2026-81797 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. |
| CVE-2026-62124 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. |
| CVE-2026-66564 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
| CVE-2026-66568 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
| CVE-2026-66483 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. |
| CVE-2026-66482 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. |
| CVE-2026-66569 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
| CVE-2026-66563 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. |
| CVE-2026-66565 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
| CVE-2026-78531 | 9,8 Kritično | 0,3 % | – | – | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |