Ranljivosti, ki jih je treba najprej popraviti: aktivno izkoriščane (seznam CISA KEV) in kritične z oceno CVSS 9,0 ali več. Pri vsaki vidite verjetnost izkoriščanja (EPSS), proizvajalca in povezavo na podrobnosti.
Ranljivosti, ki jih je CISA v zadnjih 14 dneh uvrstila na seznam KEV (izkoriščanje v praksi) ali imajo oceno CVSS 9,0 ali več. EPSS je verjetnost izkoriščanja v naslednjih 30 dneh. Seznam se osvežuje vsakih nekaj minut.
| CVE | CVSS | EPSS | CISA KEV | Proizvajalec | Opis (NVD, angleško) |
|---|---|---|---|---|---|
| CVE-2026-97229 | 10 Kritično | 27,3 % | Aktivno izkoriščana od 29. 10. 2026 | Gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server |
| CVE-2026-114625 | 9,4 Kritično | 1,0 % | Aktivno izkoriščana od 23. 10. 2026 | Arista | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability |
| CVE-2026-48356 | 9,3 Kritično | 44,6 % | Aktivno izkoriščana od 27. 10. 2026 | Adobe | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session |
| CVE-2026-109618 | 9,2 Kritično | 100,0 % | Aktivno izkoriščana od 26. 10. 2026 | Paloaltonetworks, Php, Siemens | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The su |
| CVE-2026-109619 | 9,2 Kritično | 100,0 % | Aktivno izkoriščana od 26. 10. 2026 | Paloaltonetworks, Php, Siemens | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subse |
| CVE-2026-111497 | 9,2 Kritično | 82,6 % | Aktivno izkoriščana od 27. 10. 2026 | 7-zip, Andybalholm, Anthropic, Apache | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a |
| CVE-2026-110447 | 9,2 Kritično | 73,3 % | Aktivno izkoriščana od 23. 10. 2026 | Collabora | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in |
| CVE-2026-96656 | 8,6 Visoko | 1,8 % | Aktivno izkoriščana od 20. 10. 2026 | Plex | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without si |
| CVE-2026-76418 | 8,6 Visoko | 0,8 % | Aktivno izkoriščana od 29. 10. 2026 | Cisco | A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexp |
| CVE-2026-106931 | 8,5 Visoko | 2,5 % | Aktivno izkoriščana od 20. 10. 2026 | E-guardian | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. |
| CVE-2026-110936 | 8,4 Visoko | 1,0 % | Aktivno izkoriščana od 20. 10. 2026 | Siemens | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially craft |
| CVE-2026-46300 | 7,8 Visoko | 16,1 % | Aktivno izkoriščana od 28. 10. 2026 | Linux, Redhat, Siemens | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain |
| CVE-2026-111357 | 7 Visoko | 0,5 % | Aktivno izkoriščana od 30. 10. 2026 | Ivanti | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026. |
| CVE-2026-96654 | 6,9 Srednje | 1,9 % | Aktivno izkoriščana od 20. 10. 2026 | Plex | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. |
| CVE-2026-96652 | 5,3 Srednje | 1,8 % | Aktivno izkoriščana od 20. 10. 2026 | Plex | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. |
| CVE-2026-96655 | 5,3 Srednje | 1,6 % | Aktivno izkoriščana od 20. 10. 2026 | Plex | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. |
| CVE-2026-41709 | 2,7 Nizko | 0,7 % | Aktivno izkoriščana od 28. 10. 2026 | Vmware | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged. |
| CVE-2026-118527 | –Ni ocene | – | Aktivno izkoriščana od 30. 10. 2026 | – | Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE |
| CVE-2026-10134 | 10 Kritično | 2,3 % | – | Langflow | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abus |
| CVE-2026-110264 | 10 Kritično | 1,3 % | – | Gitlab | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have |
| CVE-2026-110063 | 10 Kritično | 0,9 % | – | – | Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-79847 | 10 Kritično | 0,8 % | – | – | Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to exec |
| CVE-2026-102785 | 10 Kritično | 0,8 % | – | – | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request sign |
| CVE-2026-79851 | 10 Kritično | 0,8 % | – | – | Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating syste |
| CVE-2026-83938 | 10 Kritično | 0,7 % | – | – | Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-105944 | 10 Kritično | 0,7 % | – | – | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of it |
| CVE-2026-111057 | 10 Kritično | 0,7 % | – | – | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefo |
| CVE-2026-79850 | 10 Kritično | 0,7 % | – | – | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary |
| CVE-2026-97785 | 10 Kritično | 0,6 % | – | – | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-61738 | 10 Kritično | 0,6 % | – | – | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and |
| CVE-2026-61564 | 10 Kritično | 0,5 % | – | – | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string lite |
| CVE-2026-101809 | 10 Kritično | 0,5 % | – | – | Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP |
| CVE-2026-61567 | 10 Kritično | 0,5 % | – | – | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An una |
| CVE-2026-91216 | 10 Kritično | 0,5 % | – | Oracle | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via |
| CVE-2026-111813 | 10 Kritično | 0,5 % | – | – | Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, |
| CVE-2026-91221 | 10 Kritično | 0,5 % | – | – | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via |
| CVE-2026-91231 | 10 Kritično | 0,5 % | – | – | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP |
| CVE-2026-91299 | 10 Kritično | 0,5 % | – | – | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with |
| CVE-2026-87337 | 10 Kritično | 0,4 % | – | – | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with netwo |
| CVE-2026-111832 | 10 Kritično | 0,4 % | – | – | Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0. |
| CVE-2026-115905 | 10 Kritično | 0,3 % | – | – | zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the |
| CVE-2026-112816 | 10 Kritično | 0,3 % | – | – | Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed vi |
| CVE-2026-120338 | 10 Kritično | – | – | – | Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the la |
| CVE-2026-7873 | 9,9 Kritično | 1,6 % | – | Langflow | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement. |
| CVE-2026-90868 | 9,9 Kritično | 1,5 % | – | – | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations. |
| CVE-2026-115893 | 9,9 Kritično | 1,0 % | – | – | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. T |
| CVE-2026-113672 | 9,9 Kritično | 0,8 % | – | – | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository r |
| CVE-2026-44179 | 9,9 Kritično | 0,7 % | – | – | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's r |
| CVE-2026-104351 | 9,9 Kritično | 0,6 % | – | – | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability |
| CVE-2026-115931 | 9,9 Kritično | 0,5 % | – | – | Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web |