{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1059 Command and Scripting Interpreter","home_page_url":"https://patchfirst.co/technique/T1059/","feed_url":"https://patchfirst.co/feed/technique/T1059.json","description":"New and newly exploited CVEs that lead to ATT&CK T1059 Command and Scripting Interpreter, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-97229#kev","url":"https://patchfirst.co/cve/CVE-2026-97229/","title":"[KEV] CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","content_text":"GitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-10-29. ENISA EUVD lists it as exploited. EPSS 26.6% (higher than 98% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-31T00:16:52.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-10-29","ransomware":false},"epss":{"score":0.26569,"percentile":0.98015},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community Edition and Enterprise Edition","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-111497#kev","url":"https://patchfirst.co/cve/CVE-2026-111497/","title":"[KEV] CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability","content_text":"Google · Brotli. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 79.8 of 100.","summary":"Google Brotli Unchecked Return Value Vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-30T20:30:11.000Z","tags":["kev","public-exploit","T1190","T1005","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-10-27","ransomware":false},"epss":{"score":0.82641,"percentile":0.99666},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Google","product":"Brotli","techniqueIds":["T1190","T1005","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-48356#kev","url":"https://patchfirst.co/cve/CVE-2026-48356/","title":"[KEV] CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","content_text":"Adobe · Commerce and Magento. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 44.6% (higher than 98.8% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter. Priority 78.3 of 100.","summary":"Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T13:34:50.000Z","tags":["kev","public-exploit","T1189","T1059"],"_patchfirst":{"reason":"kev","priority":78.3,"kev":{"dateAdded":"2026-10-27","ransomware":false},"epss":{"score":0.44579,"percentile":0.98767},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento","techniqueIds":["T1189","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-109618#kev","url":"https://patchfirst.co/cve/CVE-2026-109618/","title":"[KEV] CVE-2026-109618: PHP Memory Corruption Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2026-10-26. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"PHP Memory Corruption Vulnerability","date_published":"2026-10-26T00:00:00.000Z","date_modified":"2026-10-30T19:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2026-10-26","ransomware":false},"epss":{"score":0.99999,"percentile":0.99998},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-109619#kev","url":"https://patchfirst.co/cve/CVE-2026-109619/","title":"[KEV] CVE-2026-109619: PHP Stale Internal Request-State Vulnerability","content_text":"PHP Group · PHP. In CISA KEV since 2026-10-26. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.7 of 100.","summary":"PHP Stale Internal Request-State Vulnerability","date_published":"2026-10-26T00:00:00.000Z","date_modified":"2026-10-30T19:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.7,"kev":{"dateAdded":"2026-10-26","ransomware":false},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"PHP Group","product":"PHP","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-110447#kev","url":"https://patchfirst.co/cve/CVE-2026-110447/","title":"[KEV] CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","content_text":"Collabora · Collabora Online – Built-in CODE Server. In CISA KEV since 2026-10-23. ENISA EUVD lists it as exploited. EPSS 73.3% (higher than 99.46% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 89.4 of 100.","summary":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","date_published":"2026-10-23T00:00:00.000Z","date_modified":"2026-10-30T16:32:46.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":89.4,"kev":{"dateAdded":"2026-10-23","ransomware":false},"epss":{"score":0.73307,"percentile":0.9946},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96656#kev","url":"https://patchfirst.co/cve/CVE-2026-96656/","title":"[KEV] CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 78.3% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.1 of 100.","summary":"Plex Media Server External Control of File Name or Path Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:18.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":73.1,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01785,"percentile":0.78279},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-106931#kev","url":"https://patchfirst.co/cve/CVE-2026-106931/","title":"[KEV] CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","content_text":"EG Secure Solutions · SiteGuard Server Edition. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.9% of CVEs). CVSS 8.5 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 70.7 of 100.","summary":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T15:42:24.000Z","tags":["kev","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":70.7,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.02528,"percentile":0.84877},"cvss":{"score":8.5,"severity":"HIGH","version":"4.0"},"vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-96654#kev","url":"https://patchfirst.co/cve/CVE-2026-96654/","title":"[KEV] CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","content_text":"Plex · Media Server. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 80.2% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.0 of 100.","summary":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:09:37.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.01949,"percentile":0.80195},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Plex","product":"Media Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-110936#kev","url":"https://patchfirst.co/cve/CVE-2026-110936/","title":"[KEV] CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability","content_text":"Siemens · Software Center. In CISA KEV since 2026-10-20. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 61.7% of CVEs). CVSS 6.7 MEDIUM. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1574.008 Path Interception by Search Order Hijacking. Priority 65.0 of 100.","summary":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T13:10:11.000Z","tags":["kev","T1078","T1059","T1574.008"],"_patchfirst":{"reason":"kev","priority":65,"kev":{"dateAdded":"2026-10-20","ransomware":false},"epss":{"score":0.00967,"percentile":0.6171},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1"},"vendor":"Siemens","product":"Software Center","techniqueIds":["T1078","T1059","T1574.008"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-105134#kev","url":"https://patchfirst.co/cve/CVE-2026-105134/","title":"[KEV] CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability","content_text":"Ahsay · AhsayCBS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 81.8% (higher than 99.64% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"Ahsay AhsayCBS Command Injection Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-26T18:06:57.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.81763,"percentile":0.99644},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ahsay","product":"AhsayCBS","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76519#kev","url":"https://patchfirst.co/cve/CVE-2026-76519/","title":"[KEV] CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability","content_text":"Cisco · Secure Email Gateway. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 2.2% (higher than 82.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 76.3 of 100.","summary":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-15T13:47:19.000Z","tags":["kev","public-exploit","T1190","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":76.3,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.02152,"percentile":0.82127},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Secure Email Gateway","techniqueIds":["T1190","T1059","T1105"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-0322#kev","url":"https://patchfirst.co/cve/CVE-2026-0322/","title":"[KEV] CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability","content_text":"Palo Alto Networks · PAN-OS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.7% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.","summary":"Palo Alto Networks PAN-OS Code Injection Vulnerability","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-15T13:47:26.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":73.6,"kev":{"dateAdded":"2026-10-14","ransomware":false},"epss":{"score":0.0174,"percentile":0.77702},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Palo Alto Networks","product":"PAN-OS","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-104935#kev","url":"https://patchfirst.co/cve/CVE-2026-104935/","title":"[KEV] CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-13. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.0 of 100.","summary":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-13T19:24:36.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79,"kev":{"dateAdded":"2026-10-13","ransomware":false},"epss":{"score":0.86766,"percentile":0.99742},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-96951#kev","url":"https://patchfirst.co/cve/CVE-2026-96951/","title":"[KEV] CVE-2026-96951: Microsoft Windows Command Injection Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-10-13. ENISA EUVD lists it as exploited. EPSS 9.8% (higher than 95.5% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.001 Malicious Link; T1059 Command and Scripting Interpreter. Priority 73.3 of 100.","summary":"Microsoft Windows Command Injection Vulnerability","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-29T16:20:22.000Z","tags":["kev","T1204.001","T1059"],"_patchfirst":{"reason":"kev","priority":73.3,"kev":{"dateAdded":"2026-10-13","ransomware":false},"epss":{"score":0.09813,"percentile":0.95543},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.001","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-3199#kev","url":"https://patchfirst.co/cve/CVE-2021-3199/","title":"[KEV] CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability","content_text":"ONLYOFFICE · Docs. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 30.2% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"ONLYOFFICE Docs Server Path Traversal Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:20:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.30244,"percentile":0.98219},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ONLYOFFICE","product":"Docs","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-3081#kev","url":"https://patchfirst.co/cve/CVE-2016-3081/","title":"[KEV] CVE-2016-3081: Apache Struts Command Injection Vulnerability","content_text":"Apache · Struts. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 96.5% (higher than 99.88% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.","summary":"Apache Struts Command Injection Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:43:05.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.6,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.96525,"percentile":0.99882},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Struts","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-102489#kev","url":"https://patchfirst.co/cve/CVE-2026-102489/","title":"[KEV] CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability","content_text":"Zammad GmbH · Zammad. In CISA KEV since 2026-10-02. ENISA EUVD lists it as exploited. EPSS 22.5% (higher than 97.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"Zammad GmbH Zammad Session Fixation Vulnerability","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-10T04:18:08.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.4,"kev":{"dateAdded":"2026-10-02","ransomware":false},"epss":{"score":0.22478,"percentile":0.97703},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zammad GmbH","product":"Zammad","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-102490#kev","url":"https://patchfirst.co/cve/CVE-2026-102490/","title":"[KEV] CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability","content_text":"Zammad GmbH · Zammad. In CISA KEV since 2026-10-02. ENISA EUVD lists it as exploited. EPSS 10.9% (higher than 95.9% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 72.6 of 100.","summary":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-09T14:21:05.000Z","tags":["kev","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":72.6,"kev":{"dateAdded":"2026-10-02","ransomware":false},"epss":{"score":0.10936,"percentile":0.95877},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Zammad GmbH","product":"Zammad","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-86950#kev","url":"https://patchfirst.co/cve/CVE-2026-86950/","title":"[KEV] CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability","content_text":"Apple · Multiple Products. In CISA KEV since 2026-09-29. ENISA EUVD lists it as exploited. EPSS 26.2% (higher than 98% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1059 Command and Scripting Interpreter. Priority 78.8 of 100.","summary":"Apple Multiple Products Out-of-Bounds Write Vulnerability","date_published":"2026-09-29T00:00:00.000Z","date_modified":"2026-10-27T12:29:30.000Z","tags":["kev","public-exploit","T1204.002","T1059"],"_patchfirst":{"reason":"kev","priority":78.8,"kev":{"dateAdded":"2026-09-29","ransomware":false},"epss":{"score":0.26166,"percentile":0.97992},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Apple","product":"Multiple Products","techniqueIds":["T1204.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88771#kev","url":"https://patchfirst.co/cve/CVE-2026-88771/","title":"[KEV] CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 82.2% (higher than 99.66% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Citrix NetScaler Improper Input Validation Vulnerability","date_published":"2026-09-27T00:00:00.000Z","date_modified":"2026-09-29T04:18:01.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-09-27","ransomware":false},"epss":{"score":0.8216,"percentile":0.99655},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88772#kev","url":"https://patchfirst.co/cve/CVE-2026-88772/","title":"[KEV] CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 78.2% (higher than 99.58% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.","summary":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","date_published":"2026-09-27T00:00:00.000Z","date_modified":"2026-09-28T12:26:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-27","ransomware":false},"epss":{"score":0.78162,"percentile":0.99577},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-87902#kev","url":"https://patchfirst.co/cve/CVE-2026-87902/","title":"[KEV] CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability","content_text":"WordPress · Core. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 95.8% (higher than 99.87% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.","summary":"WordPress Core Remote File Inclusion Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-28T12:20:54.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.95769,"percentile":0.99872},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"WordPress","product":"Core","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-65660#kev","url":"https://patchfirst.co/cve/CVE-2026-65660/","title":"[KEV] CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 8.2% (higher than 94.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.1 of 100.","summary":"Microsoft SharePoint Code Injection Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.1,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.08189,"percentile":0.94862},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67279#kev","url":"https://patchfirst.co/cve/CVE-2026-67279/","title":"[KEV] CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.1% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1565.001 Stored Data Manipulation. Priority 74.2 of 100.","summary":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-26T04:17:47.000Z","tags":["kev","public-exploit","T1190","T1059","T1565.001"],"_patchfirst":{"reason":"kev","priority":74.2,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.02277,"percentile":0.83093},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1059","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-93616#kev","url":"https://patchfirst.co/cve/CVE-2026-93616/","title":"[KEV] CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability","content_text":"Check Point · Multiple Products. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 91.6% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Check Point Multiple Products Path Traversal Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T16:38:38.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.91605,"percentile":0.99813},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"Multiple Products","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-85102#kev","url":"https://patchfirst.co/cve/CVE-2026-85102/","title":"[KEV] CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability","content_text":"Check Point · Multiple Products. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 54.1% (higher than 99.01% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.7 of 100.","summary":"Check Point Multiple Products Improper Certificate Validation Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T18:22:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.7,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.5414,"percentile":0.99006},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Check Point","product":"Multiple Products","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-94127#kev","url":"https://patchfirst.co/cve/CVE-2026-94127/","title":"[KEV] CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","content_text":"F5 · BIG-IP APM. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 24.9% (higher than 97.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T14:32:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.4,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.24938,"percentile":0.97912},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP APM","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-7273#kev","url":"https://patchfirst.co/cve/CVE-2026-7273/","title":"[KEV] CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","content_text":"Zyxel · GS1900 Series Switches. In CISA KEV since 2026-09-21. ENISA EUVD lists it as exploited. EPSS 2.8% (higher than 86.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 76.4 of 100.","summary":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","date_published":"2026-09-21T00:00:00.000Z","date_modified":"2026-10-25T23:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":76.4,"kev":{"dateAdded":"2026-09-21","ransomware":false},"epss":{"score":0.02778,"percentile":0.86351},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Zyxel","product":"GS1900 Series Switches","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-76461#kev","url":"https://patchfirst.co/cve/CVE-2026-76461/","title":"[KEV] CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability","content_text":"Cisco · Secure Email Gateway. In CISA KEV since 2026-09-14. ENISA EUVD lists it as exploited. EPSS 29.5% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"Cisco Secure Email Gateway SQL Injection Vulnerability","date_published":"2026-09-14T00:00:00.000Z","date_modified":"2026-09-15T12:47:32.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-09-14","ransomware":false},"epss":{"score":0.29543,"percentile":0.98185},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Secure Email Gateway","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-84869#kev","url":"https://patchfirst.co/cve/CVE-2026-84869/","title":"[KEV] CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","content_text":"ConnectWise · ScreenConnect. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 0.9% (higher than 60.4% of CVEs). CVSS 9.9 CRITICAL. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Priority 67.0 of 100.","summary":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","date_published":"2026-09-11T00:00:00.000Z","date_modified":"2026-09-12T04:16:42.000Z","tags":["kev","T1078","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":67,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.00924,"percentile":0.60395},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"ConnectWise","product":"ScreenConnect","techniqueIds":["T1078","T1059","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-25249#kev","url":"https://patchfirst.co/cve/CVE-2025-25249/","title":"[KEV] CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","content_text":"Fortinet · Multiple Products. In CISA KEV since 2026-09-09. ENISA EUVD lists it as exploited. EPSS 3.7% (higher than 89.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 77.8 of 100.","summary":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","date_published":"2026-09-09T00:00:00.000Z","date_modified":"2026-10-07T18:17:13.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":77.8,"kev":{"dateAdded":"2026-09-09","ransomware":false},"epss":{"score":0.03742,"percentile":0.89842},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"Multiple Products","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-87491#kev","url":"https://patchfirst.co/cve/CVE-2026-87491/","title":"[KEV] CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability","content_text":"Google · Chromium V8. In CISA KEV since 2026-09-09. ENISA EUVD lists it as exploited. EPSS 3.5% (higher than 89.2% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter. Priority 77.0 of 100.","summary":"Google Chromium V8 Out of Bounds Write Vulnerability","date_published":"2026-09-09T00:00:00.000Z","date_modified":"2026-09-21T13:17:11.000Z","tags":["kev","public-exploit","T1189","T1059"],"_patchfirst":{"reason":"kev","priority":77,"kev":{"dateAdded":"2026-09-09","ransomware":false},"epss":{"score":0.03507,"percentile":0.89175},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Google","product":"Chromium V8","techniqueIds":["T1189","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-86218#kev","url":"https://patchfirst.co/cve/CVE-2026-86218/","title":"[KEV] CVE-2026-86218: N-able N-central Static Code Injection Vulnerability","content_text":"N-able · N-central. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 15.4% (higher than 96.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.2 of 100.","summary":"N-able N-central Static Code Injection Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-09T05:18:19.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.2,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.15385,"percentile":0.96781},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"N-able","product":"N-central","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-75650#kev","url":"https://patchfirst.co/cve/CVE-2026-75650/","title":"[KEV] CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","content_text":"Adobe · Commerce and Magento. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 3.9% (higher than 90.4% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.1 of 100.","summary":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-09T05:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.1,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.03949,"percentile":0.90401},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-81963#kev","url":"https://patchfirst.co/cve/CVE-2026-81963/","title":"[KEV] CVE-2026-81963: Microsoft Windows Link Following Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 0.4% (higher than 33.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 65.2 of 100.","summary":"Microsoft Windows Link Following Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-09T05:18:17.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":65.2,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.00393,"percentile":0.33518},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-9586#kev","url":"https://patchfirst.co/cve/CVE-2026-9586/","title":"[KEV] CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability","content_text":"Sangoma · Switchvox. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 19.0% (higher than 97.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.3 of 100.","summary":"Sangoma Switchvox SQL Injection Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-10-24T20:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.18979,"percentile":0.97299},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sangoma","product":"Switchvox","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-83549#kev","url":"https://patchfirst.co/cve/CVE-2026-83549/","title":"[KEV] CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability","content_text":"SonicWall · SMA1000 Appliances. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 9.9% (higher than 95.6% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 77.6 of 100.","summary":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-09-21T14:17:21.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":77.6,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.09889,"percentile":0.95568},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"SonicWall","product":"SMA1000 Appliances","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-49869#kev","url":"https://patchfirst.co/cve/CVE-2026-49869/","title":"[KEV] CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability","content_text":"Kestra · Kestra OSS. In CISA KEV since 2026-09-02. ENISA EUVD lists it as exploited. EPSS 2.1% (higher than 81.6% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 76.3 of 100.","summary":"Kestra OSS OS Command Injection Vulnerability","date_published":"2026-09-02T00:00:00.000Z","date_modified":"2026-10-25T17:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":76.3,"kev":{"dateAdded":"2026-09-02","ransomware":false},"epss":{"score":0.02095,"percentile":0.8164},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Kestra","product":"Kestra OSS","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-82078#kev","url":"https://patchfirst.co/cve/CVE-2026-82078/","title":"[KEV] CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability","content_text":"PaperCut · NG/MF. In CISA KEV since 2026-08-31. ENISA EUVD lists it as exploited. EPSS 63.0% (higher than 99.2% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.1 of 100.","summary":"PaperCut NG/MF Unsafe Reflection Vulnerability","date_published":"2026-08-31T00:00:00.000Z","date_modified":"2026-09-14T00:16:56.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":83.1,"kev":{"dateAdded":"2026-08-31","ransomware":false},"epss":{"score":0.63047,"percentile":0.992},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"PaperCut","product":"NG/MF","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-23758#kev","url":"https://patchfirst.co/cve/CVE-2021-23758/","title":"[KEV] CVE-2021-23758: Ajax.NET Professional Deserialization of Untrusted Data Vulnerability","content_text":"Ajax.NET Professional · Ajax.NET Professional. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Ajax.NET Professional Deserialization of Untrusted Data Vulnerability","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T04:16:38.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-08-26","ransomware":false},"epss":{"score":0.82578,"percentile":0.99665},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ajax.NET Professional","product":"Ajax.NET Professional","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-60004","url":"https://patchfirst.co/cve/CVE-2026-60004/","title":"CVE-2026-60004: Gitea Code Injection Vulnerability","content_text":"Gitea · Gitea. In CISA KEV since 2026-08-25. ENISA EUVD lists it as exploited. EPSS 24.0% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"Gitea Code Injection Vulnerability","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T11:41:19.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"published","priority":79.4,"kev":{"dateAdded":"2026-08-25","ransomware":false},"epss":{"score":0.23988,"percentile":0.97838},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-1068#kev","url":"https://patchfirst.co/cve/CVE-2019-1068/","title":"[KEV] CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability","content_text":"Microsoft · SQL Server. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 57.3% (higher than 99.07% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.0 of 100.","summary":"Microsoft SQL Server Remote Code Execution Vulnerability","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T04:16:38.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79,"kev":{"dateAdded":"2026-08-26","ransomware":false},"epss":{"score":0.57273,"percentile":0.99073},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"SQL Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-73570#kev","url":"https://patchfirst.co/cve/CVE-2026-73570/","title":"[KEV] CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-08-21. ENISA EUVD lists it as exploited. EPSS 71.7% (higher than 99.42% of CVEs). CVSS 8.9 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.1 of 100.","summary":"Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability","date_published":"2026-08-21T00:00:00.000Z","date_modified":"2026-08-24T13:19:17.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2026-08-21","ransomware":false},"epss":{"score":0.71663,"percentile":0.9942},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-72530#kev","url":"https://patchfirst.co/cve/CVE-2026-72530/","title":"[KEV] CVE-2026-72530: TrueConf Server Code Injection Vulnerability","content_text":"TrueConf · Server. In CISA KEV since 2026-08-20. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.7 of 100.","summary":"TrueConf Server Code Injection Vulnerability","date_published":"2026-08-20T00:00:00.000Z","date_modified":"2026-08-21T04:18:15.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.7,"kev":{"dateAdded":"2026-08-20","ransomware":false},"epss":{"score":0.01686,"percentile":0.76994},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"TrueConf","product":"Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-72529#kev","url":"https://patchfirst.co/cve/CVE-2026-72529/","title":"[KEV] CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability","content_text":"TrueConf · Server. In CISA KEV since 2026-08-20. ENISA EUVD lists it as exploited. EPSS 1.5% (higher than 73.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.6 of 100.","summary":"TrueConf Server Missing Authentication for Critical Function Vulnerability","date_published":"2026-08-20T00:00:00.000Z","date_modified":"2026-08-21T04:18:15.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.6,"kev":{"dateAdded":"2026-08-20","ransomware":false},"epss":{"score":0.01464,"percentile":0.73617},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"TrueConf","product":"Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-59310#kev","url":"https://patchfirst.co/cve/CVE-2026-59310/","title":"[KEV] CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability","content_text":"Broadcom · VMware vCenter. In CISA KEV since 2026-08-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 2.6% (higher than 85.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 86.9 of 100.","summary":"Broadcom VMware vCenter Path Traversal Vulnerability","date_published":"2026-08-18T00:00:00.000Z","date_modified":"2026-08-19T04:17:24.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":86.9,"kev":{"dateAdded":"2026-08-18","ransomware":true},"epss":{"score":0.02565,"percentile":0.85103},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Broadcom","product":"VMware vCenter","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-33824#kev","url":"https://patchfirst.co/cve/CVE-2026-33824/","title":"[KEV] CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","content_text":"Microsoft · Internet Key Exchange (IKE) Service Extensions. In CISA KEV since 2026-08-18. ENISA EUVD lists it as exploited. EPSS 77.1% (higher than 99.55% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter. Priority 74.8 of 100.","summary":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","date_published":"2026-08-18T00:00:00.000Z","date_modified":"2026-09-25T18:17:25.000Z","tags":["kev","public-exploit","T1210","T1059"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-08-18","ransomware":false},"epss":{"score":0.77054,"percentile":0.99551},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Internet Key Exchange (IKE) Service Extensions","techniqueIds":["T1210","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-62593#kev","url":"https://patchfirst.co/cve/CVE-2025-62593/","title":"[KEV] CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability","content_text":"Ray-Project · Ray. In CISA KEV since 2026-08-17. ENISA EUVD lists it as exploited. EPSS 60.2% (higher than 99.13% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter. Priority 74.0 of 100.","summary":"Ray-Project Ray Code Injection Vulnerability","date_published":"2026-08-17T00:00:00.000Z","date_modified":"2026-10-19T13:10:00.000Z","tags":["kev","public-exploit","T1189","T1059"],"_patchfirst":{"reason":"kev","priority":74,"kev":{"dateAdded":"2026-08-17","ransomware":false},"epss":{"score":0.6015,"percentile":0.99134},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Ray-Project","product":"Ray","techniqueIds":["T1189","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-72898#kev","url":"https://patchfirst.co/cve/CVE-2026-72898/","title":"[KEV] CVE-2026-72898: Metabase SQL Injection Vulnerability","content_text":"Metabase · Metabase. In CISA KEV since 2026-08-11. ENISA EUVD lists it as exploited. EPSS 98.6% (higher than 99.92% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 80.0 of 100.","summary":"Metabase SQL Injection Vulnerability","date_published":"2026-08-11T00:00:00.000Z","date_modified":"2026-08-12T15:18:30.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2026-08-11","ransomware":false},"epss":{"score":0.98552,"percentile":0.99922},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Metabase","product":"Metabase","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}