Skip to content

Blog · page 3/7

CVE analysis, as it happens

Critical vulnerabilities and CISA KEV additions, explained: what is affected, which versions fix it, and what to check first.

  1. SharePoint CVE-2026-65660 in CISA KEV: Code Injection by an Authenticated Attacker

    CVE-2026-65660: code injection in Microsoft SharePoint by an authenticated attacker, added to CISA KEV on September 25, 2026. No NVD data yet. What to do now.

    CVE-2026-65660 · 4 min

  2. Netcore, FAST and D-Link Routers: 4 Critical CVEs with Public Exploits and No Fix

    Netcore NR289-GE (two 10.0 CVEs), FAST FAC1200R (9.9) and D-Link DI-8400 (9.1): public exploits, two vendors silent. Isolate or replace these routers now.

    CVE-2026-101072 CVE-2026-101077 CVE-2026-101038 CVE-2026-101081 · 4 min

  3. MikroTik RouterOS CVE-2026-67279 in CISA KEV: the Link That Makes CVE-2026-86060 Unauthenticated

    CVE-2026-67279: a RouterOS workflow flaw opens a session without authentication and chains with CVE-2026-86060. Added to CISA KEV on Sept 25. What to do.

    CVE-2026-67279 · 4 min

  4. X-SpringBoot CVE-2026-97063 and Contrast CVE-2026-100833 (Fixed in 1.23.1): Two Critical Open Source CVEs

    X-SpringBoot returns login codes in the HTTP response (9.1), and Contrast lets a confidential container image be swapped (9.6, fixed in 1.23.1). What to do.

    CVE-2026-97063 CVE-2026-100833 · 4 min

  5. WordPress Core CVE-2026-87902 in CISA KEV: File Inclusion via Page Templates

    CVE-2026-87902: WordPress core can be made to include a local .php file outside the active theme, without authentication. Added to CISA KEV, no NVD data yet.

    CVE-2026-87902 · 4 min

  6. Citrix NetScaler CVE-2026-88771 and 88772 in CISA KEV: Fixed in 14.1-73.37 and 13.1-64.23

    NetScaler ADC and Gateway: six CVEs published on September 27, including an unauthenticated 9.8 RCE and an 8.1 already in CISA KEV. Fixed versions, priorities.

    CVE-2026-88771 CVE-2026-88772 CVE-2026-88773 CVE-2026-88775 +2 · 5 min

  7. WSO2 CVE-2026-5430 in CISA KEV: One 10.0 CVE, Two Descriptions That Don't Match

    CVE-2026-5430 (10.0) on WSO2 API Manager and gateways: CISA describes a path traversal, NVD a JWT algorithm confusion. What to do regardless.

    CVE-2026-5430 · 4 min

  8. Adobe September 2026: Magento Back in KEV, 10 Critical CVEs in Campaign, AEM Forms and Connect

    CVE-2026-71362 (Magento, CISA KEV) and Adobe's September batch: 7 Campaign Classic CVEs incl. two 10.0 RCEs, AEM Forms JEE 10.0, two Connect XSS.

    CVE-2026-71362 CVE-2026-75699 CVE-2026-75721 CVE-2026-75745 +7 · 4 min

  9. SolarWinds Observability Self-Hosted CVE-2026-28324: Conditional Unauthenticated 9.8 RCE

    CVE-2026-28324 (9.8): unauthenticated RCE in SolarWinds Observability Self-Hosted, limited to non-default, non-secure configurations. How to assess yours.

    CVE-2026-28324 · 3 min

  10. orval: 3 Code Injections at 9.8 via an OpenAPI Spec — Fixed in 8.29.0

    CVE-2026-96754, 96755 and 96759: the orval generator turns a booby-trapped OpenAPI spec into code run at build time or in the browser. Fixed in 8.29.0.

    CVE-2026-96754 CVE-2026-96755 CVE-2026-96759 · 4 min

  11. Arista VeloCloud Orchestrator CVE-2026-93952: 10.0 in CISA KEV, Only On-Prem Must Act

    CVE-2026-93952 (10.0) on on-prem VeloCloud Orchestrator, in CISA KEV. Second VCO KEV entry in two months; hosted instances are already patched.

    CVE-2026-93952 · 3 min

  12. F5 BIG-IP APM CVE-2026-94127: Unauthenticated RCE When APM Is an OAuth Authorization Server

    CVE-2026-94127 (9.8, CISA KEV): F5 BIG-IP APM heap overflow, only when APM is an OAuth authorization server. Check in two minutes if you're affected.

    CVE-2026-94127 · 4 min

  13. Check Point: CVE-2026-85102 (VPN) and CVE-2026-93616 (Management) in CISA KEV

    Two unauthenticated 9.8 Check Point RCEs added to KEV on September 22: VPN certificate validation on gateways, script upload on the Management Server.

    CVE-2026-85102 CVE-2026-93616 · 3 min

  14. Linux Kernel: 3 CVEs Added to CISA KEV on the Same Day — kTLS, ebtables and AF_ALG

    CVE-2025-39682 (kTLS), CVE-2026-53266 (ebtables SNAT) and CVE-2025-39964 (AF_ALG) added to CISA KEV on September 18. Why the kernel version isn't enough.

    CVE-2025-39682 CVE-2026-53266 CVE-2025-39964 · 4 min

  15. Cisco ISE and Secure Email Gateway: CVE-2026-76460 and 76461 in CISA KEV

    Cisco Secure Email Gateway (SQL injection to root, unauthenticated) and Cisco ISE (management interface bypass) added to CISA KEV.

    CVE-2026-76460 CVE-2026-76461 · 3 min

  16. VoIP: Sangoma Switchvox CVE-2026-9586 in KEV, sngrep CVE-2026-90558 a 9.8 RCE

    Sangoma Switchvox (unauthenticated SQL injection, CISA KEV) and sngrep ≤ 1.8.4 (9.8 RCE): IP telephony targeted from both ends.

    CVE-2026-9586 CVE-2026-90558 · 5 min

  17. MISP CVE-2026-86419: SSRF and Credential Leak in the Threat Intel Platform (≤ 2.5.45)

    MISP ≤ 2.5.45 (CVE-2026-86419, 9.1): SSRF and feed credentials forwarded to a third-party host via redirects. What the fix teaches.

    CVE-2026-86419 · 5 min

  18. LLM Gateways: LiteLLM CVE-2026-59822 in KEV, LightLLM CVE-2026-90919 a 9.8 RCE

    LiteLLM CVE-2026-59822 in CISA KEV (fixed in 1.84.0) and LightLLM CVE-2026-90919, a 9.8 RCE via pickle: AI infrastructure targeted.

    CVE-2026-59822 CVE-2026-90919 · 6 min

  19. CVE-2025-25249 FortiOS: in CISA KEV Eight Months After Publication — Fixed in 7.6.4, 7.4.9, 7.2.12

    CVE-2025-25249 FortiOS (8.1): published in January, in CISA KEV in September. Fixed in 7.6.4, 7.4.9, 7.2.12, 7.0.18; 6.4 is EOL.

    CVE-2025-25249 · 5 min

  20. The Events Calendar ≤ 6.17.4: 2 Unauthenticated RCEs via Comments

    CVE-2026-78006 and CVE-2026-78159 (CVSS 9.8): unauthenticated code execution in the WordPress plugin The Events Calendar, through a comment awaiting moderation. Immediate mitigation.

    CVE-2026-78006 CVE-2026-78159 · 7 min