{
 "source": "Patch Sonar (patchsonar.com)",
 "license": "https://patchsonar.com/api#terms",
 "updated": "2026-11-04",
 "description": "Zero-days from the last 90 days: exploited before or as the fix came out.",
 "count": 51,
 "items": [
  {
   "cve": "CVE-2026-119977",
   "cves": [
    "CVE-2026-119977"
   ],
   "vendor": "WordPress",
   "product": "WordPress Core",
   "category": "web",
   "categoryName": "Websites & online stores",
   "status": "new",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0102,
   "added": "2026-11-03",
   "cisaDeadline": "2026-11-06",
   "headline": "WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-119977",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-119977"
   ]
  },
  {
   "cve": "CVE-2026-118527",
   "cves": [
    "CVE-2026-118527"
   ],
   "vendor": "Ivanti",
   "product": "Ivanti Connect Secure",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "new",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0082,
   "added": "2026-10-30",
   "cisaDeadline": "2026-11-13",
   "headline": "Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-118527",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527"
   ]
  },
  {
   "cve": "CVE-2026-76418",
   "cves": [
    "CVE-2026-76418"
   ],
   "vendor": "Cisco",
   "product": "Cisco Secure Firewall ASA Software and Cisco Secure FTD Software",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "new",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0082,
   "added": "2026-10-29",
   "cisaDeadline": "2026-11-01",
   "headline": "Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-76418",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76418"
   ]
  },
  {
   "cve": "CVE-2026-111497",
   "cves": [
    "CVE-2026-111497"
   ],
   "vendor": "Google",
   "product": "Brotli / Node.js",
   "category": "dev",
   "categoryName": "Developer, data & AI tools",
   "status": "soon",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.8264,
   "added": "2026-10-27",
   "cisaDeadline": "2026-11-10",
   "headline": "A bug in a common compression library puts Node.js apps at risk",
   "whatToDo": "Upgrade Node.js; there is no workaround. Bun, Envoy, Python, .NET and PHP on Windows have also shipped fixes.",
   "url": "https://patchsonar.com/cve/CVE-2026-111497",
   "sources": [
    "https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html"
   ]
  },
  {
   "cve": "CVE-2026-109619",
   "cves": [
    "CVE-2026-109618",
    "CVE-2026-109619"
   ],
   "vendor": "PHP Group",
   "product": "PHP",
   "category": "web",
   "categoryName": "Websites & online stores",
   "status": "patch",
   "zeroDay": true,
   "ransomware": false,
   "epss": 1,
   "added": "2026-10-26",
   "cisaDeadline": "2026-10-29",
   "headline": "Two PHP flaws let attackers take over web servers with no login",
   "whatToDo": "Upgrade PHP. If a hosting company runs your site, ask them to confirm they've updated. Check for updates to any software or appliance that bundles PHP.",
   "url": "https://patchsonar.com/cve/CVE-2026-109619",
   "sources": [
    "https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html"
   ]
  },
  {
   "cve": "CVE-2026-114625",
   "cves": [
    "CVE-2026-114625"
   ],
   "vendor": "Arista",
   "product": "Arista VeloCloud Orchestrator",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "new",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0103,
   "added": "2026-10-23",
   "cisaDeadline": "2026-10-26",
   "headline": "Arista VeloCloud Orchestrator SQL Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-114625",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-114625"
   ]
  },
  {
   "cve": "CVE-2026-110936",
   "cves": [
    "CVE-2026-110936"
   ],
   "vendor": "Siemens",
   "product": "Siemens Software Center",
   "category": "apps",
   "categoryName": "Other business software",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0097,
   "added": "2026-10-20",
   "cisaDeadline": "2026-11-03",
   "headline": "Siemens Software Center Uncontrolled Search Path Element Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-110936",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-110936"
   ]
  },
  {
   "cve": "CVE-2026-106931",
   "cves": [
    "CVE-2026-106931"
   ],
   "vendor": "EG Secure Solutions",
   "product": "EG Secure Solutions SiteGuard Server Edition",
   "category": "apps",
   "categoryName": "Other business software",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0253,
   "added": "2026-10-20",
   "cisaDeadline": "2026-10-23",
   "headline": "EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-106931",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-106931"
   ]
  },
  {
   "cve": "CVE-2026-102764",
   "cves": [
    "CVE-2026-102764"
   ],
   "vendor": "BeyondTrust",
   "product": "BeyondTrust Remote Support",
   "category": "remote",
   "categoryName": "Remote access & IT tools",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.7799,
   "added": "2026-10-16",
   "cisaDeadline": "2026-10-19",
   "headline": "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-102764",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764"
   ]
  },
  {
   "cve": "CVE-2026-76519",
   "cves": [
    "CVE-2026-76519"
   ],
   "vendor": "Cisco",
   "product": "Cisco Secure Email Gateway",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0215,
   "added": "2026-10-14",
   "cisaDeadline": "2026-10-17",
   "headline": "Cisco Secure Email Gateway Relative Path Traversal Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-76519",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76519"
   ]
  },
  {
   "cve": "CVE-2026-0322",
   "cves": [
    "CVE-2026-0322"
   ],
   "vendor": "Palo Alto Networks",
   "product": "Palo Alto Networks PAN-OS",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0174,
   "added": "2026-10-14",
   "cisaDeadline": "2026-10-17",
   "headline": "Palo Alto Networks PAN-OS Code Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-0322",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322"
   ]
  },
  {
   "cve": "CVE-2026-96951",
   "cves": [
    "CVE-2026-96951"
   ],
   "vendor": "Microsoft",
   "product": "Windows",
   "category": "devices",
   "categoryName": "Phones & computers",
   "status": "soon",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0981,
   "added": "2026-10-13",
   "cisaDeadline": "2026-10-16",
   "headline": "A Windows flaw lets booby-trapped files skip the “Are you sure?” warning",
   "whatToDo": "Open Settings, go to Windows Update, select Check for updates, then install and restart. October was also the last update for Windows 11 24H2 Home and Pro, so upgrade if you're on that version.",
   "url": "https://patchsonar.com/cve/CVE-2026-96951",
   "sources": [
    "https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack",
    "https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/"
   ]
  },
  {
   "cve": "CVE-2026-104935",
   "cves": [
    "CVE-2026-104935"
   ],
   "vendor": "Ivanti",
   "product": "Ivanti Connect Secure",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "patch",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.8894,
   "added": "2026-10-13",
   "cisaDeadline": "2026-10-16",
   "headline": "An Ivanti VPN flaw lets attackers in without a password",
   "whatToDo": "Upgrade Connect Secure to the fixed version.",
   "url": "https://patchsonar.com/cve/CVE-2026-104935",
   "sources": [
    "https://securityaffairs.com/?p=200887"
   ]
  },
  {
   "cve": "CVE-2026-88779",
   "cves": [
    "CVE-2026-88779"
   ],
   "vendor": "Citrix",
   "product": "Citrix NetScaler",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.1139,
   "added": "2026-10-04",
   "cisaDeadline": "2026-10-07",
   "headline": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-88779",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779"
   ]
  },
  {
   "cve": "CVE-2026-102490",
   "cves": [
    "CVE-2026-102490"
   ],
   "vendor": "Zammad GmbH",
   "product": "Zammad GmbH Zammad",
   "category": "apps",
   "categoryName": "Other business software",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.1094,
   "added": "2026-10-02",
   "cisaDeadline": "2026-10-05",
   "headline": "Zammad GmbH Zammad Improper Privilege Management Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-102490",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102490"
   ]
  },
  {
   "cve": "CVE-2026-102489",
   "cves": [
    "CVE-2026-102489"
   ],
   "vendor": "Zammad GmbH",
   "product": "Zammad GmbH Zammad",
   "category": "apps",
   "categoryName": "Other business software",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.2248,
   "added": "2026-10-02",
   "cisaDeadline": "2026-10-05",
   "headline": "Zammad GmbH Zammad Session Fixation Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-102489",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102489"
   ]
  },
  {
   "cve": "CVE-2026-104286",
   "cves": [
    "CVE-2026-104286"
   ],
   "vendor": "Fortinet",
   "product": "Fortinet FortiMail",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0457,
   "added": "2026-10-01",
   "cisaDeadline": "2026-10-04",
   "headline": "Fortinet FortiMail Path Traversal Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-104286",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286"
   ]
  },
  {
   "cve": "CVE-2026-76504",
   "cves": [
    "CVE-2026-76504"
   ],
   "vendor": "Cisco",
   "product": "Cisco Catalyst SD-WAN Manager",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.3893,
   "added": "2026-09-30",
   "cisaDeadline": "2026-10-03",
   "headline": "Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-76504",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76504"
   ]
  },
  {
   "cve": "CVE-2026-86950",
   "cves": [
    "CVE-2026-86950"
   ],
   "vendor": "Apple",
   "product": "iPhone, iPad & Mac",
   "category": "devices",
   "categoryName": "Phones & computers",
   "status": "soon",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.2617,
   "added": "2026-09-29",
   "cisaDeadline": "2026-10-13",
   "headline": "Apple fixes a flaw used in targeted attacks on iPhones and Macs",
   "whatToDo": "On iPhone or iPad: Settings, General, Software Update. On Mac: System Settings, General, Software Update. Until you've updated, don't open unexpected files from strangers.",
   "url": "https://patchsonar.com/cve/CVE-2026-86950",
   "sources": [
    "https://securityonline.info/exploited-apple-zero-day-vulnerability-cve-2026-86950/"
   ]
  },
  {
   "cve": "CVE-2026-88772",
   "cves": [
    "CVE-2026-88772"
   ],
   "vendor": "Citrix",
   "product": "Citrix NetScaler",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.7816,
   "added": "2026-09-27",
   "cisaDeadline": "2026-09-30",
   "headline": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-88772",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88772"
   ]
  },
  {
   "cve": "CVE-2026-88771",
   "cves": [
    "CVE-2026-88771"
   ],
   "vendor": "Citrix",
   "product": "Citrix NetScaler",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.832,
   "added": "2026-09-27",
   "cisaDeadline": "2026-09-30",
   "headline": "Citrix NetScaler Improper Input Validation Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-88771",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88771"
   ]
  },
  {
   "cve": "CVE-2026-87902",
   "cves": [
    "CVE-2026-87902"
   ],
   "vendor": "WordPress",
   "product": "WordPress Core",
   "category": "web",
   "categoryName": "Websites & online stores",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.9577,
   "added": "2026-09-25",
   "cisaDeadline": "2026-09-28",
   "headline": "WordPress Core Remote File Inclusion Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-87902",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902"
   ]
  },
  {
   "cve": "CVE-2026-94127",
   "cves": [
    "CVE-2026-94127"
   ],
   "vendor": "F5",
   "product": "F5 BIG-IP APM",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.2655,
   "added": "2026-09-22",
   "cisaDeadline": "2026-09-25",
   "headline": "F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-94127",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127"
   ]
  },
  {
   "cve": "CVE-2026-93952",
   "cves": [
    "CVE-2026-93952"
   ],
   "vendor": "Arista",
   "product": "Arista VeloCloud Orchestrator",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0138,
   "added": "2026-09-22",
   "cisaDeadline": "2026-09-25",
   "headline": "Arista VeloCloud Orchestrator Improper Input Validation Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-93952",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952"
   ]
  },
  {
   "cve": "CVE-2026-93616",
   "cves": [
    "CVE-2026-93616"
   ],
   "vendor": "Check Point",
   "product": "Check Point Multiple Products",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.9161,
   "added": "2026-09-22",
   "cisaDeadline": "2026-09-25",
   "headline": "Check Point Multiple Products Path Traversal Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-93616",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616"
   ]
  },
  {
   "cve": "CVE-2026-87886",
   "cves": [
    "CVE-2026-87886"
   ],
   "vendor": "Acronis",
   "product": "Acronis Backup",
   "category": "servers",
   "categoryName": "Servers, cloud & backup",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0023,
   "added": "2026-09-16",
   "cisaDeadline": "2026-09-19",
   "headline": "Acronis Backup Incorrect Default Permissions Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-87886",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886"
   ]
  },
  {
   "cve": "CVE-2026-76460",
   "cves": [
    "CVE-2026-76460"
   ],
   "vendor": "Cisco",
   "product": "Cisco Identity Services Engine",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.756,
   "added": "2026-09-16",
   "cisaDeadline": "2026-09-19",
   "headline": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-76460",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460"
   ]
  },
  {
   "cve": "CVE-2026-58704",
   "cves": [
    "CVE-2026-58704"
   ],
   "vendor": "Google",
   "product": "Google Pixel",
   "category": "devices",
   "categoryName": "Phones & computers",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0063,
   "added": "2026-09-16",
   "cisaDeadline": "2026-09-19",
   "headline": "Google Pixel Improper Authorization Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-58704",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704"
   ]
  },
  {
   "cve": "CVE-2026-76461",
   "cves": [
    "CVE-2026-76461"
   ],
   "vendor": "Cisco",
   "product": "Cisco Secure Email Gateway",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.2954,
   "added": "2026-09-14",
   "cisaDeadline": "2026-09-17",
   "headline": "Cisco Secure Email Gateway SQL Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-76461",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461"
   ]
  },
  {
   "cve": "CVE-2026-85706",
   "cves": [
    "CVE-2026-85706"
   ],
   "vendor": "GitLab",
   "product": "GitLab Community Edition and Enterprise Edition",
   "category": "dev",
   "categoryName": "Developer, data & AI tools",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.9736,
   "added": "2026-09-11",
   "cisaDeadline": "2026-09-14",
   "headline": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-85706",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706"
   ]
  },
  {
   "cve": "CVE-2026-84869",
   "cves": [
    "CVE-2026-84869"
   ],
   "vendor": "ConnectWise",
   "product": "ConnectWise ScreenConnect",
   "category": "remote",
   "categoryName": "Remote access & IT tools",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0092,
   "added": "2026-09-11",
   "cisaDeadline": "2026-09-14",
   "headline": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-84869",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869"
   ]
  },
  {
   "cve": "CVE-2026-86060",
   "cves": [
    "CVE-2026-86060"
   ],
   "vendor": "MikroTik",
   "product": "MikroTik RouterOS",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0639,
   "added": "2026-09-10",
   "cisaDeadline": "2026-09-13",
   "headline": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-86060",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060"
   ]
  },
  {
   "cve": "CVE-2026-67277",
   "cves": [
    "CVE-2026-67277"
   ],
   "vendor": "MikroTik",
   "product": "MikroTik RouterOS",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0156,
   "added": "2026-09-10",
   "cisaDeadline": "2026-09-13",
   "headline": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-67277",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277"
   ]
  },
  {
   "cve": "CVE-2026-87491",
   "cves": [
    "CVE-2026-87491"
   ],
   "vendor": "Google",
   "product": "Google Chromium V8",
   "category": "browsers",
   "categoryName": "Web browsers",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0351,
   "added": "2026-09-09",
   "cisaDeadline": "2026-09-23",
   "headline": "Google Chromium V8 Out of Bounds Write Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-87491",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491"
   ]
  },
  {
   "cve": "CVE-2026-86218",
   "cves": [
    "CVE-2026-86218"
   ],
   "vendor": "N-able",
   "product": "N-able N-central",
   "category": "remote",
   "categoryName": "Remote access & IT tools",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.1538,
   "added": "2026-09-08",
   "cisaDeadline": "2026-09-11",
   "headline": "N-able N-central Static Code Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-86218",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218"
   ]
  },
  {
   "cve": "CVE-2026-85880",
   "cves": [
    "CVE-2026-85880"
   ],
   "vendor": "Microsoft",
   "product": "Microsoft Windows",
   "category": "devices",
   "categoryName": "Phones & computers",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0039,
   "added": "2026-09-08",
   "cisaDeadline": "2026-09-22",
   "headline": "Microsoft Windows Heap-Based Buffer Overflow Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-85880",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85880"
   ]
  },
  {
   "cve": "CVE-2026-81963",
   "cves": [
    "CVE-2026-81963"
   ],
   "vendor": "Microsoft",
   "product": "Microsoft Windows",
   "category": "devices",
   "categoryName": "Phones & computers",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0039,
   "added": "2026-09-08",
   "cisaDeadline": "2026-09-22",
   "headline": "Microsoft Windows Link Following Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-81963",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81963"
   ]
  },
  {
   "cve": "CVE-2026-75650",
   "cves": [
    "CVE-2026-75650"
   ],
   "vendor": "Adobe",
   "product": "Adobe Commerce and Magento",
   "category": "web",
   "categoryName": "Websites & online stores",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0395,
   "added": "2026-09-08",
   "cisaDeadline": "2026-09-11",
   "headline": "Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-75650",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650"
   ]
  },
  {
   "cve": "CVE-2026-85046",
   "cves": [
    "CVE-2026-85046"
   ],
   "vendor": "Google",
   "product": "Google Chrome",
   "category": "browsers",
   "categoryName": "Web browsers",
   "status": "soon",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0181,
   "added": "2026-09-04",
   "cisaDeadline": "2026-09-18",
   "headline": "Chrome's sixth zero-day of the year is patched",
   "whatToDo": "Open the Chrome menu, go to Help, then About Google Chrome. Let it update, then relaunch. IT teams should check versions across devices instead of relying on auto-update.",
   "url": "https://patchsonar.com/cve/CVE-2026-85046",
   "sources": [
    "https://esecurityplanet.com/threats/news-google-chrome-cve-2026-85046-zero-day"
   ]
  },
  {
   "cve": "CVE-2026-83549",
   "cves": [
    "CVE-2026-83549"
   ],
   "vendor": "SonicWall",
   "product": "SonicWall SMA1000 Appliances",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0989,
   "added": "2026-09-02",
   "cisaDeadline": "2026-09-05",
   "headline": "SonicWall SMA1000 Appliances OS Command Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-83549",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549"
   ]
  },
  {
   "cve": "CVE-2026-83548",
   "cves": [
    "CVE-2026-83548"
   ],
   "vendor": "SonicWall",
   "product": "SonicWall SMA1000 Appliances",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0804,
   "added": "2026-09-02",
   "cisaDeadline": "2026-09-05",
   "headline": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-83548",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548"
   ]
  },
  {
   "cve": "CVE-2026-82329",
   "cves": [
    "CVE-2026-82329"
   ],
   "vendor": "JFrog",
   "product": "JFrog Artifactory",
   "category": "dev",
   "categoryName": "Developer, data & AI tools",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.1437,
   "added": "2026-09-02",
   "cisaDeadline": "2026-09-05",
   "headline": "JFrog Artifactory Improper Authentication Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-82329",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329"
   ]
  },
  {
   "cve": "CVE-2026-82078",
   "cves": [
    "CVE-2026-82078"
   ],
   "vendor": "PaperCut",
   "product": "PaperCut NG/MF",
   "category": "apps",
   "categoryName": "Other business software",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.6305,
   "added": "2026-08-31",
   "cisaDeadline": "2026-09-14",
   "headline": "PaperCut NG/MF Unsafe Reflection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-82078",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82078"
   ]
  },
  {
   "cve": "CVE-2026-81578",
   "cves": [
    "CVE-2026-81578"
   ],
   "vendor": "PaperCut",
   "product": "PaperCut NG/MF",
   "category": "apps",
   "categoryName": "Other business software",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.8473,
   "added": "2026-08-31",
   "cisaDeadline": "2026-09-14",
   "headline": "PaperCut NG/MF Missing Authentication for Critical Function Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-81578",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81578"
   ]
  },
  {
   "cve": "CVE-2026-60004",
   "cves": [
    "CVE-2026-60004"
   ],
   "vendor": "Gitea",
   "product": "Gitea",
   "category": "dev",
   "categoryName": "Developer, data & AI tools",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.2399,
   "added": "2026-08-25",
   "cisaDeadline": "2026-08-28",
   "headline": "Gitea Code Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-60004",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60004"
   ]
  },
  {
   "cve": "CVE-2026-72530",
   "cves": [
    "CVE-2026-72530"
   ],
   "vendor": "TrueConf",
   "product": "TrueConf Server",
   "category": "office",
   "categoryName": "Office, email & file sharing",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0169,
   "added": "2026-08-20",
   "cisaDeadline": "2026-09-03",
   "headline": "TrueConf Server Code Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-72530",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-72530"
   ]
  },
  {
   "cve": "CVE-2026-72529",
   "cves": [
    "CVE-2026-72529"
   ],
   "vendor": "TrueConf",
   "product": "TrueConf Server",
   "category": "office",
   "categoryName": "Office, email & file sharing",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0146,
   "added": "2026-08-20",
   "cisaDeadline": "2026-08-23",
   "headline": "TrueConf Server Missing Authentication for Critical Function Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-72529",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-72529"
   ]
  },
  {
   "cve": "CVE-2026-64849",
   "cves": [
    "CVE-2026-64849"
   ],
   "vendor": "MLflow",
   "product": "MLflow",
   "category": "dev",
   "categoryName": "Developer, data & AI tools",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.1002,
   "added": "2026-08-19",
   "cisaDeadline": "2026-09-02",
   "headline": "MLflow Server-Side Request Forgery Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-64849",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849"
   ]
  },
  {
   "cve": "CVE-2026-72898",
   "cves": [
    "CVE-2026-72898"
   ],
   "vendor": "Metabase",
   "product": "Metabase",
   "category": "dev",
   "categoryName": "Developer, data & AI tools",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.9881,
   "added": "2026-08-11",
   "cisaDeadline": "2026-08-14",
   "headline": "Metabase SQL Injection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-72898",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-72898"
   ]
  },
  {
   "cve": "CVE-2026-68820",
   "cves": [
    "CVE-2026-68820"
   ],
   "vendor": "Microsoft",
   "product": "Microsoft Windows Ancillary Function Driver for WinSock ",
   "category": "devices",
   "categoryName": "Phones & computers",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0857,
   "added": "2026-08-11",
   "cisaDeadline": "2026-08-25",
   "headline": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-68820",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-68820"
   ]
  },
  {
   "cve": "CVE-2026-20349",
   "cves": [
    "CVE-2026-20349"
   ],
   "vendor": "Cisco",
   "product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ",
   "category": "network",
   "categoryName": "Firewalls, VPNs & network gear",
   "status": "listed",
   "zeroDay": true,
   "ransomware": false,
   "epss": 0.0101,
   "added": "2026-08-11",
   "cisaDeadline": "2026-08-14",
   "headline": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability",
   "whatToDo": "Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.",
   "url": "https://patchsonar.com/cve/CVE-2026-20349",
   "sources": [
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20349"
   ]
  }
 ]
}