# KEVWire

> Source-reviewed editorial records covering exploited vulnerabilities, notable disclosed breaches, and AI security research.

Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends.
Configured publication origin. This endpoint makes no indexing or coverage promises.

## Evidence and limitations
KEV is known exploitation, not necessarily a zero-day. Federal due dates are not your SLA.
EPSS scores are dated model estimates for the following 30 days; missing metrics stay unknown.
Reporting is not independently primary-confirmed. AI infrastructure is not attacker AI attribution.
Local user-supplied review marker only; not verified remediation, patching, or lack of exposure.

## Endpoints
https://kevwire.com/api/intel
https://kevwire.com/api/sources
https://kevwire.com/api/health
https://kevwire.com/api/trends
https://kevwire.com/api/export.csv
https://kevwire.com/api/export.json
https://kevwire.com/feed.xml
https://kevwire.com/api/schema.json
https://kevwire.com/sitemap.xml
The intelligence API is paginated (default 25, maximum 100); search addresses the whole retained corpus.

## Source status
Editorial Evidence Review: editorial; 19 retained records. Last success: none. Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends. A manually reviewed, dated editorial sample, not a live feed. Source claims and dates remain tied to each record; no invented scores or trends.
CISA Known Exploited Vulnerabilities: live; 1756 retained records. Last success: 2026-10-26T18:50:55.739Z. The full successfully validated KEV catalog, without a newest-record slice. Known exploitation is not necessarily a zero-day. KEV-only publication dates denote catalog additions, not initial disclosure. Due dates concern covered US federal agencies, not your SLA. The last complete catalog is retained for 30 days; oversized or incomplete replacements are rejected, not truncated.
GitHub Public Security Advisories: cached; 308 retained records. Last success: 2026-10-26T18:40:59.678Z. GitHub-reviewed public advisories, sorted by update date; at most 3 cursor pages of 100 records per cycle, without authentication. Not the entire advisory database. GitHub review is upstream review, not local editorial review or proof of remediation. Withdrawn advisories are excluded. Retained union is bounded to 2,000 records updated within 180 days; public API rate limits can reduce coverage.
JPCERT/CC Japan Advisories: live; 32 retained records. Last success: 2026-10-26T18:40:55.873Z. Current Japanese-language alerts and weekly report entries, with the exact article or weekly-report anchor. RSS usually supplies only a Japanese title and date. Titles matching JPCERT/CC's fixed patterns are shown in English via a deterministic glossary translation with the original Japanese retained; unmatched titles stay in Japanese rather than being guessed. No affected-version detail is invented. Japan denotes this advisory audience, not a scan or proof of exposure. Up to 500 records are retained for 365 days.
Google Project Zero Research: live; 10 retained records. Last success: 2026-10-26T18:35:57.768Z. Security-research entries in the official Atom feed, including explicit AI-defense research when present; no archive crawling. The official feed is large but contains a bounded current entry list. Excerpts are not full articles. Ordinary fuzzing, automation, and exploit research are not classified as AI. Up to 250 records are retained for 730 days.
Google Security Research: live; 47 retained records. Last success: 2026-10-26T18:35:57.804Z. At most the 50 entries supplied by the official Google Security RSS endpoint; security-topic filtering and conservative, source-linked AI classifications. Not all Google research or all AI defense. Product security and prompt-injection research do not establish attacker AI use. Excerpts are not independently reproduced findings. Up to 250 records are retained for 730 days.
NVD Recently Published CVEs: live; 5738 retained records. Last success: 2026-10-26T18:21:53.012Z. Every CVE in the NVD, from any vendor worldwide, that any scorer (the vendor/CNA, NVD, or CISA) rates HIGH or CRITICAL, or that CISA's assessment reports as actively exploited. A 14-day backfill on first run, then every CVE modified since the last successful retrieval. Medium and low severity CVEs are not ingested; unscored CVEs appear once scored. The CNA (vendor) score is preferred over NVD's own when both exist. NVD publication is not evidence of exploitation. Up to 6,000 records are retained for 120 days.
BleepingComputer Security Reporting: unavailable; 0 retained records. Last success: none. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
The Hacker News: live; 30 retained records. Last success: 2026-10-26T18:50:55.718Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
SecurityWeek: live; 6 retained records. Last success: 2026-10-26T18:50:55.667Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Help Net Security: live; 1 retained records. Last success: 2026-10-26T18:45:58.962Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
The Record (Recorded Future News): cached; 1 retained records. Last success: 2026-10-26T14:15:57.066Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Axios: live; 3 retained records. Last success: 2026-10-26T18:50:55.667Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
TechCrunch Security: live; 3 retained records. Last success: 2026-10-26T18:50:55.649Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
WIRED Security: live; 5 retained records. Last success: 2026-10-26T18:50:55.667Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
The Verge (AI): live; 0 retained records. Last success: 2026-10-26T18:50:55.667Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
404 Media: live; 0 retained records. Last success: 2026-10-26T18:50:55.718Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Have I Been Pwned: live; 121 retained records. Last success: 2026-10-26T18:25:57.041Z. Breaches loaded into Have I Been Pwned in the last year: breached organization, account count, exposed data types, breach and load dates, and the organization's disclosure when HIBP links one. HIBP covers breaches whose data it obtained and loaded; many breaches never appear there. Counts are accounts in the loaded data, not necessarily people. Unverified breaches are labeled as such; fabricated, spam-list, retired, and sensitive breaches are skipped. Up to 400 records are retained for 365 days.
DataBreaches.net: live; 5 retained records. Last success: 2026-10-26T18:40:55.873Z. Breach and incident reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
The HIPAA Journal: live; 7 retained records. Last success: 2026-10-26T18:25:57.095Z. Healthcare breach and security reporting selected from the current feed; compliance guides and opinion are skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Anthropic: live; 1 retained records. Last success: 2026-10-26T18:25:59.739Z. Anthropic news posts about misuse, threats, safety, and security, found through its sitemap (it publishes no feed); at most 8 new pages are read per run. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
OpenAI: live; 61 retained records. Last success: 2026-10-26T18:25:55.704Z. OpenAI news posts about misuse, threats, safety, and security; product and business posts are skipped. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Google DeepMind: live; 1 retained records. Last success: 2026-10-26T18:25:55.704Z. Google DeepMind blog posts about misuse, threats, safety, and security; product and research-only posts are skipped. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Microsoft Security blog: live; 4 retained records. Last success: 2026-10-26T18:50:59.031Z. Microsoft Threat Intelligence and security posts: vulnerabilities, threat actors, and AI misuse it observed. The publishing company's own reporting about threats it observed; not independently confirmed here. Marketing posts are skipped. Up to 300 records are retained for 365 days.
AI Incident Database: live; 49 retained records. Last success: 2026-10-26T18:46:59.993Z. Reports newly added to the AI Incident Database (Responsible AI Collaborative) that concern security or misuse (deepfakes, scams, influence operations, attacks on or by AI, unauthorized actions), each linking to the original report on its publisher's site. Vehicle crashes, lawsuits, bias, errors, and other non-security harms are skipped; non-English reports usually are too, because the filter reads English. Inclusion in the database means an editor judged it an AI incident; it is not an independent investigation. The linked report is the evidence. An AI role is assigned only when the report title states it. Up to 500 records are retained for 365 days.
FIRST EPSS: live; 6700 retained records. Last success: 2026-10-26T13:40:30.430Z. Measured EPSS rows for real CVE identifiers already in this corpus; batches of at most 80 identifiers and under 1,900 CVE-query characters. Daily model scores estimate exploitation in the following 30 days, not organizational exposure. Missing CVEs receive no default score. Exact scoring dates and per-CVE/date API evidence are retained for 30 days; scores older than 2 days are stale even if a retrieval succeeds.
CVE Program CVSS Enrichment: live; 140 retained records. Last success: 2026-10-26T18:41:03.388Z. At most 8 published per-CVE documents per cycle, one request at a time, for missing CVSS or an editorial CVE-API measurement not yet rechecked; no NVD polling. Targeted enrichment, not full CVE coverage. CNA CVSS is preferred; if absent, an explicitly labeled public ADP assessment can supply the actual metric and authoritative source update date. A document with no usable CVSS is not a metric-ingestion success. Unscored targets are deferred for 24 hours. Up to 4,000 enrichments are retained for 30 days.

## Current first-page records

### PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
https://kevwire.com/record/CVE-2026-109618
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (Oct 22, 2026).
The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

 Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

 Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

 Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. 

 The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

 State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

 What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

 "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

 The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

 Read more below. 

 What is PHP?

 You've probably never heard of PHP, even though you've interacted with it for decades.

 PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

 It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

 It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. 

 How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

 What was the PHP vulnera
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109618).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-25).
Sources:
Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency: https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites
Axios syndication feed: https://api.axios.com/feed/
NVD CVE-2026-109618: https://nvd.nist.gov/vuln/detail/CVE-2026-109618
Vendor advisory (via NVD references): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (updated): https://www.jpcert.or.jp/at/2026/at260033.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware: https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity: https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed: https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge: https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't: https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html
The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities: https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/
SecurityWeek syndication feed: https://www.securityweek.com/feed/
SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells: https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/
SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits: https://therecord.media/php-php2shell-exploitation-attempts-pocs
The Record (Recorded Future News) syndication feed: https://therecord.media/feed
WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-25

### Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2026-0257
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (Oct 20, 2026).
Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched...
 Source
CVSS 7.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0257).
EPSS 95.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-0257&date=2026-10-25).
Sources:
DataBreaches.net: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA: https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/
DataBreaches.net syndication feed: https://databreaches.net/feed/
NVD CVE-2026-0257: https://nvd.nist.gov/vuln/detail/CVE-2026-0257
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0257
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-0257: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-0257&date=2026-10-25

### EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-106931
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (Oct 20, 2026).
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
CVSS 8.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106931).
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106931&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-106931: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
JPCERT/CC Japan Advisories: Security alert: OS command injection vulnerability in SiteGuard Server Edition (CVE-2026-106931) (published): https://www.jpcert.or.jp/at/2026/at260032.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
NVD CVE-2026-106931: https://nvd.nist.gov/vuln/detail/CVE-2026-106931
Vendor advisory (via NVD references): https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106931&date=2026-10-25

### Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-110447
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (Oct 14, 2026).
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110447).
EPSS 12.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110447&date=2026-10-25).
Sources:
NVD CVE-2026-110447: https://nvd.nist.gov/vuln/detail/CVE-2026-110447
Vendor advisory (via NVD references): https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
CISA KEV entry CVE-2026-110447: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud: https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110447&date=2026-10-25

### Ahsay AhsayCBS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-105134
Ahsay AhsayCBS Command Injection Vulnerability (Oct 4, 2026).
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVSS 10.0 (version 4.0; evidence as of Oct 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-105134).
EPSS 86.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105134&date=2026-10-25).
Sources:
NVD CVE-2026-105134: https://nvd.nist.gov/vuln/detail/CVE-2026-105134
Vendor advisory (via NVD references): https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-105134: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105134&date=2026-10-25
CVE Program CNA VulDB: https://cveawg.mitre.org/api/cve/CVE-2026-105134

### Ahsay AhsayCBS Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2026-105133
Ahsay AhsayCBS Improper Authentication Vulnerability (Oct 4, 2026).
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVSS 6.9 (version 4.0; evidence as of Oct 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-105133).
EPSS 79.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105133&date=2026-10-25).
Sources:
NVD CVE-2026-105133: https://nvd.nist.gov/vuln/detail/CVE-2026-105133
Vendor advisory (via NVD references): https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-105133: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105133&date=2026-10-25
CVE Program CNA VulDB: https://cveawg.mitre.org/api/cve/CVE-2026-105133

### Arista VeloCloud Orchestrator SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-114625
Arista VeloCloud Orchestrator SQL Injection Vulnerability (Oct 22, 2026).
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
CVSS 9.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114625).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114625&date=2026-10-25).
Sources:
NVD CVE-2026-114625: https://nvd.nist.gov/vuln/detail/CVE-2026-114625
Vendor advisory (via NVD references): https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
CISA KEV entry CVE-2026-114625: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114625&date=2026-10-25

### BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
https://kevwire.com/record/CVE-2026-102764
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (Oct 15, 2026).
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
CVSS 9.3 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102764).
EPSS 20.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102764&date=2026-10-25).
Sources:
NVD CVE-2026-102764: https://nvd.nist.gov/vuln/detail/CVE-2026-102764
Vendor advisory (via NVD references): https://www.beyondtrust.com/blog/entry/bt26-05
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
CISA KEV entry CVE-2026-102764: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102764&date=2026-10-25

### Siemens Software Center Uncontrolled Search Path Element Vulnerability
https://kevwire.com/record/CVE-2026-110936
Siemens Software Center Uncontrolled Search Path Element Vulnerability (Oct 15, 2026).
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
CVSS 8.4 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110936).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110936&date=2026-10-25).
Sources:
NVD CVE-2026-110936: https://nvd.nist.gov/vuln/detail/CVE-2026-110936
Vendor advisory (via NVD references): https://cert-portal.siemens.com/productcert/html/ssa-580366.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
CISA KEV entry CVE-2026-110936: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110936&date=2026-10-25

### Palo Alto Networks PAN-OS Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-0322
Palo Alto Networks PAN-OS Code Injection Vulnerability (Oct 14, 2026).
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.



The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .



This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).



Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0322).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-0322&date=2026-10-25).
Sources:
NVD CVE-2026-0322: https://nvd.nist.gov/vuln/detail/CVE-2026-0322
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0322
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
CISA KEV entry CVE-2026-0322: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-0322&date=2026-10-25

### Cisco Secure Email Gateway Relative Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-76519
Cisco Secure Email Gateway Relative Path Traversal Vulnerability (Oct 14, 2026).
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76519).
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76519&date=2026-10-25).
Sources:
NVD CVE-2026-76519: https://nvd.nist.gov/vuln/detail/CVE-2026-76519
Vendor advisory (via NVD references): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
CISA KEV entry CVE-2026-76519: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76519&date=2026-10-25

### Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
https://kevwire.com/record/CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (Oct 13, 2026).
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVSS 8.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104935).
EPSS 86.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104935&date=2026-10-25).
Sources:
NVD CVE-2026-104935: https://nvd.nist.gov/vuln/detail/CVE-2026-104935
Vendor advisory (via NVD references): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
CISA KEV entry CVE-2026-104935: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104935&date=2026-10-25

### Microsoft Windows Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-96951
Microsoft Windows Command Injection Vulnerability (Oct 13, 2026).
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96951).
EPSS 9.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96951&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96951: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
NVD CVE-2026-96951: https://nvd.nist.gov/vuln/detail/CVE-2026-96951
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96951&date=2026-10-25

### Citrix NetScaler Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2026-88771
Citrix NetScaler Improper Input Validation Vulnerability (Oct 2, 2026).
Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)
CVSS 9.5 (version 4.0; evidence as of Sep 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-88771).
EPSS 82.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88771&date=2026-10-25).
Sources:
JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated): https://www.jpcert.or.jp/at/2026/at260029.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
CISA KEV entry CVE-2026-88771: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88771&date=2026-10-25
CVE Program CNA NetScaler: https://cveawg.mitre.org/api/cve/CVE-2026-88771

### Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
https://kevwire.com/record/CVE-2026-88772
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (Oct 2, 2026).
Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)
CVSS 9.5 (version 4.0; evidence as of Sep 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-88772).
EPSS 78.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88772&date=2026-10-25).
Sources:
JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated): https://www.jpcert.or.jp/at/2026/at260029.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
CISA KEV entry CVE-2026-88772: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88772&date=2026-10-25
CVE Program CNA NetScaler: https://cveawg.mitre.org/api/cve/CVE-2026-88772

### Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2026-96652
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (Oct 20, 2026).
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
CVSS 5.3 (version 4.0; evidence as of Sep 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-96652).
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96652&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96652: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96652&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-96652

### Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
https://kevwire.com/record/CVE-2026-96654
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (Oct 20, 2026).
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
CVSS 6.9 (version 4.0; evidence as of Oct 20, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-96654).
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96654&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96654: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96654&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-96654

### Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2026-96655
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (Oct 20, 2026).
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
CVSS 5.3 (version 4.0; evidence as of Sep 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-96655).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96655&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96655: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96655&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-96655

### Plex Media Server External Control of File Name or Path Vulnerability
https://kevwire.com/record/CVE-2026-96656
Plex Media Server External Control of File Name or Path Vulnerability (Oct 20, 2026).
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
CVSS 8.6 (version 4.0; evidence as of Sep 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-96656).
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96656&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96656: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96656&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-96656

### Fortinet Multiple Products Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-61624
Fortinet Multiple Products Path Traversal Vulnerability (Oct 16, 2026).
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
CVSS 5.4 (version 3.1; evidence as of Apr 14, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-61624).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-61624&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-61624: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-61624&date=2026-10-25
CVE Program CNA fortinet: https://cveawg.mitre.org/api/cve/CVE-2025-61624

### Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
https://kevwire.com/record/CVE-2026-21589
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (Oct 15, 2026).
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-21589).
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21589&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21589: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21589&date=2026-10-25
CVE Program CNA atlassian: https://cveawg.mitre.org/api/cve/CVE-2026-21589

### ProFTPD Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2015-3306
ProFTPD Improper Access Control Vulnerability (Oct 8, 2026).
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVSS 10.0 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2015-3306).
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-3306&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-3306: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-3306&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2015-3306

### ISC BIND Data Processing Errors Vulnerability
https://kevwire.com/record/CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability (Oct 8, 2026).
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
CVSS 7.5 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2015-5477).
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-5477&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-5477: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-5477&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2015-5477

### Apache Struts Command Injection Vulnerability
https://kevwire.com/record/CVE-2016-3081
Apache Struts Command Injection Vulnerability (Oct 8, 2026).
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
CVSS 8.1 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2016-3081).
EPSS 96.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3081&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3081: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3081&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2016-3081

### ONLYOFFICE Docs Server Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-3199
ONLYOFFICE Docs Server Path Traversal Vulnerability (Oct 8, 2026).
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
CVSS 9.8 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2021-3199).
EPSS 30.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-3199&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-3199: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-3199&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2021-3199

Trend methodology: Counts of records in the last complete validated CISA KEV catalog, grouped by each source dateAdded month (UTC calendar month). The denominator is the disclosed current catalog, not the editorial sample. This measures catalog additions represented in that snapshot, not worldwide attacks, discovery dates, zero-days, or causation by AI; removals can change historical counts.
Trend corpus: 1756 CISA entries; source as of 2026-10-23T19:30:18.920Z.