Aggregated Known Exploited Vulnerabilities Catalogs

[ENISA] CVE-2026-82329 - Confirmed Exploitation

Fri, 02 Oct 2026 08:52:36 +0000

CVE-2026-82329

Catalog: ENISA

Status: Confirmed

Exploited: Yes

Status Updated: 2026-10-02 08:52 UTC

Evidence Sources: 1

Scope Notes: Affected: JFrog / Artifactory | Description: Authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. | Patched since: 2026/08/28 | Exploitation type: unknown | CWEs: CWE-287 | Origin source: ENISA | Notes: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

[CISA] CVE-2026-104286 - Confirmed Exploitation

Thu, 01 Oct 2026 02:00:00 +0000

CVE-2026-104286

Catalog: CISA

Status: Confirmed

Exploited: Yes

Status Updated: 2026-10-01 02:00 UTC

Evidence Sources: 1

First Seen: 2026-10-01

Asserted: 2026-10-01

Scope Notes: Fortinet FortiMail Path Traversal Vulnerability | Affected: Fortinet / FortiMail | Description: Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286

[ENISA] CVE-2026-104286 - Confirmed Exploitation

Thu, 01 Oct 2026 02:00:00 +0000

CVE-2026-104286

Catalog: ENISA

Status: Confirmed

Exploited: Yes

Status Updated: 2026-10-01 02:00 UTC

Evidence Sources: 1

First Seen: 2026-10-01

Asserted: 2026-10-01

Scope Notes: Affected: Fortinet / FortiMail | Description: Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Customers are urged to disable the IBE feature support or disable access to the FortiMail management interface from the internet or limit the access only from trusted private network. | Exploitation type: unknown | CWEs: CWE-22, CWE-158 | Origin source: CNW | Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-175

[Previdian] CVE-2024-58387 - Confirmed Exploitation

Wed, 30 Sep 2026 22:40:21 +0000

CVE-2024-58387

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 22:40 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

[Previdian] CVE-2023-54403 - Confirmed Exploitation

Wed, 30 Sep 2026 22:40:20 +0000

CVE-2023-54403

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 22:40 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

[Previdian] CVE-2023-54402 - Confirmed Exploitation

Wed, 30 Sep 2026 22:30:25 +0000

CVE-2023-54402

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 22:30 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

[Previdian] CVE-2018-17254 - Confirmed Exploitation

Wed, 30 Sep 2026 22:26:12 +0000

CVE-2018-17254

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 22:26 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

Scope Notes: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. | Affected: Arkextensions / JCK Editor | CVSS: 9.8 (CRITICAL) | EPSS: 0.82976 | Used in malware: unknown | Not yet in CISA KEV: True

[Previdian] CVE-2026-102490 - Confirmed Exploitation

Wed, 30 Sep 2026 20:53:04 +0000

CVE-2026-102490

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 20:53 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

[Previdian] CVE-2026-102489 - Confirmed Exploitation

Wed, 30 Sep 2026 20:52:45 +0000

CVE-2026-102489

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 20:52 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

[Previdian] CVE-2026-76504 - Confirmed Exploitation

Wed, 30 Sep 2026 15:49:09 +0000

CVE-2026-76504

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 15:49 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

[ENISA] CVE-2026-102489 - Confirmed Exploitation

Wed, 30 Sep 2026 02:00:00 +0000

CVE-2026-102489

Catalog: ENISA

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 02:00 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

Scope Notes: Affected: Zammad / Zammad | Description: Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions. | Patched since: 2026/04/08 | Exploitation type: unknown | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu

[CISA] CVE-2026-76504 - Confirmed Exploitation

Wed, 30 Sep 2026 02:00:00 +0000

CVE-2026-76504

Catalog: CISA

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 02:00 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

Scope Notes: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | Affected: Cisco / Catalyst SD-WAN Manager | Description: Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76504

[ENISA] CVE-2026-102490 - Confirmed Exploitation

Wed, 30 Sep 2026 02:00:00 +0000

CVE-2026-102490

Catalog: ENISA

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-30 02:00 UTC

Evidence Sources: 1

First Seen: 2026-09-30

Asserted: 2026-09-30

Scope Notes: Affected: Zammad / Zammad | Description: All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root. | Exploitation type: unknown | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu

[Previdian] CVE-2023-54400 - Confirmed Exploitation

Tue, 29 Sep 2026 17:30:26 +0000

CVE-2023-54400

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-29 17:30 UTC

Evidence Sources: 1

First Seen: 2026-09-29

Asserted: 2026-09-29

[Previdian] CVE-2015-20122 - Confirmed Exploitation

Tue, 29 Sep 2026 17:10:34 +0000

CVE-2015-20122

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-29 17:10 UTC

Evidence Sources: 1

First Seen: 2026-09-29

Asserted: 2026-09-29

[Previdian] CVE-2026-85520 - Confirmed Exploitation

Tue, 29 Sep 2026 13:40:26 +0000

CVE-2026-85520

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-29 13:40 UTC

Evidence Sources: 1

First Seen: 2026-09-29

Asserted: 2026-09-29

[Previdian] CVE-2025-62023 - Confirmed Exploitation

Tue, 29 Sep 2026 09:10:24 +0000

CVE-2025-62023

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-29 09:10 UTC

Evidence Sources: 1

First Seen: 2026-09-29

Asserted: 2026-09-29

[CISA] CVE-2026-86950 - Confirmed Exploitation

Tue, 29 Sep 2026 02:00:00 +0000

CVE-2026-86950

Catalog: CISA

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-29 02:00 UTC

Evidence Sources: 1

First Seen: 2026-09-29

Asserted: 2026-09-29

Scope Notes: Apple Multiple Products Out-of-Bounds Write Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/149226 ; https://support.apple.com/en-us/149228 ; https://support.apple.com/en-us/149229 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86950

[Previdian] CVE-2026-86950 - Confirmed Exploitation

Mon, 28 Sep 2026 21:30:46 +0000

CVE-2026-86950

Catalog: Previdian

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-28 21:30 UTC

Evidence Sources: 1

First Seen: 2026-09-28

Asserted: 2026-09-28

Scope Notes: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia... | Affected: Apple / iOS and iPadOS, macOS | CVSS: 8.8 (HIGH) | EPSS: 0.01242 | Used in malware: unknown | Listed 19 hours ahead of CISA KEV | Not yet in CISA KEV: False

[CIRCL] CVE-2026-85102 - Confirmed Exploitation

Mon, 28 Sep 2026 16:17:16 +0000

CVE-2026-85102

Catalog: CIRCL

Status: Confirmed

Exploited: Yes

Status Updated: 2026-09-28 16:17 UTC

Characteristics: Severity: 100.0, Remote Code Execution, No Authentication Required, Remote Access

First Seen: 2026-09-28

Asserted: 2026-09-28