Weekly digest
Week 40, 2026 (28 Sep – 4 Oct)
2,666 new CVEs this week, in line with the recent average. Severity skewed high: 350 critical and 1,108 high, 55% of the total. 566 arrived with exploitation evidence or public exploit code already attached. CISA added 6 CVEs to the Known Exploited Vulnerabilities catalog. 8 CVEs saw exploit probability (EPSS) jump by ten points or more. google was the most-affected vendor with 155.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-76504Critical· 9.8CISA KEV0dayPoCA vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …
CVE-2026-104286Critical· 9.8CISA KEV0dayPoCAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may al…
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may al…
CVE-2026-86950High· 8.8CISA KEV0dayPoCAn out-of-bounds write issue was addressed with improved bounds checking
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code exe…
CVE-2026-102489Critical· 9.8CISA KEVPoCZammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the und…
CVE-2026-88779High· 7.5CISA KEV0dayPoCVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
CVE-2026-102490High· 7.8CISA KEVPoCZammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service pro…
Rising exploit probability
Largest EPSS increases inside the period (≥ 10 points).
- CVE-2026-81578Critical· 9.8An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG4.5% → 85%
- CVE-2026-42271High· 8.8LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format13% → 93%
- CVE-2026-63077Critical· 9.8In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol9.8% → 90%
- CVE-2026-82078Critical· 9.4PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector3.8% → 61%
- CVE-2026-32201Medium· 6.5Microsoft SharePoint Server Spoofing Vulnerability0.98% → 43%
- CVE-2026-87902High· 8.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories18% → 46%
- CVE-2023-30804Medium· 4.9The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability13% → 34%
- CVE-2026-19490Critical· 9.8Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.7.0% → 23%
New this week, ranked by depth score
The 12 that matter most of the 2666 published.
CVE-2026-105134Critical· 10.0CISA KEVPoCA flaw has been found in Ahsay AhsayCBS up to 10.3.2
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to…
CVE-2026-76504Critical· 9.8CISA KEV0dayPoCA vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …
CVE-2026-105133High· 7.3CISA KEVPoCA vulnerability was detected in Ahsay AhsayCBS up to 10.3.2
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in impr…
CVE-2026-104286Critical· 9.8CISA KEV0dayPoCAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may al…
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may al…
CVE-2026-102489Critical· 9.8CISA KEVPoCZammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the und…
CVE-2026-86950High· 8.8CISA KEV0dayPoCAn out-of-bounds write issue was addressed with improved bounds checking
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code exe…
MAL-2026-17472Critical⚠ ExploitedMalicious code in anthropic-sdk (PyPI)
Malicious code in anthropic-sdk (PyPI)
MAL-2026-17629Critical⚠ ExploitedMalicious code in zencleaner (PyPI)
Malicious code in zencleaner (PyPI)
MAL-2026-17471Critical⚠ ExploitedMalicious code in caoxiltts (PyPI)
Malicious code in caoxiltts (PyPI)
MAL-2026-17470Critical⚠ ExploitedMalicious code in voxcpmruntime (PyPI)
Malicious code in voxcpmruntime (PyPI)
MAL-2026-17469Critical⚠ ExploitedMalicious code in infrabench (PyPI)
Malicious code in infrabench (PyPI)
MAL-2026-17468Critical⚠ ExploitedMalicious code in voxcpmintel (PyPI)
Malicious code in voxcpmintel (PyPI)
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL pathsseverity, cvss37
- CVE-2014-6407Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.cvss42
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available57
- CVE-2026-77251MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)severity, cvss48
- CVE-2026-88771Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…kev, zero_day, cvss95
- CVE-2026-102489Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad userseverity, cvss, exploited, exploit_available, kev79
- CVE-2026-102490Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the hostseverity, cvss, exploited, exploit_available, kev68
- CVE-2026-96760Authlib (v1.7.2 and below) contains a signature verification bypass vulnerabilityseverity, cvss, exploit_available66
Most-affected vendors
By CVEs published in the period.