60
60
60
60
57
60
60
60
ZDI-26-566: BlackBerry QNX KEV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
ZDI disclosed an out-of-bounds write flaw (CVE-2026-40272) in BlackBerry QNX KEV file parsing enabling remote code execution.
The Zero Day Initiative published ZDI-26-566 describing an out-of-bounds write vulnerability in BlackBerry QNX KEV file parsing. Remote code execution requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI assigned a CVSS score of 7.8 and the CVE identifier CVE-2026-40272.
30
55
60
60
57
Mitel MiCollab, Oracle WebLogic Server vulnerabilities exploited by attackers
60
February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January
60
Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability
60
December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity
60
60
60
60
CISA Urges All Organizations to Patch Exploited Critical Ivanti Flaws
60
Trend Micro Releases Urgent Fix for Actively Exploited Critical Security Vulnerability
60
AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060
Canada's Cyber Centre warns of three exploited MikroTik RouterOS vulnerabilities affecting SSH-exposed devices; CISA added two to its KEV catalog.
The Canadian Centre for Cyber Security issued alert AL26-020 for three MikroTik RouterOS vulnerabilities, especially on devices exposing SSH to the internet: CVE-2026-67277 (missing authentication, CWE-306, enabling sensitive information disclosure), CVE-2026-86060 (argument injection, CWE-88, enabling privilege escalation), and CVE-2026-67276 (improper cryptographic signature verification, CWE-347, allowing SSH command channel access without the private key). On September 10, 2026, CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog. Fixed versions include RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3.
72
U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.
CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.
72
CISA Flags Langflow RCE, Tomcat, and N
60
60
60
60
60
60
60
60
60
60
November 2025 CVE Landscape: 10 Critical Vulnerabilities Show 69% Drop from October
60
Citrix Patches Three Zero Days as One Sees Active Exploitation
60
Citrix Patches Three NetScaler Flaws, Confirms Active Exploitation of CVE-2025
60
60
60
CISA Urges Government to Patch Exploited Cisco, Microsoft Flaws
60