{"metadata": {"count": 2629, "page": 1, "per_page": 100}, "data": [{"uuid": "b4758b96-e2b2-4574-a93b-0811b7882286", "vulnerability": {"vulnId": "CVE-2026-57739", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "b4758b96-e2b2-4574-a93b-0811b7882286"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-22T16:39:12+00:00"}, "timestamps": {"asserted_at": "2026-08-22T16:39:12+00:00", "recorded_at": "2026-08-23T17:00:01+00:00", "first_seen_at": "2026-08-22T16:39:12+00:00"}, "scope": {"notes": "WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability | Affected: AcyMailing Newsletter Team / AcyMailing SMTP Newsletter | CVSS: 9.3 (CRITICAL) | EPSS: 0.00283 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability", "vendor": "AcyMailing Newsletter Team", "product": "AcyMailing SMTP Newsletter", "added_date": "2026-08-22T16:39:12.742Z", "cvss_score": 9.3, "epss_score": 0.00283, "cvss_severity": "CRITICAL", "epss_percentile": 0.2093, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-57739", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57739"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-57739"}]}, {"uuid": "d1ca1b8e-22a0-4653-82fa-5dfd11514b69", "vulnerability": {"vulnId": "CVE-2026-27971", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "d1ca1b8e-22a0-4653-82fa-5dfd11514b69"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-22T16:14:01+00:00"}, "timestamps": {"asserted_at": "2026-08-22T16:14:01+00:00", "recorded_at": "2026-08-23T17:00:01+00:00", "first_seen_at": "2026-08-22T16:14:01+00:00"}, "scope": {"notes": "Qwik affected by unauthenticated RCE via server$ Deserialization | Affected: QwikDev / qwik | CVSS: 9.2 (CRITICAL) | EPSS: 0.05416 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Qwik affected by unauthenticated RCE via server$ Deserialization", "vendor": "QwikDev", "product": "qwik", "added_date": "2026-08-22T16:14:01.179Z", "cvss_score": 9.2, "epss_score": 0.05416, "cvss_severity": "CRITICAL", "epss_percentile": 0.92086, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-27971", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27971"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-27971"}]}, {"uuid": "73c61b54-03ad-4413-8ae2-09a972d4abf5", "vulnerability": {"vulnId": "CVE-2026-19598", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "73c61b54-03ad-4413-8ae2-09a972d4abf5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-22T08:27:29+00:00"}, "timestamps": {"asserted_at": "2026-08-22T08:27:29+00:00", "recorded_at": "2026-08-23T09:00:01+00:00", "first_seen_at": "2026-08-22T08:27:29+00:00"}, "scope": {"notes": "Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router | Affected: sc0ttkclark / Pods \u2013 Custom Content Types and Fields | CVSS: 9.8 (CRITICAL) | EPSS: 0.00498 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router", "vendor": "sc0ttkclark", "product": "Pods \u2013 Custom Content Types and Fields", "added_date": "2026-08-22T08:27:29.848Z", "cvss_score": 9.8, "epss_score": 0.00498, "cvss_severity": "CRITICAL", "epss_percentile": 0.40769, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-19598", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19598"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-19598"}]}, {"uuid": "a6f0f6e3-8f04-4366-8b04-7fb57ea859ac", "vulnerability": {"vulnId": "CVE-2021-27691", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "a6f0f6e3-8f04-4366-8b04-7fb57ea859ac"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-22T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-22T00:00:00+00:00", "recorded_at": "2026-08-23T11:00:02+00:00", "first_seen_at": "2026-08-22T00:00:00+00:00"}, "scope": {"notes": "Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with... | Affected: Tenda / G0, G1, G3 routers | CVSS: 9.8 (CRITICAL) | EPSS: 0.25183 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with...", "vendor": "Tenda", "product": "G0, G1, G3 routers", "added_date": "2026-08-22T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.25183, "cvss_severity": "CRITICAL", "epss_percentile": 0.97767, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-27691", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27691"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-27691"}]}, {"uuid": "967c1a63-eae0-4169-990e-41cade796766", "vulnerability": {"vulnId": "CVE-2025-10164", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "967c1a63-eae0-4169-990e-41cade796766"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-22T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-22T00:00:00+00:00", "recorded_at": "2026-08-23T11:00:02+00:00", "first_seen_at": "2026-08-22T00:00:00+00:00"}, "scope": {"notes": "lmsys sglang update_weights_from_tensor main deserialization | Affected: lmsys / sglang | CVSS: 6.9 (MEDIUM) | EPSS: 0.00404 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "lmsys sglang update_weights_from_tensor main deserialization", "vendor": "lmsys", "product": "sglang", "added_date": "2026-08-22T00:00:00.000Z", "cvss_score": 6.9, "epss_score": 0.00404, "cvss_severity": "MEDIUM", "epss_percentile": 0.33952, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-10164", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10164"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-10164"}]}, {"uuid": "50f9c6a9-20aa-49d0-964f-f7cac0bca6e2", "vulnerability": {"vulnId": "CVE-2019-12725", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "50f9c6a9-20aa-49d0-964f-f7cac0bca6e2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-22T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-22T00:00:00+00:00", "recorded_at": "2026-08-23T11:00:02+00:00", "first_seen_at": "2026-08-22T00:00:00+00:00"}, "scope": {"notes": "Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few... | Affected: Zeroshell / Zeroshell | CVSS: 9.8 (CRITICAL) | EPSS: 0.89849 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few...", "vendor": "Zeroshell", "product": "Zeroshell", "added_date": "2026-08-22T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.89849, "cvss_severity": "CRITICAL", "epss_percentile": 0.99781, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2019-12725", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12725"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2019-12725"}]}, {"uuid": "da2f9533-cd62-4eb8-98eb-e623d68c51ac", "vulnerability": {"vulnId": "CVE-2026-77806", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "da2f9533-cd62-4eb8-98eb-e623d68c51ac"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-21T13:50:25+00:00"}, "timestamps": {"asserted_at": "2026-08-21T13:50:25+00:00", "recorded_at": "2026-08-22T14:00:02+00:00", "first_seen_at": "2026-08-21T13:50:25+00:00"}, "scope": {"notes": "SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to... | Affected: SPIP / SPIP | CVSS: 9.8 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to...", "vendor": "SPIP", "product": "SPIP", "added_date": "2026-08-21T13:50:25.867Z", "cvss_score": 9.8, "epss_score": null, "cvss_severity": "CRITICAL", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-77806", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77806"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-77806"}]}, {"uuid": "330e3dd7-5794-4b40-b139-8cde19efd41c", "vulnerability": {"vulnId": "CVE-2026-19478", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "330e3dd7-5794-4b40-b139-8cde19efd41c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-21T07:04:25+00:00"}, "timestamps": {"asserted_at": "2026-08-21T07:04:25+00:00", "recorded_at": "2026-08-22T08:00:02+00:00", "first_seen_at": "2026-08-21T07:04:25+00:00"}, "scope": {"notes": "Improper Control of Generation of Code ('Code Injection') in GitLab | Affected: GitLab / GitLab | CVSS: 9.4 (CRITICAL) | EPSS: 0.01506 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Improper Control of Generation of Code ('Code Injection') in GitLab", "vendor": "GitLab", "product": "GitLab", "added_date": "2026-08-21T07:04:25.000Z", "cvss_score": 9.4, "epss_score": 0.01506, "cvss_severity": "CRITICAL", "epss_percentile": 0.72394, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-19478", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19478"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-19478"}]}, {"uuid": "0fd92e10-e32d-4875-88fa-f82f8cdec081", "vulnerability": {"vulnId": "CVE-2026-77647", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "0fd92e10-e32d-4875-88fa-f82f8cdec081"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-20T22:40:31+00:00"}, "timestamps": {"asserted_at": "2026-08-20T22:40:31+00:00", "recorded_at": "2026-08-21T23:00:01+00:00", "first_seen_at": "2026-08-20T22:40:31+00:00"}, "scope": {"notes": "SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to... | Affected: SPIP / SPIP | CVSS: 9.8 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to...", "vendor": "SPIP", "product": "SPIP", "added_date": "2026-08-20T22:40:31.553Z", "cvss_score": 9.8, "epss_score": null, "cvss_severity": "CRITICAL", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-77647", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77647"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-77647"}]}, {"uuid": "dc40cd47-7584-40eb-bc99-3140683ab3e7", "vulnerability": {"vulnId": "CVE-2026-72530", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "dc40cd47-7584-40eb-bc99-3140683ab3e7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-20T17:00:27+00:00"}, "timestamps": {"asserted_at": "2026-08-20T17:00:27+00:00", "recorded_at": "2026-08-21T18:00:01+00:00", "first_seen_at": "2026-08-20T17:00:27+00:00"}, "scope": {"notes": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to... | Affected: TrueConf / TrueConf Server | CVSS: 9.5 (CRITICAL) | EPSS: 0.0034 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to...", "vendor": "TrueConf", "product": "TrueConf Server", "added_date": "2026-08-20T17:00:27.883Z", "cvss_score": 9.5, "epss_score": 0.0034, "cvss_severity": "CRITICAL", "epss_percentile": 0.27168, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-72530", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72530"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-72530"}]}, {"uuid": "d3279dc6-3bc5-42ee-9f61-c26461a0fbf4", "vulnerability": {"vulnId": "CVE-2026-72529", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "d3279dc6-3bc5-42ee-9f61-c26461a0fbf4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-20T17:00:27+00:00"}, "timestamps": {"asserted_at": "2026-08-20T17:00:27+00:00", "recorded_at": "2026-08-21T18:00:01+00:00", "first_seen_at": "2026-08-20T17:00:27+00:00"}, "scope": {"notes": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to... | Affected: TrueConf / TrueConf Server | CVSS: 9.3 (CRITICAL) | EPSS: 0.00284 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to...", "vendor": "TrueConf", "product": "TrueConf Server", "added_date": "2026-08-20T17:00:27.883Z", "cvss_score": 9.3, "epss_score": 0.00284, "cvss_severity": "CRITICAL", "epss_percentile": 0.21051, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-72529", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72529"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-72529"}]}, {"uuid": "c6f3b66c-d790-4cfe-a7a0-ebb58cb88c1b", "vulnerability": {"vulnId": "CVE-2023-25158", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "c6f3b66c-d790-4cfe-a7a0-ebb58cb88c1b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-19T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-19T00:00:00+00:00", "recorded_at": "2026-08-20T11:00:01+00:00", "first_seen_at": "2026-08-19T00:00:00+00:00"}, "scope": {"notes": "Unfiltered SQL Injection in Geotools | Affected: geotools / geotools | CVSS: 9.8 (CRITICAL) | EPSS: 0.01072 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Unfiltered SQL Injection in Geotools", "vendor": "geotools", "product": "geotools", "added_date": "2026-08-19T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.01072, "cvss_severity": "CRITICAL", "epss_percentile": 0.62258, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-25158", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25158"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-25158"}]}, {"uuid": "abc0b754-adb7-4f5c-acaf-38a8472cee67", "vulnerability": {"vulnId": "CVE-2026-33824", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "abc0b754-adb7-4f5c-acaf-38a8472cee67"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-18T16:52:08+00:00"}, "timestamps": {"asserted_at": "2026-08-18T16:52:08+00:00", "recorded_at": "2026-08-18T18:00:01+00:00", "first_seen_at": "2026-08-18T16:52:08+00:00"}, "scope": {"notes": "Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability | Affected: Microsoft / Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation) | CVSS: 9.8 (CRITICAL) | EPSS: 0.5585 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability", "vendor": "Microsoft", "product": "Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)", "added_date": "2026-08-18T16:52:08.539Z", "cvss_score": 9.8, "epss_score": 0.5585, "cvss_severity": "CRITICAL", "epss_percentile": 0.98957, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-33824", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33824"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-33824"}]}, {"uuid": "a807a3ed-9ad4-4716-90bf-bb73c3b22887", "vulnerability": {"vulnId": "CVE-2026-64849", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "a807a3ed-9ad4-4716-90bf-bb73c3b22887"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-18T13:31:00+00:00"}, "timestamps": {"asserted_at": "2026-08-18T13:31:00+00:00", "recorded_at": "2026-08-18T14:00:01+00:00", "first_seen_at": "2026-08-18T13:31:00+00:00"}, "scope": {"notes": "MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | Affected: mlflow / mlflow | CVSS: 9.3 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)", "vendor": "mlflow", "product": "mlflow", "added_date": "2026-08-18T13:31:00.000Z", "cvss_score": 9.3, "epss_score": null, "cvss_severity": "CRITICAL", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-64849", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64849"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-64849"}]}, {"uuid": "faa4b0c1-354d-4296-b00e-ff109226b681", "vulnerability": {"vulnId": "CVE-2025-62593", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "faa4b0c1-354d-4296-b00e-ff109226b681"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-18T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-18T00:00:00+00:00", "recorded_at": "2026-08-17T15:00:02+00:00", "first_seen_at": "2026-08-18T00:00:00+00:00"}, "scope": {"notes": "Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack | Affected: ray-project / ray | CVSS: 9.4 (CRITICAL) | EPSS: 0.00369 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack", "vendor": "ray-project", "product": "ray", "added_date": "2026-08-18T00:00:00.000Z", "cvss_score": 9.4, "epss_score": 0.00369, "cvss_severity": "CRITICAL", "epss_percentile": 0.30029, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2025-62593", "url": "https://www.cve.org/CVERecord?id=CVE-2025-62593"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-62593"}]}, {"uuid": "319aa644-29d6-41de-97b7-04001dc6e978", "vulnerability": {"vulnId": "CVE-2026-52806", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "319aa644-29d6-41de-97b7-04001dc6e978"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-17T08:49:09+00:00"}, "timestamps": {"asserted_at": "2026-08-17T08:49:09+00:00", "recorded_at": "2026-08-17T09:00:01+00:00", "first_seen_at": "2026-08-17T08:49:09+00:00"}, "scope": {"notes": "Gogs: RCE via git rebase --exec argument injection in pull request merge | Affected: gogs / gogs | CVSS: 9.9 (CRITICAL) | EPSS: 0.01464 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Gogs: RCE via git rebase --exec argument injection in pull request merge", "vendor": "gogs", "product": "gogs", "added_date": "2026-08-17T08:49:09.242Z", "cvss_score": 9.9, "epss_score": 0.01464, "cvss_severity": "CRITICAL", "epss_percentile": 0.71412, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-52806", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52806"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-52806"}]}, {"uuid": "bcfd3bd2-1ccf-4d5e-9a87-943ead780a1b", "vulnerability": {"vulnId": "CVE-2026-56270", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "bcfd3bd2-1ccf-4d5e-9a87-943ead780a1b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-17T08:25:42+00:00"}, "timestamps": {"asserted_at": "2026-08-17T08:25:42+00:00", "recorded_at": "2026-08-17T09:00:01+00:00", "first_seen_at": "2026-08-17T08:25:42+00:00"}, "scope": {"notes": "Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint | Affected: Flowise / Flowise | CVSS: 8.7 (HIGH) | EPSS: 0.00475 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint", "vendor": "Flowise", "product": "Flowise", "added_date": "2026-08-17T08:25:42.707Z", "cvss_score": 8.7, "epss_score": 0.00475, "cvss_severity": "HIGH", "epss_percentile": 0.39028, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-56270", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56270"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-56270"}]}, {"uuid": "85bc654a-ccea-45ad-8fe9-ccd8adb5a39d", "vulnerability": {"vulnId": "CVE-2026-8452", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "85bc654a-ccea-45ad-8fe9-ccd8adb5a39d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-17T08:04:34+00:00"}, "timestamps": {"asserted_at": "2026-08-17T08:04:34+00:00", "recorded_at": "2026-08-17T09:00:01+00:00", "first_seen_at": "2026-08-17T08:04:34+00:00"}, "scope": {"notes": "Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service | Affected: NetScaler / ADC, Gateway | CVSS: 8.8 (HIGH) | EPSS: 0.00487 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service", "vendor": "NetScaler", "product": "ADC, Gateway", "added_date": "2026-08-17T08:04:34.863Z", "cvss_score": 8.8, "epss_score": 0.00487, "cvss_severity": "HIGH", "epss_percentile": 0.39763, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-8452", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8452"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-8452"}]}, {"uuid": "cd2fc367-c05e-430c-93c9-288b96e2c26a", "vulnerability": {"vulnId": "CVE-2025-52907", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "cd2fc367-c05e-430c-93c9-288b96e2c26a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-17T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-17T00:00:00+00:00", "recorded_at": "2026-08-18T11:00:01+00:00", "first_seen_at": "2026-08-17T00:00:00+00:00"}, "scope": {"notes": "TOTOLINK X6000R Security Bypass Vulnerability | Affected: TOTOLINK / X6000R | CVSS: 7.3 (HIGH) | EPSS: 0.00868 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "TOTOLINK X6000R Security Bypass Vulnerability", "vendor": "TOTOLINK", "product": "X6000R", "added_date": "2026-08-17T00:00:00.000Z", "cvss_score": 7.3, "epss_score": 0.00868, "cvss_severity": "HIGH", "epss_percentile": 0.55741, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-52907", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52907"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-52907"}]}, {"uuid": "6f0f59ea-f42a-4626-8eda-c58bda1e0861", "vulnerability": {"vulnId": "CVE-2022-50973", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "6f0f59ea-f42a-4626-8eda-c58bda1e0861"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-17T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-17T00:00:00+00:00", "recorded_at": "2026-08-18T11:00:01+00:00", "first_seen_at": "2026-08-17T00:00:00+00:00"}, "scope": {"notes": "Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet | Affected: Yonyou Network Technology Co., Ltd. / KSOA | CVSS: 9.3 (CRITICAL) | EPSS: 0.0086 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet", "vendor": "Yonyou Network Technology Co., Ltd.", "product": "KSOA", "added_date": "2026-08-17T00:00:00.000Z", "cvss_score": 9.3, "epss_score": 0.0086, "cvss_severity": "CRITICAL", "epss_percentile": 0.55478, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-50973", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50973"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-50973"}]}, {"uuid": "845ba691-21c4-4ed3-849f-151b3d1704db", "vulnerability": {"vulnId": "CVE-2021-2109", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "845ba691-21c4-4ed3-849f-151b3d1704db"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-15T00:00:00+00:00", "recorded_at": "2026-08-16T11:00:01+00:00", "first_seen_at": "2026-08-15T00:00:00+00:00"}, "scope": {"notes": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are... | Affected: Oracle Corporation / WebLogic Server | CVSS: 7.2 (HIGH) | EPSS: 0.70447 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are...", "vendor": "Oracle Corporation", "product": "WebLogic Server", "added_date": "2026-08-15T00:00:00.000Z", "cvss_score": 7.2, "epss_score": 0.70447, "cvss_severity": "HIGH", "epss_percentile": 0.99333, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-2109", "url": "https://www.cve.org/CVERecord?id=CVE-2021-2109"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-2109"}]}, {"uuid": "2d4b086b-a4ca-49c2-bc57-45ccb3c680cf", "vulnerability": {"vulnId": "CVE-2016-5312", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "2d4b086b-a4ca-49c2-bc57-45ccb3c680cf"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-15T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-15T00:00:00+00:00", "recorded_at": "2026-08-16T11:00:01+00:00", "first_seen_at": "2026-08-15T00:00:00+00:00"}, "scope": {"notes": "Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read... | Affected: Symantec / Messaging Gateway | CVSS: 6.5 (MEDIUM) | EPSS: 0.53702 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read...", "vendor": "Symantec", "product": "Messaging Gateway", "added_date": "2026-08-15T00:00:00.000Z", "cvss_score": 6.5, "epss_score": 0.53702, "cvss_severity": "MEDIUM", "epss_percentile": 0.98906, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2016-5312", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5312"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2016-5312"}]}, {"uuid": "291d5c17-eb75-41bf-914c-997e90612bc1", "vulnerability": {"vulnId": "CVE-2016-20097", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "291d5c17-eb75-41bf-914c-997e90612bc1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T19:20:24+00:00"}, "timestamps": {"asserted_at": "2026-08-14T19:20:24+00:00", "recorded_at": "2026-08-14T20:00:01+00:00", "first_seen_at": "2026-08-14T19:20:24+00:00"}, "scope": {"notes": "Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad | Affected: Weaver Network Co., Ltd. / E-cology 8.0 | CVSS: 8.7 (HIGH) | EPSS: 0.0047 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad", "vendor": "Weaver Network Co., Ltd.", "product": "E-cology 8.0", "added_date": "2026-08-14T19:20:24.767Z", "cvss_score": 8.7, "epss_score": 0.0047, "cvss_severity": "HIGH", "epss_percentile": 0.38557, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2016-20097", "url": "https://www.cve.org/CVERecord?id=CVE-2016-20097"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2016-20097"}]}, {"uuid": "ba7b53de-4b27-42fa-9501-c263fac184ee", "vulnerability": {"vulnId": "CVE-2026-73532", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "ba7b53de-4b27-42fa-9501-c263fac184ee"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T17:13:03+00:00"}, "timestamps": {"asserted_at": "2026-08-14T17:13:03+00:00", "recorded_at": "2026-08-14T18:00:01+00:00", "first_seen_at": "2026-08-14T17:13:03+00:00"}, "scope": {"notes": "Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build | Affected: WPManageNinja / Fluent Forms Pro | CVSS: 9.3 (CRITICAL) | EPSS: 0.00463 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build", "vendor": "WPManageNinja", "product": "Fluent Forms Pro", "added_date": "2026-08-14T17:13:03.323Z", "cvss_score": 9.3, "epss_score": 0.00463, "cvss_severity": "CRITICAL", "epss_percentile": 0.38121, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-73532", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73532"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-73532"}]}, {"uuid": "06db8427-35c6-4df4-a597-b76bdd262abc", "vulnerability": {"vulnId": "CVE-2026-73533", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "06db8427-35c6-4df4-a597-b76bdd262abc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T17:13:03+00:00"}, "timestamps": {"asserted_at": "2026-08-14T17:13:03+00:00", "recorded_at": "2026-08-14T18:00:01+00:00", "first_seen_at": "2026-08-14T17:13:03+00:00"}, "scope": {"notes": "Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build | Affected: WPManageNinja / Ninja Tables Pro | CVSS: 9.3 (CRITICAL) | EPSS: 0.00448 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build", "vendor": "WPManageNinja", "product": "Ninja Tables Pro", "added_date": "2026-08-14T17:13:03.486Z", "cvss_score": 9.3, "epss_score": 0.00448, "cvss_severity": "CRITICAL", "epss_percentile": 0.37123, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-73533", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73533"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-73533"}]}, {"uuid": "bdbf2621-b773-4d3d-9c8a-d386781a3a60", "vulnerability": {"vulnId": "CVE-2026-67595", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "bdbf2621-b773-4d3d-9c8a-d386781a3a60"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T17:12:30+00:00"}, "timestamps": {"asserted_at": "2026-08-14T17:12:30+00:00", "recorded_at": "2026-08-14T18:00:01+00:00", "first_seen_at": "2026-08-14T17:12:30+00:00"}, "scope": {"notes": "VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php | Affected: webreinvent / vaahcms | CVSS: 9.2 (CRITICAL) | EPSS: 0.00422 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php", "vendor": "webreinvent", "product": "vaahcms", "added_date": "2026-08-14T17:12:30.387Z", "cvss_score": 9.2, "epss_score": 0.00422, "cvss_severity": "CRITICAL", "epss_percentile": 0.3508, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-67595", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67595"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-67595"}]}, {"uuid": "a32dfc59-c150-4611-aebe-211150faedbb", "vulnerability": {"vulnId": "CVE-2022-4995", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "a32dfc59-c150-4611-aebe-211150faedbb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T17:10:46+00:00"}, "timestamps": {"asserted_at": "2026-08-14T17:10:46+00:00", "recorded_at": "2026-08-14T18:00:01+00:00", "first_seen_at": "2026-08-14T17:10:46+00:00"}, "scope": {"notes": "Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp | Affected: Weaver Network Co., Ltd. / E-cology 9.0 | CVSS: 9.3 (CRITICAL) | EPSS: 0.00687 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp", "vendor": "Weaver Network Co., Ltd.", "product": "E-cology 9.0", "added_date": "2026-08-14T17:10:46.107Z", "cvss_score": 9.3, "epss_score": 0.00687, "cvss_severity": "CRITICAL", "epss_percentile": 0.49575, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-4995", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4995"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-4995"}]}, {"uuid": "39fae793-268a-4914-bfb2-b5a30a59e51f", "vulnerability": {"vulnId": "CVE-2022-50997", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "39fae793-268a-4914-bfb2-b5a30a59e51f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T17:10:46+00:00"}, "timestamps": {"asserted_at": "2026-08-14T17:10:46+00:00", "recorded_at": "2026-08-14T18:00:01+00:00", "first_seen_at": "2026-08-14T17:10:46+00:00"}, "scope": {"notes": "Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp | Affected: Weaver Network Co., Ltd. / E-cology 9.0, E-cology 8.0 | CVSS: 8.7 (HIGH) | EPSS: 0.00462 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp", "vendor": "Weaver Network Co., Ltd.", "product": "E-cology 9.0, E-cology 8.0", "added_date": "2026-08-14T17:10:46.524Z", "cvss_score": 8.7, "epss_score": 0.00462, "cvss_severity": "HIGH", "epss_percentile": 0.38085, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2022-50997", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50997"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2022-50997"}]}, {"uuid": "bb7ed00c-fb3b-463f-80b0-04f3ec41f0ff", "vulnerability": {"vulnId": "CVE-2019-25765", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "bb7ed00c-fb3b-463f-80b0-04f3ec41f0ff"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T13:20:44+00:00"}, "timestamps": {"asserted_at": "2026-08-14T13:20:44+00:00", "recorded_at": "2026-08-14T14:00:01+00:00", "first_seen_at": "2026-08-14T13:20:44+00:00"}, "scope": {"notes": "ASP-CMS SQL Injection via commentList.asp id Parameter | Affected: ASP-CMS Project / ASP-CMS | CVSS: 8.7 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "ASP-CMS SQL Injection via commentList.asp id Parameter", "vendor": "ASP-CMS Project", "product": "ASP-CMS", "added_date": "2026-08-14T13:20:44.131Z", "cvss_score": 8.7, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2019-25765", "url": "https://www.cve.org/CVERecord?id=CVE-2019-25765"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2019-25765"}]}, {"uuid": "349a1dc8-b7cd-43d7-88fa-165a70b44cd0", "vulnerability": {"vulnId": "CVE-2026-58231", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "349a1dc8-b7cd-43d7-88fa-165a70b44cd0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T12:59:59+00:00"}, "timestamps": {"asserted_at": "2026-08-14T12:59:59+00:00", "recorded_at": "2026-08-14T13:00:01+00:00", "first_seen_at": "2026-08-14T12:59:59+00:00"}, "scope": {"notes": "Improper Authorization in SAP Commerce Cloud (Data Hub Adapter) | Affected: SAP_SE / SAP Commerce Cloud (Data Hub Adapter) | CVSS: 10.0 (CRITICAL) | EPSS: 0.00726 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)", "vendor": "SAP_SE", "product": "SAP Commerce Cloud (Data Hub Adapter)", "added_date": "2026-08-14T12:59:59.018Z", "cvss_score": 10.0, "epss_score": 0.00726, "cvss_severity": "CRITICAL", "epss_percentile": 0.50866, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-58231", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58231"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-58231"}]}, {"uuid": "f4814983-6b55-4c95-b21c-d1eb834384e2", "vulnerability": {"vulnId": "CVE-2021-30120", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "f4814983-6b55-4c95-b21c-d1eb834384e2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T04:30:51+00:00"}, "timestamps": {"asserted_at": "2026-08-14T04:30:51+00:00", "recorded_at": "2026-08-14T05:00:01+00:00", "first_seen_at": "2026-08-14T04:30:51+00:00"}, "scope": {"notes": "2FA bypass in Kaseya VSA <= v9.5.6 | Affected: Kaseya / VSA | CVSS: 9.9 (CRITICAL) | EPSS: 0.05701 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "2FA bypass in Kaseya VSA <= v9.5.6", "vendor": "Kaseya", "product": "VSA", "added_date": "2026-08-14T04:30:51.650Z", "cvss_score": 9.9, "epss_score": 0.05701, "cvss_severity": "CRITICAL", "epss_percentile": 0.92322, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-30120", "url": "https://www.cve.org/CVERecord?id=CVE-2021-30120"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-30120"}]}, {"uuid": "5180831d-bbe2-419d-b007-87f8165bff7f", "vulnerability": {"vulnId": "CVE-2021-30119", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "5180831d-bbe2-419d-b007-87f8165bff7f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T04:30:51+00:00"}, "timestamps": {"asserted_at": "2026-08-14T04:30:51+00:00", "recorded_at": "2026-08-14T05:00:01+00:00", "first_seen_at": "2026-08-14T04:30:51+00:00"}, "scope": {"notes": "Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6 | Affected: Kaseya / VSA | CVSS: 5.4 (MEDIUM) | EPSS: 0.52687 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6", "vendor": "Kaseya", "product": "VSA", "added_date": "2026-08-14T04:30:51.519Z", "cvss_score": 5.4, "epss_score": 0.52687, "cvss_severity": "MEDIUM", "epss_percentile": 0.9887, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-30119", "url": "https://www.cve.org/CVERecord?id=CVE-2021-30119"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-30119"}]}, {"uuid": "92b5b64e-c7a0-41c4-bd4c-57af9b0ab5a7", "vulnerability": {"vulnId": "CVE-2026-45298", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "92b5b64e-c7a0-41c4-bd4c-57af9b0ab5a7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-14T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-14T00:00:00+00:00", "recorded_at": "2026-08-15T11:00:01+00:00", "first_seen_at": "2026-08-14T00:00:00+00:00"}, "scope": {"notes": "Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy) | Affected: amir20 / dozzle | CVSS: 8.6 (HIGH) | EPSS: 0.01491 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)", "vendor": "amir20", "product": "dozzle", "added_date": "2026-08-14T00:00:00.000Z", "cvss_score": 8.6, "epss_score": 0.01491, "cvss_severity": "HIGH", "epss_percentile": 0.7183, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-45298", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45298"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-45298"}]}, {"uuid": "23749399-c3bc-4951-96ae-0bb714e0798b", "vulnerability": {"vulnId": "CVE-2026-26190", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "23749399-c3bc-4951-96ae-0bb714e0798b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-13T10:20:23+00:00"}, "timestamps": {"asserted_at": "2026-08-13T10:20:23+00:00", "recorded_at": "2026-08-13T11:00:01+00:00", "first_seen_at": "2026-08-13T10:20:23+00:00"}, "scope": {"notes": "Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise | Affected: milvus-io / milvus | CVSS: 9.8 (CRITICAL) | EPSS: 0.36912 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise", "vendor": "milvus-io", "product": "milvus", "added_date": "2026-08-13T10:20:23.409Z", "cvss_score": 9.8, "epss_score": 0.36912, "cvss_severity": "CRITICAL", "epss_percentile": 0.98373, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-26190", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26190"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-26190"}]}, {"uuid": "cbcb5f2d-24ef-44d7-82cc-1956de693ed4", "vulnerability": {"vulnId": "CVE-2026-55040", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "cbcb5f2d-24ef-44d7-82cc-1956de693ed4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-12T19:37:46+00:00"}, "timestamps": {"asserted_at": "2026-08-12T19:37:46+00:00", "recorded_at": "2026-08-12T20:00:01+00:00", "first_seen_at": "2026-08-12T19:37:46+00:00"}, "scope": {"notes": "Microsoft SharePoint Server Security Feature Bypass Vulnerability | Affected: Microsoft / Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition | CVSS: 9.1 (CRITICAL) | EPSS: 0.01626 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Microsoft SharePoint Server Security Feature Bypass Vulnerability", "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition", "added_date": "2026-08-12T19:37:46.763Z", "cvss_score": 9.1, "epss_score": 0.01626, "cvss_severity": "CRITICAL", "epss_percentile": 0.73981, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-55040", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55040"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-55040"}]}, {"uuid": "1d270acf-8da1-4944-ae6c-5cdc7f627315", "vulnerability": {"vulnId": "CVE-2026-59310", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "1d270acf-8da1-4944-ae6c-5cdc7f627315"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-12T10:47:00+00:00"}, "timestamps": {"asserted_at": "2026-08-12T10:47:00+00:00", "recorded_at": "2026-08-12T11:00:01+00:00", "first_seen_at": "2026-08-12T10:47:00+00:00"}, "scope": {"notes": "vCenter directory-traversal vulnerability | Affected: VMware / Cloud Foundation, vSphere Foundation, vCenter, Telco Cloud Infrastructure, Telco Cloud Platform | CVSS: 9.8 (CRITICAL) | EPSS: 0.0114 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "vCenter directory-traversal vulnerability", "vendor": "VMware", "product": "Cloud Foundation, vSphere Foundation, vCenter, Telco Cloud Infrastructure, Telco Cloud Platform", "added_date": "2026-08-12T10:47:00.000Z", "cvss_score": 9.8, "epss_score": 0.0114, "cvss_severity": "CRITICAL", "epss_percentile": 0.63646, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-59310", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59310"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-59310"}]}, {"uuid": "ac9c87c3-9462-4c96-bee4-a6e99eb210ee", "vulnerability": {"vulnId": "CVE-2021-21983", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "ac9c87c3-9462-4c96-bee4-a6e99eb210ee"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-12T04:21:08+00:00"}, "timestamps": {"asserted_at": "2026-08-12T04:21:08+00:00", "recorded_at": "2026-08-12T05:00:01+00:00", "first_seen_at": "2026-08-12T04:21:08+00:00"}, "scope": {"notes": "Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with... | Affected: VMware / vRealize Operations Manager | CVSS: 6.5 (MEDIUM) | EPSS: 0.68557 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with...", "vendor": "VMware", "product": "vRealize Operations Manager", "added_date": "2026-08-12T04:21:08.411Z", "cvss_score": 6.5, "epss_score": 0.68557, "cvss_severity": "MEDIUM", "epss_percentile": 0.99272, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-21983", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21983"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-21983"}]}, {"uuid": "31061b91-09c6-46de-9bd2-1c32ed19107b", "vulnerability": {"vulnId": "CVE-2026-20349", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "31061b91-09c6-46de-9bd2-1c32ed19107b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-11T18:59:43+00:00"}, "timestamps": {"asserted_at": "2026-08-11T18:59:43+00:00", "recorded_at": "2026-08-11T20:00:01+00:00", "first_seen_at": "2026-08-11T18:59:43+00:00"}, "scope": {"notes": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability | Affected: Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software | CVSS: 8.6 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability", "vendor": "Cisco", "product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software", "added_date": "2026-08-11T18:59:43.686Z", "cvss_score": 8.6, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-20349", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20349"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-20349"}]}, {"uuid": "4c0d1f4c-4339-4ad0-bfc9-2502056915b3", "vulnerability": {"vulnId": "CVE-2026-33497", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "4c0d1f4c-4339-4ad0-bfc9-2502056915b3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-11T12:08:51+00:00"}, "timestamps": {"asserted_at": "2026-08-11T12:08:51+00:00", "recorded_at": "2026-08-11T13:00:01+00:00", "first_seen_at": "2026-08-11T12:08:51+00:00"}, "scope": {"notes": "Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading | Affected: langflow-ai / langflow | CVSS: 8.7 (HIGH) | EPSS: 0.19584 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading", "vendor": "langflow-ai", "product": "langflow", "added_date": "2026-08-11T12:08:51.170Z", "cvss_score": 8.7, "epss_score": 0.19584, "cvss_severity": "HIGH", "epss_percentile": 0.97122, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-33497", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33497"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-33497"}]}, {"uuid": "d6000248-7bd4-450a-b756-bf730f6d4323", "vulnerability": {"vulnId": "CVE-2026-49049", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "d6000248-7bd4-450a-b756-bf730f6d4323"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-11T08:44:44+00:00"}, "timestamps": {"asserted_at": "2026-08-11T08:44:44+00:00", "recorded_at": "2026-08-11T09:00:01+00:00", "first_seen_at": "2026-08-11T08:44:44+00:00"}, "scope": {"notes": "Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler | Affected: joomshaper.com / Helix3 extension for Joomla | CVSS: 7.5 (HIGH) | EPSS: 0.17701 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler", "vendor": "joomshaper.com", "product": "Helix3 extension for Joomla", "added_date": "2026-08-11T08:44:44.938Z", "cvss_score": 7.5, "epss_score": 0.17701, "cvss_severity": "HIGH", "epss_percentile": 0.96866, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-49049", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49049"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-49049"}]}, {"uuid": "c0d0462c-a909-4b98-855e-97cc37776095", "vulnerability": {"vulnId": "CVE-2025-2505", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "c0d0462c-a909-4b98-855e-97cc37776095"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-11T07:58:07+00:00"}, "timestamps": {"asserted_at": "2026-08-11T07:58:07+00:00", "recorded_at": "2026-08-11T08:00:01+00:00", "first_seen_at": "2026-08-11T07:58:07+00:00"}, "scope": {"notes": "Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang' | Affected: philsbury / Age Gate | CVSS: 9.8 (CRITICAL) | EPSS: 0.03945 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'", "vendor": "philsbury", "product": "Age Gate", "added_date": "2026-08-11T07:58:07.782Z", "cvss_score": 9.8, "epss_score": 0.03945, "cvss_severity": "CRITICAL", "epss_percentile": 0.89413, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-2505", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2505"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-2505"}]}, {"uuid": "aa14b1da-a2a0-4e1a-a4a3-f432b25869df", "vulnerability": {"vulnId": "CVE-2026-68820", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "aa14b1da-a2a0-4e1a-a4a3-f432b25869df"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-11T07:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-11T07:00:00+00:00", "recorded_at": "2026-08-11T18:00:01+00:00", "first_seen_at": "2026-08-11T07:00:00+00:00"}, "scope": {"notes": "Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Affected: Microsoft / Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core installation) | CVSS: 7.0 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability", "vendor": "Microsoft", "product": "Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core installation)", "added_date": "2026-08-11T07:00:00.000Z", "cvss_score": 7.0, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-68820", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68820"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-68820"}]}, {"uuid": "5e1d5cc8-d19b-4a0a-953e-a335168bee1c", "vulnerability": {"vulnId": "CVE-2026-72898", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "5e1d5cc8-d19b-4a0a-953e-a335168bee1c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-10T20:20:31+00:00"}, "timestamps": {"asserted_at": "2026-08-10T20:20:31+00:00", "recorded_at": "2026-08-10T21:00:02+00:00", "first_seen_at": "2026-08-10T20:20:31+00:00"}, "scope": {"notes": "Metabase SQL injection via password reset endpoint | Affected: Metabase / Metabase | CVSS: 10.0 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Metabase SQL injection via password reset endpoint", "vendor": "Metabase", "product": "Metabase", "added_date": "2026-08-10T20:20:31.993Z", "cvss_score": 10.0, "epss_score": null, "cvss_severity": "CRITICAL", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-72898", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-72898"}]}, {"uuid": "50f1ad27-2588-4452-831b-fa1418b9e973", "vulnerability": {"vulnId": "CVE-2026-55450", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "50f1ad27-2588-4452-831b-fa1418b9e973"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-09T12:09:32+00:00"}, "timestamps": {"asserted_at": "2026-08-09T12:09:32+00:00", "recorded_at": "2026-08-09T13:00:01+00:00", "first_seen_at": "2026-08-09T12:09:32+00:00"}, "scope": {"notes": "Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak | Affected: langflow-ai / langflow | CVSS: 9.3 (CRITICAL) | EPSS: 0.11819 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak", "vendor": "langflow-ai", "product": "langflow", "added_date": "2026-08-09T12:09:32.943Z", "cvss_score": 9.3, "epss_score": 0.11819, "cvss_severity": "CRITICAL", "epss_percentile": 0.95685, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-55450", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55450"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-55450"}]}, {"uuid": "657f4a25-5dd7-4662-9158-216bc2709a59", "vulnerability": {"vulnId": "CVE-2023-3722", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "657f4a25-5dd7-4662-9158-216bc2709a59"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-09T00:00:00+00:00", "recorded_at": "2026-08-10T11:00:01+00:00", "first_seen_at": "2026-08-09T00:00:00+00:00"}, "scope": {"notes": "Avaya Aura Device Services Remote Code Execution | Affected: Avaya / Aura Device Services | CVSS: 8.6 (HIGH) | EPSS: 0.0386 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Avaya Aura Device Services Remote Code Execution", "vendor": "Avaya", "product": "Aura Device Services", "added_date": "2026-08-09T00:00:00.000Z", "cvss_score": 8.6, "epss_score": 0.0386, "cvss_severity": "HIGH", "epss_percentile": 0.8916, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-3722", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3722"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-3722"}]}, {"uuid": "280ad552-0d71-431d-9cf3-655e6c93c48e", "vulnerability": {"vulnId": "CVE-2013-3821", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "280ad552-0d71-431d-9cf3-655e6c93c48e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-07T10:09:49+00:00"}, "timestamps": {"asserted_at": "2026-08-07T10:09:49+00:00", "recorded_at": "2026-08-07T11:00:01+00:00", "first_seen_at": "2026-08-07T10:09:49+00:00"}, "scope": {"notes": "Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote... | Affected: Oracle / PeopleSoft Products | CVSS: 6.4 (MEDIUM) | EPSS: 0.06897 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote...", "vendor": "Oracle", "product": "PeopleSoft Products", "added_date": "2026-08-07T10:09:49.510Z", "cvss_score": 6.4, "epss_score": 0.06897, "cvss_severity": "MEDIUM", "epss_percentile": 0.93433, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2013-3821", "url": "https://www.cve.org/CVERecord?id=CVE-2013-3821"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2013-3821"}]}, {"uuid": "f34ea8a4-eadc-4669-ae6a-f4da6e839058", "vulnerability": {"vulnId": "CVE-2026-2652", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "f34ea8a4-eadc-4669-ae6a-f4da6e839058"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-07T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-07T00:00:00+00:00", "recorded_at": "2026-08-08T11:00:01+00:00", "first_seen_at": "2026-08-07T00:00:00+00:00"}, "scope": {"notes": "Authentication Bypass in mlflow/mlflow | Affected: mlflow / mlflow/mlflow | CVSS: 8.6 (HIGH) | EPSS: 0.18861 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Authentication Bypass in mlflow/mlflow", "vendor": "mlflow", "product": "mlflow/mlflow", "added_date": "2026-08-07T00:00:00.000Z", "cvss_score": 8.6, "epss_score": 0.18861, "cvss_severity": "HIGH", "epss_percentile": 0.97013, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-2652", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2652"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-2652"}]}, {"uuid": "3cc61674-0365-45da-84ca-2733b9bc4726", "vulnerability": {"vulnId": "CVE-2018-14013", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "3cc61674-0365-45da-84ca-2733b9bc4726"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-06T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-06T00:00:00+00:00", "recorded_at": "2026-08-07T11:00:01+00:00", "first_seen_at": "2026-08-06T00:00:00+00:00"}, "scope": {"notes": "Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. | Affected: Synacor / Zimbra Collaboration Suite | CVSS: 6.1 (MEDIUM) | EPSS: 0.07376 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.", "vendor": "Synacor", "product": "Zimbra Collaboration Suite", "added_date": "2026-08-06T00:00:00.000Z", "cvss_score": 6.1, "epss_score": 0.07376, "cvss_severity": "MEDIUM", "epss_percentile": 0.9381, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2018-14013", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14013"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2018-14013"}]}, {"uuid": "c8ac322b-2cd1-4d50-8956-a051f8869ef3", "vulnerability": {"vulnId": "CVE-2026-63077", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "c8ac322b-2cd1-4d50-8956-a051f8869ef3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-05T16:50:38+00:00"}, "timestamps": {"asserted_at": "2026-08-05T16:50:38+00:00", "recorded_at": "2026-08-05T18:00:01+00:00", "first_seen_at": "2026-08-05T16:50:38+00:00"}, "scope": {"notes": "In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol | Affected: JetBrains / TeamCity | CVSS: 9.8 (CRITICAL) | EPSS: 0.00649 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol", "vendor": "JetBrains", "product": "TeamCity", "added_date": "2026-08-05T16:50:38.645Z", "cvss_score": 9.8, "epss_score": 0.00649, "cvss_severity": "CRITICAL", "epss_percentile": 0.47585, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-63077", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63077"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-63077"}]}, {"uuid": "f5ad1c77-7a11-432a-aeed-fb4c6dddf25f", "vulnerability": {"vulnId": "CVE-2026-34486", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "f5ad1c77-7a11-432a-aeed-fb4c6dddf25f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-04T16:45:52+00:00"}, "timestamps": {"asserted_at": "2026-08-04T16:45:52+00:00", "recorded_at": "2026-08-04T18:00:01+00:00", "first_seen_at": "2026-08-04T16:45:52+00:00"}, "scope": {"notes": "Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor | Affected: Apache Software Foundation / Apache Tomcat | CVSS: 7.5 (HIGH) | EPSS: 0.42627 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor", "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "added_date": "2026-08-04T16:45:52.078Z", "cvss_score": 7.5, "epss_score": 0.42627, "cvss_severity": "HIGH", "epss_percentile": 0.9858, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-34486", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34486"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-34486"}]}, {"uuid": "51520397-d1e1-44fa-be20-ddd28bbc8741", "vulnerability": {"vulnId": "CVE-2026-9198", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "51520397-d1e1-44fa-be20-ddd28bbc8741"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-04T16:45:52+00:00"}, "timestamps": {"asserted_at": "2026-08-04T16:45:52+00:00", "recorded_at": "2026-08-04T18:00:01+00:00", "first_seen_at": "2026-08-04T16:45:52+00:00"}, "scope": {"notes": "Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation | Affected: IBM / Langflow OSS | CVSS: 9.8 (CRITICAL) | EPSS: 0.01886 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation", "vendor": "IBM", "product": "Langflow OSS", "added_date": "2026-08-04T16:45:52.078Z", "cvss_score": 9.8, "epss_score": 0.01886, "cvss_severity": "CRITICAL", "epss_percentile": 0.77474, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-9198", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9198"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-9198"}]}, {"uuid": "0f04cf0a-5d10-416a-886f-98bf71a80672", "vulnerability": {"vulnId": "CVE-2026-48313", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "0f04cf0a-5d10-416a-886f-98bf71a80672"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-04T10:48:59+00:00"}, "timestamps": {"asserted_at": "2026-08-04T10:48:59+00:00", "recorded_at": "2026-08-04T11:00:01+00:00", "first_seen_at": "2026-08-04T10:48:59+00:00"}, "scope": {"notes": "ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Affected: Adobe / ColdFusion | CVSS: 9.3 (CRITICAL) | EPSS: 0.04164 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)", "vendor": "Adobe", "product": "ColdFusion", "added_date": "2026-08-04T10:48:59.031Z", "cvss_score": 9.3, "epss_score": 0.04164, "cvss_severity": "CRITICAL", "epss_percentile": 0.89876, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-48313", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48313"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48313"}]}, {"uuid": "8d9a5cf7-8256-49fb-ad1f-f60ea89193f6", "vulnerability": {"vulnId": "CVE-2026-28409", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "8d9a5cf7-8256-49fb-ad1f-f60ea89193f6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-04T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-04T00:00:00+00:00", "recorded_at": "2026-08-05T11:00:01+00:00", "first_seen_at": "2026-08-04T00:00:00+00:00"}, "scope": {"notes": "WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection | Affected: LabRedesCefetRJ / WeGIA | CVSS: 10.0 (CRITICAL) | EPSS: 0.03315 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection", "vendor": "LabRedesCefetRJ", "product": "WeGIA", "added_date": "2026-08-04T00:00:00.000Z", "cvss_score": 10.0, "epss_score": 0.03315, "cvss_severity": "CRITICAL", "epss_percentile": 0.87361, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-28409", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28409"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-28409"}]}, {"uuid": "263fb9e0-a398-4100-81af-047d3707fdcc", "vulnerability": {"vulnId": "CVE-2026-18577", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "263fb9e0-a398-4100-81af-047d3707fdcc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-03T18:55:09+00:00"}, "timestamps": {"asserted_at": "2026-08-03T18:55:09+00:00", "recorded_at": "2026-08-03T20:00:02+00:00", "first_seen_at": "2026-08-03T18:55:09+00:00"}, "scope": {"notes": "Incomplete patch leads to administrative account takeover | Affected: N-able / N-central | CVSS: 8.2 (HIGH) | EPSS: 0.01477 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Incomplete patch leads to administrative account takeover", "vendor": "N-able", "product": "N-central", "added_date": "2026-08-03T18:55:09.067Z", "cvss_score": 8.2, "epss_score": 0.01477, "cvss_severity": "HIGH", "epss_percentile": 0.7132, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-18577", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18577"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-18577"}]}, {"uuid": "b8e6d441-9db5-42a2-81c7-cd361383211d", "vulnerability": {"vulnId": "CVE-2026-54066", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "b8e6d441-9db5-42a2-81c7-cd361383211d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-03T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-03T00:00:00+00:00", "recorded_at": "2026-08-04T11:00:01+00:00", "first_seen_at": "2026-08-03T00:00:00+00:00"}, "scope": {"notes": "SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file\u2500read) | Affected: siyuan-note / siyuan | CVSS: 7.5 (HIGH) | EPSS: 0.01892 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file\u2500read)", "vendor": "siyuan-note", "product": "siyuan", "added_date": "2026-08-03T00:00:00.000Z", "cvss_score": 7.5, "epss_score": 0.01892, "cvss_severity": "HIGH", "epss_percentile": 0.7754, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-54066", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54066"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-54066"}]}, {"uuid": "a58186bc-7cfa-4e70-a62c-87fe0a86ca5e", "vulnerability": {"vulnId": "CVE-2026-38992", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "a58186bc-7cfa-4e70-a62c-87fe0a86ca5e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-03T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-03T00:00:00+00:00", "recorded_at": "2026-08-04T11:00:01+00:00", "first_seen_at": "2026-08-03T00:00:00+00:00"}, "scope": {"notes": "Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows... | Affected: Cockpit-HQ / Cockpit | CVSS: 9.8 (CRITICAL) | EPSS: 0.00426 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows...", "vendor": "Cockpit-HQ", "product": "Cockpit", "added_date": "2026-08-03T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.00426, "cvss_severity": "CRITICAL", "epss_percentile": 0.35124, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-38992", "url": "https://www.cve.org/CVERecord?id=CVE-2026-38992"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-38992"}]}, {"uuid": "8c163874-e0de-4e15-b08c-f2a6d18f1475", "vulnerability": {"vulnId": "CVE-2026-28496", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "8c163874-e0de-4e15-b08c-f2a6d18f1475"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-03T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-03T00:00:00+00:00", "recorded_at": "2026-08-04T11:00:01+00:00", "first_seen_at": "2026-08-03T00:00:00+00:00"}, "scope": {"notes": "FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE | Affected: FOSSBilling / FOSSBilling | CVSS: 9.4 (CRITICAL) | EPSS: 0.17612 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE", "vendor": "FOSSBilling", "product": "FOSSBilling", "added_date": "2026-08-03T00:00:00.000Z", "cvss_score": 9.4, "epss_score": 0.17612, "cvss_severity": "CRITICAL", "epss_percentile": 0.96841, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-28496", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28496"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-28496"}]}, {"uuid": "67abd7e3-1cf3-498f-aa34-c267e5a383fb", "vulnerability": {"vulnId": "CVE-2023-2825", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "67abd7e3-1cf3-498f-aa34-c267e5a383fb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-02T00:00:00+00:00", "recorded_at": "2026-08-03T11:00:01+00:00", "first_seen_at": "2026-08-02T00:00:00+00:00"}, "scope": {"notes": "An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal... | Affected: GitLab / GitLab | CVSS: 10.0 (CRITICAL) | EPSS: 0.71641 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal...", "vendor": "GitLab", "product": "GitLab", "added_date": "2026-08-02T00:00:00.000Z", "cvss_score": 10.0, "epss_score": 0.71641, "cvss_severity": "CRITICAL", "epss_percentile": 0.99359, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-2825", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2825"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-2825"}]}, {"uuid": "4c46f25a-4798-4fbb-b54c-46205c806002", "vulnerability": {"vulnId": "CVE-2023-54359", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "4c46f25a-4798-4fbb-b54c-46205c806002"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-02T00:00:00+00:00", "recorded_at": "2026-08-03T11:00:01+00:00", "first_seen_at": "2026-08-02T00:00:00+00:00"}, "scope": {"notes": "WordPress adivaha Travel Plugin 2.3 SQL Injection via pid | Affected: Adivaha / WordPress adivaha Travel Plugin | CVSS: 8.8 (HIGH) | EPSS: 0.00269 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WordPress adivaha Travel Plugin 2.3 SQL Injection via pid", "vendor": "Adivaha", "product": "WordPress adivaha Travel Plugin", "added_date": "2026-08-02T00:00:00.000Z", "cvss_score": 8.8, "epss_score": 0.00269, "cvss_severity": "HIGH", "epss_percentile": 0.18971, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2023-54359", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54359"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-54359"}]}, {"uuid": "1f27c600-d58f-4a56-ae5e-d217a6583a1c", "vulnerability": {"vulnId": "CVE-2025-71324", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "1f27c600-d58f-4a56-ae5e-d217a6583a1c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-02T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-08-02T00:00:00+00:00", "recorded_at": "2026-08-03T11:00:01+00:00", "first_seen_at": "2026-08-02T00:00:00+00:00"}, "scope": {"notes": "Flowise - Arbitrary File Read via chatId Parameter | Affected: Flowise / Flowise | CVSS: 8.7 (HIGH) | EPSS: 0.00431 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Flowise - Arbitrary File Read via chatId Parameter", "vendor": "Flowise", "product": "Flowise", "added_date": "2026-08-02T00:00:00.000Z", "cvss_score": 8.7, "epss_score": 0.00431, "cvss_severity": "HIGH", "epss_percentile": 0.35452, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-71324", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71324"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-71324"}]}, {"uuid": "c7348c25-7f52-4a7b-aceb-f7f22bc17056", "vulnerability": {"vulnId": "CVE-2026-18556", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "c7348c25-7f52-4a7b-aceb-f7f22bc17056"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-01T13:51:00+00:00"}, "timestamps": {"asserted_at": "2026-08-01T13:51:00+00:00", "recorded_at": "2026-08-02T14:00:01+00:00", "first_seen_at": "2026-08-01T13:51:00+00:00"}, "scope": {"notes": "Unauthenticated administrative account takeover | Affected: N-able / N-central | CVSS: 8.2 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Unauthenticated administrative account takeover", "vendor": "N-able", "product": "N-central", "added_date": "2026-08-01T13:51:00.000Z", "cvss_score": 8.2, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-18556", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18556"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-18556"}]}, {"uuid": "f56e958c-2c39-4369-8573-a01219357ff8", "vulnerability": {"vulnId": "CVE-2024-37014", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "f56e958c-2c39-4369-8573-a01219357ff8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-01T10:55:44+00:00"}, "timestamps": {"asserted_at": "2026-08-01T10:55:44+00:00", "recorded_at": "2026-08-01T11:00:01+00:00", "first_seen_at": "2026-08-01T10:55:44+00:00"}, "scope": {"notes": "Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the \"POST /api/v1/custom_component\" endpoint and provide... | Affected: langflow-ai / Langflow | CVSS: 9.8 (CRITICAL) | EPSS: 0.31113 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the \"POST /api/v1/custom_component\" endpoint and provide...", "vendor": "langflow-ai", "product": "Langflow", "added_date": "2026-08-01T10:55:44.980Z", "cvss_score": 9.8, "epss_score": 0.31113, "cvss_severity": "CRITICAL", "epss_percentile": 0.98087, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-37014", "url": "https://www.cve.org/CVERecord?id=CVE-2024-37014"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-37014"}]}, {"uuid": "98b75082-2977-4037-ad56-ddd989d7a4f8", "vulnerability": {"vulnId": "CVE-2026-59800", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "98b75082-2977-4037-ad56-ddd989d7a4f8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-31T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-31T00:00:00+00:00", "recorded_at": "2026-08-01T11:00:01+00:00", "first_seen_at": "2026-07-31T00:00:00+00:00"}, "scope": {"notes": "9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint | Affected: decolua / 9router | CVSS: 9.2 (CRITICAL) | EPSS: 0.01338 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint", "vendor": "decolua", "product": "9router", "added_date": "2026-07-31T00:00:00.000Z", "cvss_score": 9.2, "epss_score": 0.01338, "cvss_severity": "CRITICAL", "epss_percentile": 0.68457, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-59800", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59800"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-59800"}]}, {"uuid": "17bffc5b-dfa0-4bd1-9c4a-371c5fea2891", "vulnerability": {"vulnId": "CVE-2021-1472", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "17bffc5b-dfa0-4bd1-9c4a-371c5fea2891"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-30T15:50:01+00:00"}, "timestamps": {"asserted_at": "2026-07-30T15:50:01+00:00", "recorded_at": "2026-07-30T16:00:01+00:00", "first_seen_at": "2026-07-30T15:50:01+00:00"}, "scope": {"notes": "Cisco Small Business RV Series Routers Vulnerabilities | Affected: Cisco / Cisco Small Business RV Series Router Firmware | CVSS: 5.3 (MEDIUM) | EPSS: 0.72472 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Cisco Small Business RV Series Routers Vulnerabilities", "vendor": "Cisco", "product": "Cisco Small Business RV Series Router Firmware", "added_date": "2026-07-30T15:50:01.902Z", "cvss_score": 5.3, "epss_score": 0.72472, "cvss_severity": "MEDIUM", "epss_percentile": 0.99384, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2021-1472", "url": "https://www.cve.org/CVERecord?id=CVE-2021-1472"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-1472"}]}, {"uuid": "250f151a-3762-4e7f-a8a6-e61e94d5c01c", "vulnerability": {"vulnId": "CVE-2019-8942", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "250f151a-3762-4e7f-a8a6-e61e94d5c01c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-30T10:42:00+00:00"}, "timestamps": {"asserted_at": "2026-07-30T10:42:00+00:00", "recorded_at": "2026-07-30T11:00:01+00:00", "first_seen_at": "2026-07-30T10:42:00+00:00"}, "scope": {"notes": "WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an... | Affected: WordPress / WordPress | CVSS: 8.8 (HIGH) | EPSS: 0.82736 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an...", "vendor": "WordPress", "product": "WordPress", "added_date": "2026-07-30T10:42:00.000Z", "cvss_score": 8.8, "epss_score": 0.82736, "cvss_severity": "HIGH", "epss_percentile": 0.99637, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2019-8942", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8942"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2019-8942"}]}, {"uuid": "c5f07788-04ac-4d70-bb57-ab5822faeefe", "vulnerability": {"vulnId": "CVE-2026-1623", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "c5f07788-04ac-4d70-bb57-ab5822faeefe"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-30T05:53:55+00:00"}, "timestamps": {"asserted_at": "2026-07-30T05:53:55+00:00", "recorded_at": "2026-07-30T06:00:01+00:00", "first_seen_at": "2026-07-30T05:53:55+00:00"}, "scope": {"notes": "Totolink A7000R cstecgi.cgi setUpgradeFW command injection | Affected: Totolink / A7000R | CVSS: 5.3 (MEDIUM) | EPSS: 0.0218 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Totolink A7000R cstecgi.cgi setUpgradeFW command injection", "vendor": "Totolink", "product": "A7000R", "added_date": "2026-07-30T05:53:55.753Z", "cvss_score": 5.3, "epss_score": 0.0218, "cvss_severity": "MEDIUM", "epss_percentile": 0.80513, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-1623", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1623"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-1623"}]}, {"uuid": "b2dc12eb-f4ac-4fac-8025-9303500e345f", "vulnerability": {"vulnId": "CVE-2026-20316", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "b2dc12eb-f4ac-4fac-8025-9303500e345f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-29T18:45:59+00:00"}, "timestamps": {"asserted_at": "2026-07-29T18:45:59+00:00", "recorded_at": "2026-07-29T20:00:01+00:00", "first_seen_at": "2026-07-29T18:45:59+00:00"}, "scope": {"notes": "Cisco Secure Firewall Management Center Software Static Credential Vulnerability | Affected: Cisco / Cisco Secure Firewall Management Center (FMC) | CVSS: 5.3 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Cisco Secure Firewall Management Center Software Static Credential Vulnerability", "vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "added_date": "2026-07-29T18:45:59.580Z", "cvss_score": 5.3, "epss_score": null, "cvss_severity": "MEDIUM", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-20316", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20316"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-20316"}]}, {"uuid": "7784d2d5-9fea-4ac5-be5c-c9687de34351", "vulnerability": {"vulnId": "CVE-2025-71334", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "7784d2d5-9fea-4ac5-be5c-c9687de34351"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-28T12:54:07+00:00"}, "timestamps": {"asserted_at": "2026-07-28T12:54:07+00:00", "recorded_at": "2026-07-28T13:00:01+00:00", "first_seen_at": "2026-07-28T12:54:07+00:00"}, "scope": {"notes": "Flowise - Arbitrary File Access via Missing Chat Flow ID Validation | Affected: Flowise / Flowise | CVSS: 9.3 (CRITICAL) | EPSS: 0.01171 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Flowise - Arbitrary File Access via Missing Chat Flow ID Validation", "vendor": "Flowise", "product": "Flowise", "added_date": "2026-07-28T12:54:07.303Z", "cvss_score": 9.3, "epss_score": 0.01171, "cvss_severity": "CRITICAL", "epss_percentile": 0.64171, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-71334", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71334"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-71334"}]}, {"uuid": "4cba00bb-a85a-4c38-b65d-65c0bc7bfc5e", "vulnerability": {"vulnId": "CVE-2025-68686", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "4cba00bb-a85a-4c38-b65d-65c0bc7bfc5e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-27T17:00:05+00:00"}, "timestamps": {"asserted_at": "2026-07-27T17:00:05+00:00", "recorded_at": "2026-07-27T18:00:01+00:00", "first_seen_at": "2026-07-27T17:00:05+00:00"}, "scope": {"notes": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,... | Affected: Fortinet / FortiOS | CVSS: 5.9 (MEDIUM) | EPSS: 0.00477 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,...", "vendor": "Fortinet", "product": "FortiOS", "added_date": "2026-07-27T17:00:05.726Z", "cvss_score": 5.9, "epss_score": 0.00477, "cvss_severity": "MEDIUM", "epss_percentile": 0.38495, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2025-68686", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68686"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-68686"}]}, {"uuid": "7d708add-30dc-4333-a3ca-71b5fb4c42af", "vulnerability": {"vulnId": "CVE-2026-16812", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "7d708add-30dc-4333-a3ca-71b5fb4c42af"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-27T16:20:55+00:00"}, "timestamps": {"asserted_at": "2026-07-27T16:20:55+00:00", "recorded_at": "2026-07-27T17:00:01+00:00", "first_seen_at": "2026-07-27T16:20:55+00:00"}, "scope": {"notes": "VeloCloud Orchestrator OS Command Injection | Affected: Arista Networks / VeloCloud Orchestrator On-Prem | CVSS: 10.0 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "VeloCloud Orchestrator OS Command Injection", "vendor": "Arista Networks", "product": "VeloCloud Orchestrator On-Prem", "added_date": "2026-07-27T16:20:55.359Z", "cvss_score": 10.0, "epss_score": null, "cvss_severity": "CRITICAL", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-16812", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16812"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-16812"}]}, {"uuid": "037d8688-07dd-49a2-8f44-48a2a553b7a3", "vulnerability": {"vulnId": "CVE-2026-58138", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "037d8688-07dd-49a2-8f44-48a2a553b7a3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-27T10:20:05+00:00"}, "timestamps": {"asserted_at": "2026-07-27T10:20:05+00:00", "recorded_at": "2026-07-27T11:00:02+00:00", "first_seen_at": "2026-07-27T10:20:05+00:00"}, "scope": {"notes": "Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators | Affected: conductor-oss / conductor | CVSS: 9.3 (CRITICAL) | EPSS: 0.01155 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators", "vendor": "conductor-oss", "product": "conductor", "added_date": "2026-07-27T10:20:05.791Z", "cvss_score": 9.3, "epss_score": 0.01155, "cvss_severity": "CRITICAL", "epss_percentile": 0.63728, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-58138", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58138"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-58138"}]}, {"uuid": "a542b3f9-28ad-4206-8bab-06d34e663279", "vulnerability": {"vulnId": "CVE-2014-2383", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "a542b3f9-28ad-4206-8bab-06d34e663279"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-25T11:07:06+00:00"}, "timestamps": {"asserted_at": "2026-07-25T11:07:06+00:00", "recorded_at": "2026-07-25T12:00:01+00:00", "first_seen_at": "2026-07-25T11:07:06+00:00"}, "scope": {"notes": "dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read... | Affected: dompdf / dompdf | CVSS: 6.8 (MEDIUM) | EPSS: 0.39231 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read...", "vendor": "dompdf", "product": "dompdf", "added_date": "2026-07-25T11:07:06.460Z", "cvss_score": 6.8, "epss_score": 0.39231, "cvss_severity": "MEDIUM", "epss_percentile": 0.98447, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2014-2383", "url": "https://www.cve.org/CVERecord?id=CVE-2014-2383"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2014-2383"}]}, {"uuid": "cabad5d5-7de5-408d-a634-4ff873a0cfa5", "vulnerability": {"vulnId": "CVE-2026-16723", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "cabad5d5-7de5-408d-a634-4ff873a0cfa5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-25T02:23:23+00:00"}, "timestamps": {"asserted_at": "2026-07-25T02:23:23+00:00", "recorded_at": "2026-07-25T12:00:01+00:00", "first_seen_at": "2026-07-25T02:23:23+00:00"}, "scope": {"notes": "Remote Code Execution in fastjson 1.2.68\u20131.2.83 | Affected: Alibaba / Fastjson | CVSS: 9.0 (CRITICAL) | EPSS: 0.00413 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Remote Code Execution in fastjson 1.2.68\u20131.2.83", "vendor": "Alibaba", "product": "Fastjson", "added_date": "2026-07-25T02:23:23.000Z", "cvss_score": 9.0, "epss_score": 0.00413, "cvss_severity": "CRITICAL", "epss_percentile": 0.3383, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-16723", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16723"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-16723"}]}, {"uuid": "1efef072-e612-466a-92be-4463052dd51a", "vulnerability": {"vulnId": "CVE-2025-4283", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "1efef072-e612-466a-92be-4463052dd51a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-24T08:52:14+00:00"}, "timestamps": {"asserted_at": "2026-07-24T08:52:14+00:00", "recorded_at": "2026-07-24T09:00:01+00:00", "first_seen_at": "2026-07-24T08:52:14+00:00"}, "scope": {"notes": "SourceCodester/oretnom23 Stock Management System Login.php sql injection | Affected: SourceCodester, oretnom23 / Stock Management System | CVSS: 6.9 (MEDIUM) | EPSS: 0.00491 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "SourceCodester/oretnom23 Stock Management System Login.php sql injection", "vendor": "SourceCodester, oretnom23", "product": "Stock Management System", "added_date": "2026-07-24T08:52:14.602Z", "cvss_score": 6.9, "epss_score": 0.00491, "cvss_severity": "MEDIUM", "epss_percentile": 0.39307, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-4283", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4283"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-4283"}]}, {"uuid": "6c49082f-b628-483f-a394-1af2816d7654", "vulnerability": {"vulnId": "CVE-2016-3081", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "6c49082f-b628-483f-a394-1af2816d7654"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-23T09:37:25+00:00"}, "timestamps": {"asserted_at": "2026-07-23T09:37:25+00:00", "recorded_at": "2026-07-23T10:00:01+00:00", "first_seen_at": "2026-07-23T09:37:25+00:00"}, "scope": {"notes": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to... | Affected: Apache / Struts | CVSS: 8.1 (HIGH) | EPSS: 0.93249 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to...", "vendor": "Apache", "product": "Struts", "added_date": "2026-07-23T09:37:25.728Z", "cvss_score": 8.1, "epss_score": 0.93249, "cvss_severity": "HIGH", "epss_percentile": 0.99824, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2016-3081", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3081"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2016-3081"}]}, {"uuid": "a32fd972-96af-466a-bb50-405309376a77", "vulnerability": {"vulnId": "CVE-2026-16232", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "a32fd972-96af-466a-bb50-405309376a77"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-22T15:57:00+00:00"}, "timestamps": {"asserted_at": "2026-07-22T15:57:00+00:00", "recorded_at": "2026-07-22T16:00:01+00:00", "first_seen_at": "2026-07-22T15:57:00+00:00"}, "scope": {"notes": "Authentication Bypass in the SmartConsole Login Process Using an Application Token | Affected: checkpoint / Quantum Security Management, Multi-Domain Security Management | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Authentication Bypass in the SmartConsole Login Process Using an Application Token", "vendor": "checkpoint", "product": "Quantum Security Management, Multi-Domain Security Management", "added_date": "2026-07-22T15:57:00.000Z", "cvss_score": null, "epss_score": null, "cvss_severity": null, "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-16232", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16232"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-16232"}]}, {"uuid": "54c80942-7cf7-48d4-ad93-eeff2db06f44", "vulnerability": {"vulnId": "CVE-2026-29059", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "54c80942-7cf7-48d4-ad93-eeff2db06f44"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-22T12:36:36+00:00"}, "timestamps": {"asserted_at": "2026-07-22T12:36:36+00:00", "recorded_at": "2026-07-22T15:00:01+00:00", "first_seen_at": "2026-07-22T12:36:36+00:00"}, "scope": {"notes": "Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly | Affected: windmill-labs / windmill | CVSS: 6.9 (MEDIUM) | EPSS: 0.02584 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly", "vendor": "windmill-labs", "product": "windmill", "added_date": "2026-07-22T12:36:36.000Z", "cvss_score": 6.9, "epss_score": 0.02584, "cvss_severity": "MEDIUM", "epss_percentile": 0.83609, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-29059", "url": "https://www.cve.org/CVERecord?id=CVE-2026-29059"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-29059"}]}, {"uuid": "b4f8a1e1-935d-4a90-84d4-5b692d14d294", "vulnerability": {"vulnId": "CVE-2026-36356", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "b4f8a1e1-935d-4a90-84d4-5b692d14d294"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-22T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-22T00:00:00+00:00", "recorded_at": "2026-07-23T11:00:01+00:00", "first_seen_at": "2026-07-22T00:00:00+00:00"}, "scope": {"notes": "The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection... | Affected: MeiG / Smart FORGE_SLT711 | CVSS: 9.1 (CRITICAL) | EPSS: 0.13549 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection...", "vendor": "MeiG", "product": "Smart FORGE_SLT711", "added_date": "2026-07-22T00:00:00.000Z", "cvss_score": 9.1, "epss_score": 0.13549, "cvss_severity": "CRITICAL", "epss_percentile": 0.96056, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-36356", "url": "https://www.cve.org/CVERecord?id=CVE-2026-36356"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-36356"}]}, {"uuid": "eb5d10bd-a00c-499c-99c6-8a51731d4ec9", "vulnerability": {"vulnId": "CVE-2026-0770", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "eb5d10bd-a00c-499c-99c6-8a51731d4ec9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-21T14:32:22+00:00"}, "timestamps": {"asserted_at": "2026-07-21T14:32:22+00:00", "recorded_at": "2026-07-21T15:00:01+00:00", "first_seen_at": "2026-07-21T14:32:22+00:00"}, "scope": {"notes": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability | Affected: Langflow / Langflow | CVSS: 9.8 (CRITICAL) | EPSS: 0.10371 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability", "vendor": "Langflow", "product": "Langflow", "added_date": "2026-07-21T14:32:22.598Z", "cvss_score": 9.8, "epss_score": 0.10371, "cvss_severity": "CRITICAL", "epss_percentile": 0.95225, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-0770", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0770"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-0770"}]}, {"uuid": "6f8d2045-aa6d-4b1d-ba59-8e3808313b44", "vulnerability": {"vulnId": "CVE-2021-27137", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "6f8d2045-aa6d-4b1d-ba59-8e3808313b44"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-21T14:32:22+00:00"}, "timestamps": {"asserted_at": "2026-07-21T14:32:22+00:00", "recorded_at": "2026-07-21T15:00:01+00:00", "first_seen_at": "2026-07-21T14:32:22+00:00"}, "scope": {"notes": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an... | Affected: DD-WRT / DD-WRT | CVSS: 8.1 (HIGH) | EPSS: 0.05447 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an...", "vendor": "DD-WRT", "product": "DD-WRT", "added_date": "2026-07-21T14:32:22.598Z", "cvss_score": 8.1, "epss_score": 0.05447, "cvss_severity": "HIGH", "epss_percentile": 0.91861, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2021-27137", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27137"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2021-27137"}]}, {"uuid": "fdef5d8e-bc21-43c0-a45f-42d85f8ee6e4", "vulnerability": {"vulnId": "CVE-2026-50522", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "fdef5d8e-bc21-43c0-a45f-42d85f8ee6e4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-21T10:24:00+00:00"}, "timestamps": {"asserted_at": "2026-07-21T10:24:00+00:00", "recorded_at": "2026-07-21T11:00:02+00:00", "first_seen_at": "2026-07-21T10:24:00+00:00"}, "scope": {"notes": "Microsoft SharePoint Remote Code Execution Vulnerability | Affected: Microsoft / Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition | CVSS: 9.8 (CRITICAL) | EPSS: 0.20346 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Microsoft SharePoint Remote Code Execution Vulnerability", "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition", "added_date": "2026-07-21T10:24:00.000Z", "cvss_score": 9.8, "epss_score": 0.20346, "cvss_severity": "CRITICAL", "epss_percentile": 0.97202, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-50522", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50522"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-50522"}]}, {"uuid": "266e5c08-f6f9-4094-841d-dc2f28eea1a3", "vulnerability": {"vulnId": "CVE-2026-48611", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "266e5c08-f6f9-4094-841d-dc2f28eea1a3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-20T07:57:22+00:00"}, "timestamps": {"asserted_at": "2026-07-20T07:57:22+00:00", "recorded_at": "2026-07-20T08:00:01+00:00", "first_seen_at": "2026-07-20T07:57:22+00:00"}, "scope": {"notes": "Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to... | Affected: phpBB / phpBB | CVSS: 9.8 (CRITICAL) | EPSS: 0.02865 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to...", "vendor": "phpBB", "product": "phpBB", "added_date": "2026-07-20T07:57:22.068Z", "cvss_score": 9.8, "epss_score": 0.02865, "cvss_severity": "CRITICAL", "epss_percentile": 0.8522, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-48611", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48611"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48611"}]}, {"uuid": "a7b6b39c-f0d0-46d3-b487-0658e7e27c94", "vulnerability": {"vulnId": "CVE-2025-68493", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "a7b6b39c-f0d0-46d3-b487-0658e7e27c94"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-20T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-20T00:00:00+00:00", "recorded_at": "2026-07-21T11:00:02+00:00", "first_seen_at": "2026-07-20T00:00:00+00:00"}, "scope": {"notes": "Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component | Affected: Apache Software Foundation / Apache Struts | CVSS: 8.1 (HIGH) | EPSS: 0.23054 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component", "vendor": "Apache Software Foundation", "product": "Apache Struts", "added_date": "2026-07-20T00:00:00.000Z", "cvss_score": 8.1, "epss_score": 0.23054, "cvss_severity": "HIGH", "epss_percentile": 0.97507, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2025-68493", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68493"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2025-68493"}]}, {"uuid": "9b2d3c99-4298-4933-ad3a-6087f3213b78", "vulnerability": {"vulnId": "CVE-2026-22679", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "9b2d3c99-4298-4933-ad3a-6087f3213b78"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-19T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-19T00:00:00+00:00", "recorded_at": "2026-07-20T11:00:02+00:00", "first_seen_at": "2026-07-19T00:00:00+00:00"}, "scope": {"notes": "Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint | Affected: Weaver Network Co., Ltd. / E-cology | CVSS: 9.3 (CRITICAL) | EPSS: 0.2148 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint", "vendor": "Weaver Network Co., Ltd.", "product": "E-cology", "added_date": "2026-07-19T00:00:00.000Z", "cvss_score": 9.3, "epss_score": 0.2148, "cvss_severity": "CRITICAL", "epss_percentile": 0.97341, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-22679", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22679"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-22679"}]}, {"uuid": "965351e2-52f4-48d5-9ffa-30f0b22d7f18", "vulnerability": {"vulnId": "CVE-2026-63030", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "965351e2-52f4-48d5-9ffa-30f0b22d7f18"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-18T16:03:00+00:00"}, "timestamps": {"asserted_at": "2026-07-18T16:03:00+00:00", "recorded_at": "2026-07-19T17:00:01+00:00", "first_seen_at": "2026-07-18T16:03:00+00:00"}, "scope": {"notes": "WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | Affected: WordPress / WordPress | CVSS: 9.8 (CRITICAL) | EPSS: 0.08946 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution", "vendor": "WordPress", "product": "WordPress", "added_date": "2026-07-18T16:03:00.000Z", "cvss_score": 9.8, "epss_score": 0.08946, "cvss_severity": "CRITICAL", "epss_percentile": 0.94668, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-63030", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63030"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-63030"}]}, {"uuid": "35f1572b-45ed-40a8-836f-9068054a3dbe", "vulnerability": {"vulnId": "CVE-2026-60137", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "35f1572b-45ed-40a8-836f-9068054a3dbe"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-18T15:32:00+00:00"}, "timestamps": {"asserted_at": "2026-07-18T15:32:00+00:00", "recorded_at": "2026-07-19T16:00:01+00:00", "first_seen_at": "2026-07-18T15:32:00+00:00"}, "scope": {"notes": "WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | Affected: WordPress / WordPress | CVSS: 5.9 (MEDIUM) | EPSS: 0.04026 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query", "vendor": "WordPress", "product": "WordPress", "added_date": "2026-07-18T15:32:00.000Z", "cvss_score": 5.9, "epss_score": 0.04026, "cvss_severity": "MEDIUM", "epss_percentile": 0.89451, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-60137", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60137"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-60137"}]}, {"uuid": "da1cf476-0fcb-4573-8561-c4b3645b49f2", "vulnerability": {"vulnId": "CVE-2026-6875", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "da1cf476-0fcb-4573-8561-c4b3645b49f2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-18T10:55:00+00:00"}, "timestamps": {"asserted_at": "2026-07-18T10:55:00+00:00", "recorded_at": "2026-07-20T09:00:02+00:00", "first_seen_at": "2026-07-18T10:55:00+00:00"}, "scope": {"notes": "Sandbox Escape in ServiceNow AI Platform | Affected: ServiceNow / ServiceNow AI Platform | CVSS: 9.5 (CRITICAL) | EPSS: 0.00509 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Sandbox Escape in ServiceNow AI Platform", "vendor": "ServiceNow", "product": "ServiceNow AI Platform", "added_date": "2026-07-18T10:55:00.000Z", "cvss_score": 9.5, "epss_score": 0.00509, "cvss_severity": "CRITICAL", "epss_percentile": 0.40039, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-6875", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6875"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-6875"}]}, {"uuid": "7df46513-10f3-4c07-829a-17572e873297", "vulnerability": {"vulnId": "CVE-2024-36420", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "7df46513-10f3-4c07-829a-17572e873297"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-17T08:33:53+00:00"}, "timestamps": {"asserted_at": "2026-07-17T08:33:53+00:00", "recorded_at": "2026-07-17T09:00:01+00:00", "first_seen_at": "2026-07-17T08:33:53+00:00"}, "scope": {"notes": "GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file | Affected: FlowiseAI / Flowise | CVSS: 7.5 (HIGH) | EPSS: 0.01776 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file", "vendor": "FlowiseAI", "product": "Flowise", "added_date": "2026-07-17T08:33:53.505Z", "cvss_score": 7.5, "epss_score": 0.01776, "cvss_severity": "HIGH", "epss_percentile": 0.75707, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-36420", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36420"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-36420"}]}, {"uuid": "8ca79216-c70b-41c2-847b-837a18e1f759", "vulnerability": {"vulnId": "CVE-2026-46442", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "8ca79216-c70b-41c2-847b-837a18e1f759"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-17T07:51:05+00:00"}, "timestamps": {"asserted_at": "2026-07-17T07:51:05+00:00", "recorded_at": "2026-07-17T08:00:01+00:00", "first_seen_at": "2026-07-17T07:51:05+00:00"}, "scope": {"notes": "Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape | Affected: FlowiseAI / Flowise | CVSS: 9.4 (CRITICAL) | EPSS: 0.0082 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape", "vendor": "FlowiseAI", "product": "Flowise", "added_date": "2026-07-17T07:51:05.707Z", "cvss_score": 9.4, "epss_score": 0.0082, "cvss_severity": "CRITICAL", "epss_percentile": 0.53112, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-46442", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46442"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-46442"}]}, {"uuid": "1c5ad154-dc19-4f81-8037-be65dad66607", "vulnerability": {"vulnId": "CVE-2026-25089", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "1c5ad154-dc19-4f81-8037-be65dad66607"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T17:00:15+00:00"}, "timestamps": {"asserted_at": "2026-07-16T17:00:15+00:00", "recorded_at": "2026-07-16T18:00:01+00:00", "first_seen_at": "2026-07-16T17:00:15+00:00"}, "scope": {"notes": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through... | Affected: Fortinet / FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS | CVSS: 9.8 (CRITICAL) | EPSS: 0.23393 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through...", "vendor": "Fortinet", "product": "FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS", "added_date": "2026-07-16T17:00:15.684Z", "cvss_score": 9.8, "epss_score": 0.23393, "cvss_severity": "CRITICAL", "epss_percentile": 0.97528, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-25089", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25089"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-25089"}]}, {"uuid": "0725b21f-2cd4-4b18-bf9e-e6388adb19dc", "vulnerability": {"vulnId": "CVE-2023-4346", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "0725b21f-2cd4-4b18-bf9e-e6388adb19dc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T16:42:14+00:00"}, "timestamps": {"asserted_at": "2026-07-15T16:42:14+00:00", "recorded_at": "2026-07-15T18:00:02+00:00", "first_seen_at": "2026-07-15T16:42:14+00:00"}, "scope": {"notes": "\nKNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users... | Affected: KNX Association / KNX Protocol Connection Authorization Option 1 | CVSS: 7.5 (HIGH) | EPSS: 0.00483 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "\nKNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users...", "vendor": "KNX Association", "product": "KNX Protocol Connection Authorization Option 1", "added_date": "2026-07-15T16:42:14.826Z", "cvss_score": 7.5, "epss_score": 0.00483, "cvss_severity": "HIGH", "epss_percentile": 0.38438, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2023-4346", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4346"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2023-4346"}]}, {"uuid": "2d3a8f05-6353-4b21-a935-7d9cc932638b", "vulnerability": {"vulnId": "CVE-2026-15410", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "2d3a8f05-6353-4b21-a935-7d9cc932638b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T19:00:56+00:00"}, "timestamps": {"asserted_at": "2026-07-14T19:00:56+00:00", "recorded_at": "2026-07-14T21:00:01+00:00", "first_seen_at": "2026-07-14T19:00:56+00:00"}, "scope": {"notes": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management... | Affected: SonicWall / SMA1000 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management...", "vendor": "SonicWall", "product": "SMA1000", "added_date": "2026-07-14T19:00:56.138Z", "cvss_score": null, "epss_score": null, "cvss_severity": null, "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-15410", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15410"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-15410"}]}, {"uuid": "a428d69c-71f7-4ee8-b840-79cadef31425", "vulnerability": {"vulnId": "CVE-2026-15409", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "a428d69c-71f7-4ee8-b840-79cadef31425"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T18:18:00+00:00"}, "timestamps": {"asserted_at": "2026-07-14T18:18:00+00:00", "recorded_at": "2026-07-14T19:00:02+00:00", "first_seen_at": "2026-07-14T18:18:00+00:00"}, "scope": {"notes": "Sonicwall SMA1000 Appliance Work Place interface - Unauthenticated Server-side request forgery (SSRF) | Affected: Sonicwall / SMA1000 | CVSS: 10.0 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Sonicwall SMA1000 Appliance Work Place interface - Unauthenticated Server-side request forgery (SSRF)", "vendor": "Sonicwall", "product": "SMA1000", "added_date": "2026-07-14T18:18:00.000Z", "cvss_score": 10.0, "epss_score": null, "cvss_severity": "CRITICAL", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-15409", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15409"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-15409"}]}, {"uuid": "74ca21a8-fc43-4efe-b8a4-bd5bd0598ecb", "vulnerability": {"vulnId": "CVE-2026-56164", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "74ca21a8-fc43-4efe-b8a4-bd5bd0598ecb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T07:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-14T07:00:00+00:00", "recorded_at": "2026-07-14T18:00:02+00:00", "first_seen_at": "2026-07-14T07:00:00+00:00"}, "scope": {"notes": "Microsoft SharePoint Server Elevation of Privilege Vulnerability | Affected: Microsoft / Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition | CVSS: 5.3 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Microsoft SharePoint Server Elevation of Privilege Vulnerability", "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition", "added_date": "2026-07-14T07:00:00.000Z", "cvss_score": 5.3, "epss_score": null, "cvss_severity": "MEDIUM", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-56164", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56164"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-56164"}]}, {"uuid": "5cbbfec8-b494-4239-902c-5cbff324be29", "vulnerability": {"vulnId": "CVE-2026-56155", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "5cbbfec8-b494-4239-902c-5cbff324be29"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T07:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-14T07:00:00+00:00", "recorded_at": "2026-07-14T18:00:02+00:00", "first_seen_at": "2026-07-14T07:00:00+00:00"}, "scope": {"notes": "Active Directory Federation Services Elevation of Privilege Vulnerability | Affected: Microsoft / Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core installation) | CVSS: 7.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Active Directory Federation Services Elevation of Privilege Vulnerability", "vendor": "Microsoft", "product": "Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core installation)", "added_date": "2026-07-14T07:00:00.000Z", "cvss_score": 7.8, "epss_score": null, "cvss_severity": "HIGH", "epss_percentile": null, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-56155", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56155"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-56155"}]}, {"uuid": "606be08c-01ff-47a3-acf7-d8ea183a18fb", "vulnerability": {"vulnId": "CVE-2008-4128", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "606be08c-01ff-47a3-acf7-d8ea183a18fb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T17:00:17+00:00"}, "timestamps": {"asserted_at": "2026-07-13T17:00:17+00:00", "recorded_at": "2026-07-13T18:00:01+00:00", "first_seen_at": "2026-07-13T17:00:17+00:00"}, "scope": {"notes": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services... | Affected: Cisco / IOS | CVSS: 4.3 (MEDIUM) | EPSS: 0.12036 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services...", "vendor": "Cisco", "product": "IOS", "added_date": "2026-07-13T17:00:17.965Z", "cvss_score": 4.3, "epss_score": 0.12036, "cvss_severity": "MEDIUM", "epss_percentile": 0.95649, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2008-4128", "url": "https://www.cve.org/CVERecord?id=CVE-2008-4128"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2008-4128"}]}, {"uuid": "f5da2216-78df-4cec-a18d-80e8c7638ccb", "vulnerability": {"vulnId": "CVE-2024-29972", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "f5da2216-78df-4cec-a18d-80e8c7638ccb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-13T00:00:00+00:00", "recorded_at": "2026-07-14T11:00:01+00:00", "first_seen_at": "2026-07-13T00:00:00+00:00"}, "scope": {"notes": "** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the CGI program \"remote_help-cgi\" in Zyxel NAS326 firmware versions before... | Affected: Zyxel / NAS326 firmware, NAS542 firmware | CVSS: 9.8 (CRITICAL) | EPSS: 0.89218 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the CGI program \"remote_help-cgi\" in Zyxel NAS326 firmware versions before...", "vendor": "Zyxel", "product": "NAS326 firmware, NAS542 firmware", "added_date": "2026-07-13T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.89218, "cvss_severity": "CRITICAL", "epss_percentile": 0.99766, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2024-29972", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29972"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2024-29972"}]}, {"uuid": "c0016db6-9e91-4bc9-ade8-bce2ced70c15", "vulnerability": {"vulnId": "CVE-2026-48939", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "c0016db6-9e91-4bc9-ade8-bce2ced70c15"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T17:00:25+00:00"}, "timestamps": {"asserted_at": "2026-07-10T17:00:25+00:00", "recorded_at": "2026-07-10T18:00:02+00:00", "first_seen_at": "2026-07-10T17:00:25+00:00"}, "scope": {"notes": "Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 | Affected: icagenda.com / iCagenda extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.00564 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15", "vendor": "icagenda.com", "product": "iCagenda extension for Joomla", "added_date": "2026-07-10T17:00:25.732Z", "cvss_score": 10.0, "epss_score": 0.00564, "cvss_severity": "CRITICAL", "epss_percentile": 0.42883, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-48939", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48939"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-48939"}]}, {"uuid": "392613b0-fae6-4655-b63e-03bcca02a7eb", "vulnerability": {"vulnId": "CVE-2026-56291", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "392613b0-fae6-4655-b63e-03bcca02a7eb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T17:00:25+00:00"}, "timestamps": {"asserted_at": "2026-07-10T17:00:25+00:00", "recorded_at": "2026-07-10T18:00:02+00:00", "first_seen_at": "2026-07-10T17:00:25+00:00"}, "scope": {"notes": "Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 | Affected: balbooa.com / balbooa.com Balbooa Forms extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.00278 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1", "vendor": "balbooa.com", "product": "balbooa.com Balbooa Forms extension for Joomla", "added_date": "2026-07-10T17:00:25.732Z", "cvss_score": 10.0, "epss_score": 0.00278, "cvss_severity": "CRITICAL", "epss_percentile": 0.19623, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-56291", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56291"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-56291"}]}, {"uuid": "14b4e80b-96e8-4b09-9f3c-7e95a5db32db", "vulnerability": {"vulnId": "CVE-2026-2699", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "14b4e80b-96e8-4b09-9f3c-7e95a5db32db"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-10T00:00:00+00:00", "recorded_at": "2026-07-11T11:00:01+00:00", "first_seen_at": "2026-07-10T00:00:00+00:00"}, "scope": {"notes": "EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC) | Affected: Progress / ShareFile Storage Zones Controller | CVSS: 9.8 (CRITICAL) | EPSS: 0.49424 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "kevintel", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "KEVIntel (kevintel.com)", "title": "EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)", "vendor": "Progress", "product": "ShareFile Storage Zones Controller", "added_date": "2026-07-10T00:00:00.000Z", "cvss_score": 9.8, "epss_score": 0.49424, "cvss_severity": "CRITICAL", "epss_percentile": 0.98754, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-2699", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2699"}, {"id": "kevintel", "url": "https://kevintel.com/CVE-2026-2699"}]}]}