Security Radar

CVE-2026-94127 Critical · CVSS 9.3 added on 09/22/2026

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

F5 · BIG-IP APM · CWE-122

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

CVE-2025-39682 Critical · CVSS 9.8 added on 09/18/2026

Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

Linux · Kernel · CWE-754

Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

CVE-2026-76460 Critical · CVSS 10.0 added on 09/16/2026

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Cisco · Identity Services Engine · CWE-648

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

CVE-2026-76461 Critical · CVSS 9.8 added on 09/14/2026

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco · Secure Email Gateway · CWE-89

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

CVE-2026-85706 Critical · CVSS 10.0 added on 09/11/2026

GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

GitLab · Community Edition and Enterprise Edition · CWE-35

GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.

CVE-2026-84869 Critical · CVSS 9.9 added on 09/11/2026

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

ConnectWise · ScreenConnect · CWE-269, CWE-862

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.

CVE-2026-86060 Critical · CVSS 9.2 added on 09/10/2026

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

MikroTik · RouterOS · CWE-88

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.

CVE-2026-20079 Critical · CVSS 10.0 added on 09/09/2026

Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management · CWE-288

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

CVE-2025-25249 Critical · CVSS 9.8 added on 09/09/2026

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Fortinet · Multiple Products · CWE-122, CWE-787

Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.

CVE-2026-19490 Critical · CVSS 9.3 added on 09/09/2026

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Citrix · NetScaler · CWE-288

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

CVE-2026-86218 Critical · CVSS 10.0 added on 09/08/2026

N-able N-central Static Code Injection Vulnerability

N-able · N-central · CWE-96

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.

CVE-2026-75650 Critical · CVSS 10.0 added on 09/08/2026

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Adobe · Commerce and Magento · CWE-1336

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

CVE-2026-83548 Critical · CVSS 10.0 added on 09/02/2026

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall · SMA1000 Appliances · CWE-918, CWE-441

SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.

CVE-2026-9586 Critical · CVSS 9.3 added on 09/02/2026

Sangoma Switchvox SQL Injection Vulnerability

Sangoma · Switchvox · CWE-89

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.