Radar de Segurança

CVE-2024-27834 Média · CVSS 5.5 no catálogo em 04/11/2026

Apple Multiple Products Improper Authentication Vulnerability

Apple · Multiple Products · CWE-287

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. EN

CVE-2026-119977 Alta · CVSS 8.1 no catálogo em 03/11/2026

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

WordPress · WordPress Core · CWE-367

WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. EN

CVE-2026-111357 Alta · CVSS 7.0 no catálogo em 30/10/2026

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Ivanti · Connect Secure · CWE-306, CWE-862, CWE-345

Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. EN

CVE-2026-118527 Média · CVSS 4.3 no catálogo em 30/10/2026

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti · Connect Secure · CWE-340

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. EN

CVE-2026-97229 Crítica · CVSS 10.0 no catálogo em 29/10/2026

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

GitLab · Community Edition and Enterprise Edition · CWE-190

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. EN

CVE-2026-76418 Alta · CVSS 8.6 no catálogo em 29/10/2026

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Cisco · Secure Firewall ASA Software and Cisco Secure FTD Software · CWE-690

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. EN

CVE-2026-46300 Alta · CVSS 7.8 no catálogo em 28/10/2026

Linux Kernel Missing Initialization of a Variable Vulnerability

Linux · Kernel · CWE-456

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. EN

CVE-2026-41709 Baixa · CVSS 2.7 no catálogo em 28/10/2026

Broadcom VMWare ESX Insufficient Logging Vulnerability

Broadcom · VMware ESX · CWE-778

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. EN

CVE-2026-48356 Crítica · CVSS 9.3 no catálogo em 27/10/2026

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Adobe · Commerce and Magento · CWE-434

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. EN

CVE-2026-111497 Crítica · CVSS 9.2 no catálogo em 27/10/2026

Google Brotli Unchecked Return Value Vulnerability

Google · Brotli · CWE-252, CWE-787

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. EN

CVE-2026-109619 Crítica · CVSS 9.2 no catálogo em 26/10/2026

PHP Stale Internal Request-State Vulnerability

PHP Group · PHP · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. EN

CVE-2026-109618 Crítica · CVSS 9.2 no catálogo em 26/10/2026

PHP Memory Corruption Vulnerability

PHP Group · PHP · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. EN

CVE-2026-114625 Crítica · CVSS 9.4 no catálogo em 23/10/2026

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista · VeloCloud Orchestrator · CWE-89

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. EN

CVE-2026-110447 Crítica · CVSS 9.2 no catálogo em 23/10/2026

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora · Collabora Online – Built-in CODE Server · CWE-78

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. EN

CVE-2026-96656 Alta · CVSS 8.6 no catálogo em 20/10/2026

Plex Media Server External Control of File Name or Path Vulnerability

Plex · Media Server · CWE-73

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. EN

CVE-2026-106931 Alta · CVSS 8.5 no catálogo em 20/10/2026

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

EG Secure Solutions · SiteGuard Server Edition · CWE-78

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. EN

CVE-2026-110936 Alta · CVSS 8.4 no catálogo em 20/10/2026

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens · Software Center · CWE-427

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. EN

CVE-2026-96654 Média · CVSS 6.9 no catálogo em 20/10/2026

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex · Media Server · CWE-84

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. EN

CVE-2026-96655 Média · CVSS 5.3 no catálogo em 20/10/2026

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex · Media Server · CWE-918

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. EN

CVE-2026-96652 Média · CVSS 5.3 no catálogo em 20/10/2026

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex · Media Server · CWE-918

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. EN

CVE-2026-102764 Crítica · CVSS 9.3 no catálogo em 16/10/2026

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust · Remote Support · CWE-290

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. EN

CVE-2025-61624 Média · CVSS 6.5 no catálogo em 16/10/2026

Fortinet Multiple Products Path Traversal Vulnerability

Fortinet · Multiple Products · CWE-22

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. EN

CVE-2026-21589 Crítica · CVSS 9.3 no catálogo em 15/10/2026

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian · Multiple Products · CWE-552

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. EN

CVE-2026-105134 Crítica · CVSS 10.0 no catálogo em 14/10/2026

Ahsay AhsayCBS Command Injection Vulnerability

Ahsay · AhsayCBS · CWE-77, CWE-78

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. EN