Radar de Segurança

CVE-2026-76519 Crítica · CVSS 9.8 no catálogo em 14/10/2026

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Cisco · Secure Email Gateway · CWE-23

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. EN

CVE-2026-0322 Alta · CVSS 8.6 no catálogo em 14/10/2026

Palo Alto Networks PAN-OS Code Injection Vulnerability

Palo Alto Networks · PAN-OS · CWE-94

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. EN

CVE-2026-105133 Média · CVSS 6.9 no catálogo em 14/10/2026

Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay · AhsayCBS · CWE-287

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. EN

CVE-2026-96951 Alta · CVSS 8.8 no catálogo em 13/10/2026

Microsoft Windows Command Injection Vulnerability

Microsoft · Windows · CWE-77

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. EN

CVE-2026-104935 Alta · CVSS 8.6 no catálogo em 13/10/2026

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Ivanti · Connect Secure · CWE-290

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. EN

CVE-2015-3306 Crítica · CVSS 10.0 no catálogo em 08/10/2026

ProFTPD Improper Access Control Vulnerability

ProFTPD · ProFTPD · CWE-284

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. EN

CVE-2021-3199 Crítica · CVSS 9.8 no catálogo em 08/10/2026

ONLYOFFICE Docs Server Path Traversal Vulnerability

ONLYOFFICE · Docs · CWE-22

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. EN

CVE-2016-3081 Alta · CVSS 8.1 no catálogo em 08/10/2026

Apache Struts Command Injection Vulnerability

Apache · Struts · CWE-77

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. EN

CVE-2015-5477 Alta · CVSS 7.5 no catálogo em 08/10/2026

ISC BIND Data Processing Errors Vulnerability

ISC · BIND · CWE-19

ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. EN

CVE-2023-22894 Média · CVSS 4.9 no catálogo em 08/10/2026

Strapi Cleartext Storage of Sensitive Information Vulnerability

Strapi · Strapi · CWE-312

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. EN

CVE-2026-88779 Alta · CVSS 8.7 no catálogo em 04/10/2026

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix · NetScaler · CWE-119

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. EN

CVE-2026-102490 Crítica · CVSS 9.4 no catálogo em 02/10/2026

Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH · Zammad · CWE-269

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. EN

CVE-2026-102489 Crítica · CVSS 9.4 no catálogo em 02/10/2026

Zammad GmbH Zammad Session Fixation Vulnerability

Zammad GmbH · Zammad · CWE-384

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. EN

CVE-2026-104286 Crítica · CVSS 9.8 no catálogo em 01/10/2026

Fortinet FortiMail Path Traversal Vulnerability

Fortinet · FortiMail · CWE-22, CWE-158

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. EN

CVE-2026-76504 Crítica · CVSS 9.8 no catálogo em 30/09/2026

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Cisco · Catalyst SD-WAN Manager · CWE-177

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. EN

CVE-2026-86950 Alta · CVSS 8.8 no catálogo em 29/09/2026

Apple Multiple Products Out-of-Bounds Write Vulnerability

Apple · Multiple Products · CWE-787

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. EN

CVE-2026-88772 Crítica · CVSS 9.5 no catálogo em 27/09/2026

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix · NetScaler · CWE-119

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service EN

CVE-2026-88771 Crítica · CVSS 9.5 no catálogo em 27/09/2026

Citrix NetScaler Improper Input Validation Vulnerability

Citrix · NetScaler · CWE-119

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. EN

CVE-2026-65660 Alta · CVSS 8.8 no catálogo em 25/09/2026

Microsoft SharePoint Code Injection Vulnerability

Microsoft · SharePoint · CWE-94

Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. EN

CVE-2026-87902 Alta · CVSS 8.1 no catálogo em 25/09/2026

WordPress Core Remote File Inclusion Vulnerability

WordPress · Core · CWE-98

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. EN

CVE-2026-67279 Média · CVSS 6.9 no catálogo em 25/09/2026

Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

MikroTik · RouterOS · CWE-841

Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. EN

CVE-2026-5430 Crítica · CVSS 10.0 no catálogo em 24/09/2026

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 · Multiple Products · CWE-347

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. EN

CVE-2026-71362 Crítica · CVSS 9.1 no catálogo em 24/09/2026

Adobe Commerce and Magento Incorrect Authorization Vulnerability

Adobe · Commerce and Magento · CWE-863

Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. EN

CVE-2026-93616 Crítica · CVSS 9.8 no catálogo em 22/09/2026

Check Point Multiple Products Path Traversal Vulnerability

Check Point · Multiple Products · CWE-22

Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. EN