Vulnerabilidades (CVE) que estão sendo exploradas ativamente, segundo o catálogo KEV da CISA, com severidade CVSS e probabilidade de exploração (EPSS).
34exploradas nos últimos 30 dias
13críticas (CVSS ≥ 9)
0usadas em ransomware
1768no catálogo KEV
CVE-2026-97229Crítica · CVSS 10.0no catálogo em 29/10/2026
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab · Community Edition and Enterprise Edition · CWE-190
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. EN
CVE-2026-48356Crítica · CVSS 9.3no catálogo em 27/10/2026
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe · Commerce and Magento · CWE-434
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. EN
Google Brotli Unchecked Return Value Vulnerability
Google · Brotli · CWE-252, CWE-787
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. EN
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. EN
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora · Collabora Online – Built-in CODE Server · CWE-78
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. EN
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust · Remote Support · CWE-290
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. EN
CVE-2026-21589Crítica · CVSS 9.3no catálogo em 15/10/2026
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian · Multiple Products · CWE-552
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. EN
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. EN
CVE-2026-76519Crítica · CVSS 9.8no catálogo em 14/10/2026
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. EN
CVE-2015-3306Crítica · CVSS 10.0no catálogo em 08/10/2026
ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPD · CWE-284
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. EN
CVE-2021-3199Crítica · CVSS 9.8no catálogo em 08/10/2026
ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE · Docs · CWE-22
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. EN
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. EN
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. EN
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. EN
CVE-2026-76504Crítica · CVSS 9.8no catálogo em 30/09/2026
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. EN
CVE-2026-88772Crítica · CVSS 9.5no catálogo em 27/09/2026
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScaler · CWE-119
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service EN
CVE-2026-88771Crítica · CVSS 9.5no catálogo em 27/09/2026
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. EN
CVE-2026-5430Crítica · CVSS 10.0no catálogo em 24/09/2026
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. EN
CVE-2026-71362Crítica · CVSS 9.1no catálogo em 24/09/2026
Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe · Commerce and Magento · CWE-863
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. EN
CVE-2026-93616Crítica · CVSS 9.8no catálogo em 22/09/2026
Check Point Multiple Products Path Traversal Vulnerability
Check Point · Multiple Products · CWE-22
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. EN
CVE-2026-85102Crítica · CVSS 9.8no catálogo em 22/09/2026
Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point · Multiple Products · CWE-295
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. EN
CVE-2026-93952Crítica · CVSS 9.5no catálogo em 22/09/2026
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. EN
Quer saber se o seu ambiente está exposto?
Avaliamos versões, acessos e integrações do seu ERP e priorizamos as correções.
O Bit é uma IA e pode errar. Não compartilhe senhas ou dados pessoais. As conversas não são armazenadas. Saiba mais
Sua privacidade importa
Usamos cookies essenciais para o site funcionar e, com sua permissão, cookies do Google para medir audiência e exibir anúncios — inclusive personalizados — que mantêm as ferramentas gratuitas. Você pode mudar sua escolha a qualquer momento em “Preferências de cookies”, no rodapé. Saiba mais.
