Vulnerabilità sfruttate attivamente
15 nuove falle sfruttate questa settimana
Il catalogo KEV della CISA elenca le vulnerabilità che vengono sfruttate in attacchi reali, non quelle che potrebbero esserlo. È la lista da cui partire quando devi decidere cosa correggere per primo.
Questa settimana
- CVE-2026-76461Critica9.8
Cisco · Secure Email Gateway
Cisco Secure Email Gateway SQL Injection Vulnerability
- CVE-2026-85706Critica10.0
GitLab · Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- CVE-2026-84869Critica9.9
ConnectWise · ScreenConnect
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- CVE-2026-42018Alta7.5
JFrog · Artifactory
JFrog Artifactory Improper Authentication Vulnerability
- CVE-2026-42016Alta8.1
JFrog · Artifactory
JFrog Artifactory Incorrect Authorization Vulnerability
- CVE-2026-86060Critica9.8
MikroTik · RouterOS
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
- CVE-2026-67277Alta8.2
MikroTik · RouterOS
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
- CVE-2026-87491Alta8.8
Google · Chromium V8
Google Chromium V8 Out of Bounds Write Vulnerability
- CVE-2026-20079Critica10.0
Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-19490Critica9.8
Citrix · NetScaler
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2025-25249Alta8.1
Fortinet · Multiple Products
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
- CVE-2026-86218Critica9.8
N-able · N-central
N-able N-central Static Code Injection Vulnerability
- CVE-2026-85880Alta7.8
Microsoft · Windows
Microsoft Windows Heap-Based Buffer Overflow Vulnerability
- CVE-2026-81963Alta7.8
Microsoft · Windows
Microsoft Windows Link Following Vulnerability
- CVE-2026-75650Critica10.0
Adobe · Commerce and Magento
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Aggiunte in precedenza
- CVE-2026-85046Alta8.8
Google · Chromium V8
Google Chromium V8 Type Confusion Vulnerability
- CVE-2026-9586Critica9.8
Sangoma · Switchvox
Sangoma Switchvox SQL Injection Vulnerability
- CVE-2026-83549Alta7.8
SonicWall · SMA1000 Appliances
SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- CVE-2026-83548Critica10.0
SonicWall · SMA1000 Appliances
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- CVE-2026-82329Critica9.8
JFrog · Artifactory
JFrog Artifactory Improper Authentication Vulnerability
- CVE-2026-59822Alta8.2
BerriAI · LiteLLM
BerriAI LiteLLM Improper Authentication Vulnerability
56 giorni dopo le prime prove di sfruttamento
- CVE-2026-49869Critica10.0
Kestra · Kestra OSS
Kestra OSS OS Command Injection Vulnerability
7 giorni dopo le prime prove di sfruttamento
- CVE-2026-48710Media6.5
Kludex · Starlette
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
99 giorni dopo le prime prove di sfruttamento
- CVE-2026-82078Critica9.1
PaperCut · NG/MF
PaperCut NG/MF Unsafe Reflection Vulnerability
- CVE-2026-81578Critica9.8
PaperCut · NG/MF
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
- CVE-2026-66384Media5.3
JFrog · Artifactory
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- CVE-2026-53362Alta7.8
Linux · Kernel
Linux Kernel Unspecified Vulnerability
- CVE-2023-49105Critica9.8
ownCloud · ownCloud
ownCloud Improper Authentication Vulnerability
- CVE-2026-8452Critica9.8
Citrix · NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
9 giorni dopo le prime prove di sfruttamento
- CVE-2022-0995Alta7.8
Linux · Kernel
Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2021-23758Alta8.1
Ajax.NET Professional · Ajax.NET Professional
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
- CVE-2019-1068Alta8.8
Microsoft · SQL Server
Microsoft SQL Server Remote Code Execution Vulnerability
721 giorni dopo le prime prove di sfruttamento
- CVE-2015-5287Alta7.8
Red Hat · Automatic Bug Reporting Tool
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
- CVE-2015-3246Media5.1
Red Hat · Libuser
Red Hat Libuser Race Condition Vulnerability
- CVE-2026-60004Critica9.8
Gitea · Gitea
Gitea Code Injection Vulnerability
- CVE-2026-21962Critica10.0
Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
195 giorni dopo le prime prove di sfruttamento
- CVE-2026-73570Alta8.9
Synacor · Zimbra Collaboration Suite (ZCS)
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- CVE-2026-72530Critica9.0
TrueConf · Server
TrueConf Server Code Injection Vulnerability
8 giorni dopo le prime prove di sfruttamento
- CVE-2026-72529Critica9.8
TrueConf · Server
TrueConf Server Missing Authentication for Critical Function Vulnerability
8 giorni dopo le prime prove di sfruttamento
- CVE-2026-64849Critica9.3
MLflow · MLflow
MLflow Server-Side Request Forgery Vulnerability
- CVE-2026-65400Critica9.8
Apple · macOS
Apple macOS Improper Authentication Vulnerability
11 giorni dopo le prime prove di sfruttamento
Broadcom · VMware vCenter
Broadcom VMware vCenter Path Traversal Vulnerability
8 giorni dopo le prime prove di sfruttamento
- CVE-2026-55040Critica9.1
Microsoft · SharePoint
Microsoft SharePoint Weak Authentication Vulnerability
- CVE-2026-33824Critica9.8
Microsoft · Internet Key Exchange (IKE) Service Extensions
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
19 giorni dopo le prime prove di sfruttamento
- CVE-2025-62593Alta8.8
Ray-Project · Ray
Ray-Project Ray Code Injection Vulnerability
159 giorni dopo le prime prove di sfruttamento
- CVE-2026-72898Critica10.0
Metabase · Metabase
Metabase SQL Injection Vulnerability
- CVE-2026-68820Alta7.0
Microsoft · Windows Ancillary Function Driver for WinSock
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- CVE-2026-20349Alta8.6
Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
- CVE-2026-8037Critica9.6
Progress · LoadMaster
Progress LoadMaster Command Injection Vulnerability
37 giorni dopo le prime prove di sfruttamento
- CVE-2026-63077Critica9.8
JetBrains · TeamCity
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
- CVE-2026-9198Critica9.8
IBM · Langflow
IBM Langflow Code Injection Vulnerability
- CVE-2026-34486Alta7.5
Apache · Tomcat
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-18556Alta7.4
N-able · N-central
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-18577Alta8.1
N-able · N-central
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco · Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
- CVE-2026-16812Critica10.0
Arista · VeloCloud Orchestrator
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
- CVE-2025-68686Media5.9
Fortinet · FortiOS
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- CVE-2026-50522Critica9.8
Microsoft · SharePoint
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- CVE-2026-16232Critica9.8
Check Point · SmartConsole
Check Point SmartConsole Improper Authentication Vulnerability
- CVE-2026-63030Critica9.8
WordPress · Core
WordPress Core Interpretation Conflict Vulnerability
Che cos’è il catalogo KEV
Dati dal catalogo Known Exploited Vulnerabilities della CISA, opera del governo statunitense in pubblico dominio. Le scadenze indicate vincolano le agenzie federali USA (BOD 22-01); per tutti gli altri sono un ottimo riferimento di priorità.