/
attack_type:vulnerability_exploitation × criticity:critical × limpar

Resultados

22 casos · pág. 2/2

cert.ssi.gouv.fr · · 5 fontes · 5 atualizações critical

Ivanti patches exploited Connect Secure zero-day CVE-2026-104935 (UTA0576); CISA adds it to KEV; six Xtraction and Intune flaws fixed

Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…

CVE-2026-104935 CVE-2026-109412 CVE-2026-106042 UTA0576 government
tenable.com · · 28 fontes · 42 atualizações critical

PHP2Shell: critical PHP RCE flaws CVE-2026-109618/109619 patched; broad exploitation attempts, European sites offline

The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…

CVE-2026-109618 CVE-2026-109619 government transportation