Insights de Segurança — Incidentes reais e lições 2024–2026

Incidentes e cases

• 2024–2026 em uma frase: identidade, terceiros e dados em movimento — Olhando o triênio, os maiores incidentes compartilham DNA: credenciais, fornecedores e exfiltração. Softwares, redes e cloud precisam de defesa em profundidade — de verdade. (2026)
• ADT: quando segurança física e cibernética colidem — Incidentes de 2026 envolvendo a ADT reforçam que provedores de segurança residencial concentram dados de lares, câmeras e rotinas — alvo sensível. (2026)
• Carnival: engenharia social e milhões de passageiros afetados — Em 2026, a Carnival reportou incidente via engenharia social com milhões de pessoas afetadas — lembrete de que o fator humano continua abrindo perímetros caros. (2026)
• Instructure (Canvas LMS): educação em escala e extorsão de dados — Em 2026, divulgações ligadas à Instructure/Canvas apontaram um dos maiores volumes de notificação do semestre — educação também é infraestrutura crítica de dados. (2026)
• IA generativa nas empresas: vazamento por prompt, sombra de SaaS e modelos — Entre 2025 e 2026, o risco deixou de ser só ‘alucinação’: dados sensíveis em prompts, copilots sem DLP e supply chain de modelos viraram incidentes reais de segurança. (2025)
• Prosper Marketplace: fintech e 13 milhões de pessoas notificadas — Notificações de 2025 ligadas à Prosper Marketplace ilustram o volume de PII em plataformas de crédito peer-to-peer e lending digital. (2025)
• TransUnion: vazamento em bureau de crédito e o valor do PII financeiro — Em 2025, notificações ligadas à TransUnion reforçaram o risco sistêmico de bureaus e processadores que concentram identidade financeira. (2025)
• Conduent: ransomware em govtech e o custo de dados de cidadãos — Detectado em janeiro de 2025 e ampliado nas divulgações de 2026, o incidente Conduent mostrou como govtech concentra dados sensíveis de milhões de cidadãos. (2025)
• Tesouro dos EUA e BeyondTrust: compromisso via software privilegiado — No início de 2025, divulgações ligaram atividade contra o Departamento do Tesouro dos EUA a comprometimento envolvendo software de acesso privilegiado (BeyondTrust). (2025)
• National Public Data: bilhões de registros e o mercado de dados pessoais — O vazamento ligado à National Public Data em 2024 reforçou um aviso: corretoras de dados e bases massivas são alvos de alto retorno para criminosos. (2024)
• CrowdStrike 19/07/2024: quando a ferramenta de segurança derruba o mundo — Uma atualização falha do Falcon causou BSOD em massa no Windows. Não foi ransomware — foi resiliência operacional e governança de mudanças em software de segurança. (2024)
• CDK Global: ransomware na cadeia automotiva e software de concessionárias — O ataque à CDK Global em junho de 2024 parou operações em milhares de dealers na América do Norte — outro lembrete de concentração de SaaS crítico. (2024)
• Synnovis / NHS Londres: ransomware em laboratório crítico — Em junho de 2024, ransomware na Synnovis (serviços de patologia) disruptou hospitais de Londres — sangue, testes e cirurgias afetados. (2024)
• Ecossistema Snowflake: Ticketmaster, AT&T e o risco de credenciais na nuvem — Em 2024, invasores exploraram contas Snowflake sem MFA e credenciais vazadas — atingindo marcas globais. Cloud sem higiene de identidade é porta aberta. (2024)
• Dell: portal de parceiros e 49 milhões de registros de clientes — Em 2024, a Dell reportou acesso não autorizado a um portal de parceiros com dados de clientes — demonstrando risco de superfícies B2B pouco visíveis. (2024)
• Ascension: ransomware paralisa rede hospitalar nos EUA — Em maio de 2024, a Ascension (uma das maiores redes de saúde dos EUA) sofreu ransomware que derrubou sistemas clínicos e administrativos por semanas. (2024)
• Change Healthcare: o maior ataque ransomware à saúde dos EUA — Em fevereiro de 2024, um ataque ransomware paralisou a maior plataforma de processamento de claims dos EUA — e expôs a fragilidade da cadeia de software e terceiros na saúde. (2024)
• MOVEit / Clop: a onda de supply chain que definiu 2023–2024 — A exploração do MOVEit Transfer pelo Clop gerou uma das maiores ondas de notificação em massa — e suas lições ecoaram em todo 2024. (2024)

Materiais para download

• Checklist Secure SDLC & DevSecOps — Lista acionável para times de engenharia e segurança: SAST, DAST, SCA, secrets, IAM de pipeline e gates de release.
• Guia rápido: hardening de cloud e rede — Práticas essenciais para AWS/Azure/GCP e redes corporativas, inspiradas nos incidentes Snowflake, ransomware e falhas de continuidade.
• Briefing: segurança no uso de IA generativa — Como adotar copilots e agentes sem transformar prompts em canal de vazamento. Alinhado aos riscos observados em 2025–2026.

Catálogo CVE · CISA KEV

Atualizado automaticamente a partir do Known Exploited Vulnerabilities Catalog. Última sync: 2026-08-06T01:24:46.757Z.

Destaques GSAFE

Vulnerabilidades exploradas (KEV)

1. CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability (JetBrains / TeamCity). JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. NVD
2. CVE-2026-9198 — IBM Langflow Code Injection Vulnerability (IBM / Langflow). Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. NVD
3. CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (Apache / Tomcat). Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. NVD
4. CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (N-able / N-central). N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass. NVD
5. CVE-2026-18577 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (N-able / N-central). N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556. NVD
6. CVE-2026-20316 — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability (Cisco / Secure Firewall Management Center (FMC)). Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. NVD
7. CVE-2026-16812 — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (Arista / VeloCloud Orchestrator). Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. NVD
8. CVE-2025-68686 — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (Fortinet / FortiOS). Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. NVD
9. CVE-2026-50522 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (Microsoft / SharePoint). Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. NVD
10. CVE-2026-16232 — Check Point SmartConsole Improper Authentication Vulnerability (Check Point / SmartConsole). Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. NVD
11. CVE-2021-27137 — DD-WRT Stack-Based Buffer Overflow Vulnerability (DD-WRT / DD-WRT). DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability. NVD
12. CVE-2026-0770 — Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability (Langflow / Langflow). Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. NVD
13. CVE-2026-63030 — WordPress Core Interpretation Conflict Vulnerability (WordPress / Core). WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. NVD
14. CVE-2026-60137 — WordPress Core SQL Injection Vulnerability (WordPress / Core). WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. NVD
15. CVE-2026-39808 — Fortinet FortiSandbox OS Command Injection Vulnerability (Fortinet / FortiSandbox). Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. NVD
16. CVE-2026-25089 — Fortinet FortiSandbox OS Command Injection Vulnerability (Fortinet / FortiSandbox). Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. NVD
17. CVE-2026-58644 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (Microsoft / SharePoint). Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. NVD
18. CVE-2023-4346 — KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability (KNX Association / KNX Protocol Connection Authorization Option 1). KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. NVD
19. CVE-2026-46817 — Oracle E-Business Suite Improper Privilege Management Vulnerability (Oracle / E-Business Suite). Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. NVD
20. CVE-2026-15410 — SonicWall SMA1000 Appliances Code Injection Vulnerability (SonicWall / SMA1000 Appliances). SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. NVD
21. CVE-2026-15409 — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (SonicWall / SMA1000 Appliances). SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. NVD
22. CVE-2026-56164 — Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability (Microsoft / SharePoint Server). Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. NVD
23. CVE-2026-56155 — Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability (Microsoft / Active Directory Federation Services). Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. NVD
24. CVE-2008-4128 — Cisco IOS Cross-Site Request Forgery Vulnerability (Cisco / IOS). Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NVD
25. CVE-2026-48939 — iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability (iCagenda / iCagenda). iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. NVD
26. CVE-2026-56291 — Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability (Balbooa / Forms). Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE. NVD
27. CVE-2026-48282 — Adobe ColdFusion Path Traversal Vulnerability (Adobe / ColdFusion). Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. NVD
28. CVE-2026-56290 — Joomlack Page Builder Improper Access Control Vulnerability (Joomlack / Page Builder). Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. NVD
29. CVE-2026-55255 — Langflow Authorization Bypass Through User-Controlled Key Vulnerability (Langflow / Langflow). Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. NVD
30. CVE-2026-48908 — JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability (JoomShaper / SP Page Builder). JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. NVD
31. CVE-2026-45659 — Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability (Microsoft / SharePoint Server). Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. NVD
32. CVE-2026-48558 — SimpleHelp Authentication Bypass Vulnerability (SimpleHelp / SimpleHelp). SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. NVD
33. CVE-2026-20230 — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (Cisco / Unified Communications Manager). Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. NVD
34. CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation Vulnerability (PTC / Windchill and FlexPLM). PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network. NVD
35. CVE-2026-34908 — Ubiquiti UniFi OS Improper Access Control Vulnerability (Ubiquiti / UniFi OS). Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system. NVD
36. CVE-2026-34909 — Ubiquiti UniFi OS Path Traversal Vulnerability (Ubiquiti / UniFi OS). Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account. NVD
37. CVE-2026-34910 — Ubiquiti UniFi OS Improper Input Validation Vulnerability (Ubiquiti / UniFi OS). Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection. NVD
38. CVE-2025-67038 — Lantronix EDS5000 Code Injection Vulnerability (Lantronix / EDS5000). Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. NVD
39. CVE-2026-20253 — Splunk Enterprise Missing Authentication for Critical Function Vulnerability (Splunk / Enterprise). Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. NVD
40. CVE-2026-48907 — Widget Factory Joomla Content Editor Improper Access Control Vulnerability (Widget Factory / Joomla Content Editor ). Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. NVD
41. CVE-2026-20262 — Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability (Cisco / Catalyst SD-WAN Manager). Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. NVD
42. CVE-2026-54420 — LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability (LiteSpeed / cPanel Plugin). LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS. NVD
43. CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability (Oracle / PeopleSoft Enterprise PeopleTools). Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. NVD
44. CVE-2026-10520 — Ivanti Sentry OS Command Injection Vulnerability (Ivanti / Sentry). Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. NVD
45. CVE-2026-20245 — Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability (Cisco / Catalyst SD-WAN Manager). Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. NVD
46. CVE-2026-7473 — Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability (Arista / Extensible Operating System). Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. NVD
47. CVE-2026-11645 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (Google / Chromium V8). Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. NVD
48. CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability (Check Point / Security Gateway). Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. NVD
49. CVE-2026-42271 — BerriAI LiteLLM Command Injection Vulnerability (BerriAI / LiteLLM). BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. NVD
50. CVE-2026-28318 — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability (SolarWinds / Serv-U). SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. NVD
51. CVE-2026-45247 — Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability (Mirasvit / Mirasvit Full Page Cache Warmer). Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. NVD
52. CVE-2025-48595 — Android Framework Integer Overflow Vulnerability (Android / Framework). Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. NVD
53. CVE-2022-0492 — Linux Kernel Improper Authentication Vulnerability (Linux / Kernel). Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature. NVD
54. CVE-2024-21182 — Oracle WebLogic Server Unspecified Vulnerability (Oracle / WebLogic Server). Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. NVD
55. CVE-2026-0257 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (Palo Alto Networks / PAN-OS). Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. NVD
56. CVE-2026-8398 — Daemon Tools Lite Embedded Malicious Code Vulnerability (Daemon / Daemon Tools Lite). Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability. NVD
57. CVE-2026-45321 — TanStack Unspecified Vulnerability (TanStack / TanStack). TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. NVD
58. CVE-2026-48027 — Nx Console Embedded Malicious Code Vulnerability (Nx / Nx Console). Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. NVD
59. CVE-2026-48172 — LiteSpeed cPanel Plugin Privilege Escalation Vulnerability (LiteSpeed / cPanel Plugin). LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges. NVD
60. CVE-2026-9082 — Drupal Core SQL Injection Vulnerability (Drupal / Core). Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. NVD
61. CVE-2026-34926 — Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability (Trend Micro / Apex One). Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. NVD
62. CVE-2025-34291 — Langflow Origin Validation Error Vulnerability (Langflow / Langflow). Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. NVD
63. CVE-2026-45498 — Microsoft Defender Denial of Service Vulnerability (Microsoft / Defender). Microsoft Defender contains an unspecified vulnerability that allows for denial of service. NVD
64. CVE-2026-41091 — Microsoft Defender Link Following Vulnerability (Microsoft / Defender). Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. NVD
65. CVE-2010-0806 — Microsoft Internet Explorer Use-After-Free Vulnerability (Microsoft / Internet Explorer). Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. NVD
66. CVE-2010-0249 — Microsoft Internet Explorer Use-After-Free Vulnerability (Microsoft / Internet Explorer). Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. NVD
67. CVE-2009-3459 — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability (Adobe / Acrobat and Reader). Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption. NVD
68. CVE-2009-1537 — Microsoft DirectX NULL Byte Overwrite Vulnerability (Microsoft / DirectX). Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. NVD
69. CVE-2008-4250 — Microsoft Windows Buffer Overflow Vulnerability (Microsoft / Windows). Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. NVD
70. CVE-2026-42897 — Microsoft Exchange Server Cross-Site Scripting Vulnerability (Microsoft / Microsoft). Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. NVD
71. CVE-2026-20182 — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (Cisco / Catalyst SD-WAN). Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. NVD
72. CVE-2026-42208 — BerriAI LiteLLM SQL Injection Vulnerability (BerriAI / LiteLLM). BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. NVD
73. CVE-2026-6973 — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability (Ivanti / Endpoint Manager Mobile (EPMM)). Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. NVD
74. CVE-2026-0300 — Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability (Palo Alto Networks / PAN-OS). Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. NVD
75. CVE-2026-31431 — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability (Linux / Kernel). Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation. NVD
76. CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability (WebPros / cPanel & WHM and WP2 (WordPress Squared)). WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. NVD
77. CVE-2026-32202 — Microsoft Windows Protection Mechanism Failure Vulnerability (Microsoft / Windows). Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. NVD
78. CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal Vulnerability (ConnectWise / ScreenConnect). ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems. NVD
79. CVE-2024-57726 — SimpleHelp Missing Authorization Vulnerability (SimpleHelp / SimpleHelp). SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. NVD
80. CVE-2024-57728 — SimpleHelp Path Traversal Vulnerability (SimpleHelp / SimpleHelp). SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. NVD

Catálogo de exploits · referência

Metadados públicos de exploração ativa (KEV + EPSS). A GSAFE não publica PoCs nem payloads.

1. CVE-2026-48282 — Adobe ColdFusion Path Traversal Vulnerability · EPSS 0.992 · Adobe / ColdFusion · Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
2. CVE-2026-63030 — WordPress Core Interpretation Conflict Vulnerability · EPSS 0.984 · WordPress / Core · WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
3. CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability · EPSS 0.979 · WebPros / cPanel & WHM and WP2 (WordPress Squared) · WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
4. CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability · EPSS 0.955 · Oracle / PeopleSoft Enterprise PeopleTools · Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
5. CVE-2026-0257 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability · EPSS 0.939 · Palo Alto Networks / PAN-OS · Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
6. CVE-2026-39808 — Fortinet FortiSandbox OS Command Injection Vulnerability · EPSS 0.897 · Fortinet / FortiSandbox · Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
7. CVE-2026-48908 — JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability · EPSS 0.881 · JoomShaper / SP Page Builder · JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
8. CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal Vulnerability · EPSS 0.876 · ConnectWise / ScreenConnect · ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
9. CVE-2026-56290 — Joomlack Page Builder Improper Access Control Vulnerability · EPSS 0.833 · Joomlack / Page Builder · Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
10. CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability · EPSS 0.826 · Check Point / Security Gateway · Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
11. CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · EPSS 0.812 · Apache / Tomcat · Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.
12. CVE-2026-60137 — WordPress Core SQL Injection Vulnerability · EPSS 0.790 · WordPress / Core · WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
13. CVE-2026-15409 — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability · EPSS 0.784 · SonicWall / SMA1000 Appliances · SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
14. CVE-2026-15410 — SonicWall SMA1000 Appliances Code Injection Vulnerability · EPSS 0.763 · SonicWall / SMA1000 Appliances · SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
15. CVE-2026-56291 — Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability · EPSS 0.761 · Balbooa / Forms · Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.
16. CVE-2026-50522 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability · EPSS 0.758 · Microsoft / SharePoint · Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
17. CVE-2026-16232 — Check Point SmartConsole Improper Authentication Vulnerability · EPSS 0.714 · Check Point / SmartConsole · Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
18. CVE-2026-25089 — Fortinet FortiSandbox OS Command Injection Vulnerability · EPSS 0.698 · Fortinet / FortiSandbox · Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
19. CVE-2026-0770 — Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability · EPSS 0.563 · Langflow / Langflow · Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
20. CVE-2008-4128 — Cisco IOS Cross-Site Request Forgery Vulnerability · EPSS 0.330 · Cisco / IOS · Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.
21. CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation Vulnerability · EPSS 0.302 · PTC / Windchill and FlexPLM · PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
22. CVE-2026-55255 — Langflow Authorization Bypass Through User-Controlled Key Vulnerability · EPSS 0.291 · Langflow / Langflow · Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
23. CVE-2026-48939 — iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability · EPSS 0.243 · iCagenda / iCagenda · iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
24. CVE-2026-56164 — Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability · EPSS 0.224 · Microsoft / SharePoint Server · Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
25. CVE-2026-9198 — IBM Langflow Code Injection Vulnerability · EPSS 0.171 · IBM / Langflow · Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
26. CVE-2021-27137 — DD-WRT Stack-Based Buffer Overflow Vulnerability · EPSS 0.165 · DD-WRT / DD-WRT · DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
27. CVE-2026-46817 — Oracle E-Business Suite Improper Privilege Management Vulnerability · EPSS 0.133 · Oracle / E-Business Suite · Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
28. CVE-2024-57726 — SimpleHelp Missing Authorization Vulnerability · EPSS 0.086 · SimpleHelp / SimpleHelp · SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
29. CVE-2024-57728 — SimpleHelp Path Traversal Vulnerability · EPSS 0.070 · SimpleHelp / SimpleHelp · SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
30. CVE-2026-58644 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability · EPSS 0.060 · Microsoft / SharePoint · Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
31. CVE-2026-18577 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · EPSS 0.041 · N-able / N-central · N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.
32. CVE-2026-45321 — TanStack Unspecified Vulnerability · EPSS 0.023 · TanStack / TanStack · TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
33. CVE-2026-56155 — Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability · EPSS 0.023 · Microsoft / Active Directory Federation Services · Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
34. CVE-2026-48027 — Nx Console Embedded Malicious Code Vulnerability · EPSS 0.018 · Nx / Nx Console · Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
35. CVE-2025-68686 — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability · EPSS 0.013 · Fortinet / FortiOS · Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
36. CVE-2023-4346 — KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability · EPSS 0.009 · KNX Association / KNX Protocol Connection Authorization Option 1 · KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.
37. CVE-2026-16812 — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability · EPSS 0.009 · Arista / VeloCloud Orchestrator · Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
38. CVE-2026-20316 — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability · EPSS 0.008 · Cisco / Secure Firewall Management Center (FMC) · Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
39. CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability · EPSS 0.006 · JetBrains / TeamCity · JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
40. CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · EPSS 0.005 · N-able / N-central · N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

Feed de notícias de segurança

• CISA Adds One Known Exploited Vulnerability to Catalog (CISA Advisories)
• Thermo Fisher Applied Biosystems Genetic Analyzers (CISA Advisories)
• Acrisure KARR BT and DR-100 (CISA Advisories)
• CISA Adds Three Known Exploited Vulnerabilities to Catalog (CISA Advisories)
• CISA Adds One Known Exploited Vulnerability to Catalog (CISA Advisories)
• MZ Automation GmbH libiec61850 (CISA Advisories)
• Mitsubishi Electric CC-Link IE TSN Communication Protocol (CISA Advisories)
• Schneider Electric IGSS (CISA Advisories)
• MikroTik RouterOS (CISA Advisories)
• Toptech Systems RCU II+ and Multiload II+ (CISA Advisories)
• Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures (The Hacker News)
• OpenAI Disrupts Poipet Scam Network Using ChatGPT Across Multiple Fraud Schemes (The Hacker News)
• Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt (The Hacker News)
• Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports (The Hacker News)
• Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug (The Hacker News)
• Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain (The Hacker News)
• New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch (The Hacker News)
• Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk (The Hacker News)
• Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup (The Hacker News)
• Leaked n8n API Tokens Exposed Live Instances to Credential Theft (The Hacker News)