{"results":{"items":[{"id":"CVE-2026-88779","title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","vendorName":"Citrix","productName":"NetScaler","vendorSlug":"citrix","productSlug":"citrix-netscaler","cvssScore":8.7,"knownRansomwareUse":false,"dateAdded":"2026-10-04","dueDate":"2026-10-07","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"citrix-netscaler-improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer"},{"id":"CVE-2026-102489","title":"Zammad GmbH Zammad Session Fixation Vulnerability","vendorName":"Zammad GmbH","productName":"Zammad","vendorSlug":"zammad-gmbh","productSlug":"zammad-gmbh-zammad","cvssScore":9.4,"knownRansomwareUse":false,"dateAdded":"2026-10-02","dueDate":"2026-10-05","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"zammad-gmbh-zammad-improper-privilege-management-vulnerability-cve-2026-102490-is-being"},{"id":"CVE-2026-102490","title":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","vendorName":"Zammad GmbH","productName":"Zammad","vendorSlug":"zammad-gmbh","productSlug":"zammad-gmbh-zammad","cvssScore":9.4,"knownRansomwareUse":false,"dateAdded":"2026-10-02","dueDate":"2026-10-05","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"zammad-gmbh-zammad-improper-privilege-management-vulnerability-cve-2026-102490-is-being"},{"id":"CVE-2026-104286","title":"Fortinet FortiMail Path Traversal Vulnerability","vendorName":"Fortinet","productName":"FortiMail","vendorSlug":"fortinet","productSlug":"fortinet-fortimail","cvssScore":null,"knownRansomwareUse":false,"dateAdded":"2026-10-01","dueDate":"2026-10-04","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"fortinet-fortimail-path-traversal-vulnerability-cve-2026-104286-is-being-actively"},{"id":"CVE-2026-76504","title":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","vendorName":"Cisco","productName":"Catalyst SD-WAN Manager","vendorSlug":"cisco","productSlug":"cisco-catalyst-sd-wan-manager","cvssScore":9.8,"knownRansomwareUse":false,"dateAdded":"2026-09-30","dueDate":"2026-10-03","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks"},{"id":"CVE-2026-86950","title":"Apple Multiple Products Out-of-Bounds Write Vulnerability","vendorName":"Apple","productName":"Multiple Products","vendorSlug":"apple","productSlug":"apple-multiple-products","cvssScore":8.8,"knownRansomwareUse":false,"dateAdded":"2026-09-29","dueDate":"2026-10-02","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"apple-multiple-products-out-of-bounds-write-vulnerability-cve-2026-86950-is-being"},{"id":"CVE-2026-88771","title":"Citrix NetScaler Improper Input Validation Vulnerability","vendorName":"Citrix","productName":"NetScaler","vendorSlug":"citrix","productSlug":"citrix-netscaler","cvssScore":9.5,"knownRansomwareUse":false,"dateAdded":"2026-09-27","dueDate":"2026-09-30","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"cisa-adds-two-known-exploited-vulnerabilities-to-catalog-2"},{"id":"CVE-2026-88772","title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","vendorName":"Citrix","productName":"NetScaler","vendorSlug":"citrix","productSlug":"citrix-netscaler","cvssScore":9.5,"knownRansomwareUse":false,"dateAdded":"2026-09-27","dueDate":"2026-09-30","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"cisa-adds-two-known-exploited-vulnerabilities-to-catalog-2"},{"id":"CVE-2026-65660","title":"Microsoft SharePoint Code Injection Vulnerability","vendorName":"Microsoft","productName":"SharePoint","vendorSlug":"microsoft","productSlug":"sharepoint","cvssScore":8.8,"knownRansomwareUse":false,"dateAdded":"2026-09-25","dueDate":"2026-09-28","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"cisa-adds-two-known-exploited-vulnerabilities-to-catalog"},{"id":"CVE-2026-87902","title":"WordPress Core Remote File Inclusion Vulnerability","vendorName":"WordPress","productName":"Core","vendorSlug":"wordpress","productSlug":"wordpress-core","cvssScore":8.1,"knownRansomwareUse":false,"dateAdded":"2026-09-25","dueDate":"2026-09-28","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"cisa-adds-one-known-exploited-vulnerability-to-catalog-2"},{"id":"CVE-2026-67279","title":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","vendorName":"MikroTik","productName":"RouterOS","vendorSlug":"mikrotik","productSlug":"mikrotik-routeros","cvssScore":6.9,"knownRansomwareUse":false,"dateAdded":"2026-09-25","dueDate":"2026-09-28","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"cisa-adds-two-known-exploited-vulnerabilities-to-catalog"},{"id":"CVE-2026-5430","title":"WSO2 Multiple Products Path Traversal Vulnerability ","vendorName":"WSO2","productName":"Multiple Products","vendorSlug":"wso2","productSlug":"wso2-multiple-products","cvssScore":10,"knownRansomwareUse":false,"dateAdded":"2026-09-24","dueDate":"2026-09-27","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"wso2-multiple-products-path-traversal-vulnerability-cve-2026-5430-is-being-actively"},{"id":"CVE-2026-71362","title":"Adobe Commerce and Magento Incorrect Authorization Vulnerability ","vendorName":"Adobe","productName":"Commerce and Magento ","vendorSlug":"adobe","productSlug":"adobe-commerce-and-magento","cvssScore":9.1,"knownRansomwareUse":false,"dateAdded":"2026-09-24","dueDate":"2026-09-27","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"adobe-commerce-and-magento-incorrect-authorization-vulnerability-cve-2026-71362-is-being"},{"id":"CVE-2026-85102","title":"Check Point Multiple Products Improper Certificate Validation Vulnerability","vendorName":"Check Point","productName":"Multiple Products","vendorSlug":"check-point","productSlug":"check-point-multiple-products","cvssScore":9.8,"knownRansomwareUse":false,"dateAdded":"2026-09-22","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"check-point-multiple-products-improper-certificate-validation-vulnerability-cve-2026"},{"id":"CVE-2026-93616","title":"Check Point Multiple Products Path Traversal Vulnerability","vendorName":"Check Point","productName":"Multiple Products","vendorSlug":"check-point","productSlug":"check-point-multiple-products","cvssScore":9.8,"knownRansomwareUse":false,"dateAdded":"2026-09-22","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"wso2-multiple-products-path-traversal-vulnerability-cve-2026-5430-is-being-actively"},{"id":"CVE-2026-93952","title":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","vendorName":"Arista","productName":"VeloCloud Orchestrator","vendorSlug":"arista","productSlug":"arista-velocloud-orchestrator","cvssScore":9.5,"knownRansomwareUse":false,"dateAdded":"2026-09-22","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"arista-velocloud-orchestrator-improper-input-validation-vulnerability-cve-2026-93952-is"},{"id":"CVE-2026-94127","title":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","vendorName":"F5","productName":"BIG-IP APM","vendorSlug":"f5","productSlug":"f5-big-ip-apm","cvssScore":9.3,"knownRansomwareUse":false,"dateAdded":"2026-09-22","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"f5-big-ip-apm-heap-based-buffer-overflow-vulnerability-cve-2026-94127-is-being-actively"},{"id":"CVE-2026-7273","title":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","vendorName":"Zyxel","productName":"GS1900 Series Switches","vendorSlug":"zyxel","productSlug":"zyxel-gs1900-series-switches","cvssScore":8.8,"knownRansomwareUse":false,"dateAdded":"2026-09-21","dueDate":"2026-09-24","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"cisa-adds-one-known-exploited-vulnerability-to-catalog"},{"id":"CVE-2025-39682","title":"Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability","vendorName":"Linux","productName":"Kernel","vendorSlug":"linux","productSlug":"linux-kernel","cvssScore":9.8,"knownRansomwareUse":false,"dateAdded":"2026-09-18","dueDate":"2026-09-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"linux-kernel-improper-check-for-unusual-or-exceptional-conditions-vulnerability-cve-2025"},{"id":"CVE-2026-53266","title":"Linux Kernel Out-of-Bounds Write Vulnerability","vendorName":"Linux","productName":"Kernel","vendorSlug":"linux","productSlug":"linux-kernel","cvssScore":8.8,"knownRansomwareUse":false,"dateAdded":"2026-09-18","dueDate":"2026-09-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"linux-kernel-out-of-bounds-write-vulnerability-cve-2026-53266-is-being-actively-exploited"},{"id":"CVE-2025-39964","title":"Linux Kernel Race Condition Vulnerability","vendorName":"Linux","productName":"Kernel","vendorSlug":"linux","productSlug":"linux-kernel","cvssScore":5.5,"knownRansomwareUse":false,"dateAdded":"2026-09-18","dueDate":"2026-09-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"linux-kernel-race-condition-vulnerability-cve-2025-39964-is-being-actively-exploited-cisa"},{"id":"CVE-2026-76460","title":"Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","vendorName":"Cisco","productName":"Identity Services Engine","vendorSlug":"cisco","productSlug":"cisco-identity-services-engine","cvssScore":10,"knownRansomwareUse":false,"dateAdded":"2026-09-16","dueDate":"2026-09-19","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"cisco-identity-services-engine-incorrect-use-of-privileged-apis-vulnerability-cve-2026"},{"id":"CVE-2026-58704","title":"Google Pixel Improper Authorization Vulnerability","vendorName":"Google","productName":"Pixel","vendorSlug":"google","productSlug":"google-pixel","cvssScore":8.8,"knownRansomwareUse":false,"dateAdded":"2026-09-16","dueDate":"2026-09-19","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"google-pixel-improper-authorization-vulnerability-cve-2026-58704-is-being-actively"},{"id":"CVE-2026-87886","title":"Acronis Backup Incorrect Default Permissions Vulnerability","vendorName":"Acronis","productName":"Backup","vendorSlug":"acronis","productSlug":"acronis-backup","cvssScore":7.8,"knownRansomwareUse":false,"dateAdded":"2026-09-16","dueDate":"2026-09-19","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"acronis-backup-incorrect-default-permissions-vulnerability-cve-2026-87886-is-being"},{"id":"CVE-2026-76461","title":"Cisco Secure Email Gateway SQL Injection Vulnerability","vendorName":"Cisco","productName":"Secure Email Gateway","vendorSlug":"cisco","productSlug":"cisco-secure-email-gateway","cvssScore":9.8,"knownRansomwareUse":false,"dateAdded":"2026-09-14","dueDate":"2026-09-17","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":null},{"id":"CVE-2026-85706","title":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","vendorName":"GitLab","productName":"Community Edition and Enterprise Edition","vendorSlug":"gitlab","productSlug":"gitlab-community-edition-and-enterprise-edition","cvssScore":10,"knownRansomwareUse":false,"dateAdded":"2026-09-11","dueDate":"2026-09-14","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":null},{"id":"CVE-2026-84869","title":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","vendorName":"ConnectWise","productName":"ScreenConnect","vendorSlug":"connectwise","productSlug":"connectwise-screenconnect","cvssScore":9.9,"knownRansomwareUse":false,"dateAdded":"2026-09-11","dueDate":"2026-09-14","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":null},{"id":"CVE-2026-42016","title":"JFrog Artifactory Incorrect Authorization Vulnerability","vendorName":"JFrog","productName":"Artifactory","vendorSlug":"jfrog","productSlug":"jfrog-artifactory","cvssScore":8.8,"knownRansomwareUse":false,"dateAdded":"2026-09-11","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":null},{"id":"CVE-2026-42018","title":"JFrog Artifactory Improper Authentication Vulnerability","vendorName":"JFrog","productName":"Artifactory","vendorSlug":"jfrog","productSlug":"jfrog-artifactory","cvssScore":7.5,"knownRansomwareUse":false,"dateAdded":"2026-09-11","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":null},{"id":"CVE-2026-86060","title":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","vendorName":"MikroTik","productName":"RouterOS","vendorSlug":"mikrotik","productSlug":"mikrotik-routeros","cvssScore":9.2,"knownRansomwareUse":false,"dateAdded":"2026-09-10","dueDate":"2026-09-13","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","storySlug":"mikrotik-routeros-improper-enforcement-of-behavioral-workflow-vulnerability-cve-2026"}],"page":1,"pageSize":30,"total":1734},"topVendors":[{"slug":"microsoft","name":"Microsoft","count":389},{"slug":"cisco","name":"Cisco","count":100},{"slug":"apple","name":"Apple","count":95},{"slug":"adobe","name":"Adobe","count":82},{"slug":"google","name":"Google","count":75},{"slug":"oracle","name":"Oracle","count":46},{"slug":"apache","name":"Apache Software Foundation","count":40},{"slug":"ivanti","name":"Ivanti","count":35},{"slug":"fortinet","name":"Fortinet","count":31},{"slug":"broadcom-vmware","name":"VMware (Broadcom)","count":31},{"slug":"linux","name":"Linux","count":31},{"slug":"citrix","name":"Citrix (Cloud Software Group)","count":27},{"slug":"d-link","name":"D-Link","count":26},{"slug":"synacor","name":"Synacor","count":19},{"slug":"sonicwall","name":"SonicWall","count":19}],"totalKev":1734,"addedLast30Days":39,"ransomwareCount":361}