--- title: "CISA Known Exploited Vulnerabilities (KEV) catalog | CubePath" description: "The CISA Known Exploited Vulnerabilities catalog: CVEs with evidence of exploitation in the wild, newest first, with the date added and the federal due date." language: en source: https://cubepath.com/security/cve/kev --- # CISA Known Exploited Vulnerabilities (KEV) catalog | CubePath | CVE | Vulnerability | Added | Federal due date | Ransomware | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | ---------------- | ---------- | | [CVE-2026-102895](https://cubepath.com/security/cve/CVE-2026-102895) | GPUStack Improper Authentication Vulnerability GPUStack / GPUStack | Nov 9, 2026 | Nov 12, 2026 | | | [CVE-2026-116779](https://cubepath.com/security/cve/CVE-2026-116779) | SignalWire FreeSwitch Code Injection Vulnerability SignalWire / FreeSwitch | Nov 9, 2026 | Nov 12, 2026 | | | [CVE-2026-123158](https://cubepath.com/security/cve/CVE-2026-123158) | OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability OpenBSD / OpenSSH | Nov 9, 2026 | Nov 12, 2026 | | | [CVE-2026-123218](https://cubepath.com/security/cve/CVE-2026-123218) | IBM Aspera Faspex Incorrect Authorization Vulnerability IBM / Aspera Faspex | Nov 9, 2026 | Nov 12, 2026 | | | [CVE-2026-19868](https://cubepath.com/security/cve/CVE-2026-19868) | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability SonicWall / SonicOS SSLVPN | Nov 6, 2026 | Nov 20, 2026 | | | [CVE-2024-27834](https://cubepath.com/security/cve/CVE-2024-27834) | Apple Multiple Products Improper Authentication Vulnerability Apple / Multiple Products | Nov 4, 2026 | Nov 18, 2026 | | | [CVE-2026-119977](https://cubepath.com/security/cve/CVE-2026-119977) | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability WordPress / WordPress Core | Nov 3, 2026 | Nov 6, 2026 | | | [CVE-2026-111357](https://cubepath.com/security/cve/CVE-2026-111357) | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Ivanti / Connect Secure | Oct 30, 2026 | Nov 2, 2026 | | | [CVE-2026-118527](https://cubepath.com/security/cve/CVE-2026-118527) | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Ivanti / Connect Secure | Oct 30, 2026 | Nov 13, 2026 | | | [CVE-2026-76418](https://cubepath.com/security/cve/CVE-2026-76418) | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability Cisco / Secure Firewall ASA Software and Cisco Secure FTD Software | Oct 29, 2026 | Nov 1, 2026 | | | [CVE-2026-97229](https://cubepath.com/security/cve/CVE-2026-97229) | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability GitLab / Community Edition and Enterprise Edition | Oct 29, 2026 | Nov 1, 2026 | | | [CVE-2026-41709](https://cubepath.com/security/cve/CVE-2026-41709) | Broadcom VMWare ESX Insufficient Logging Vulnerability Broadcom / VMware ESX | Oct 28, 2026 | Nov 11, 2026 | | | [CVE-2026-46300](https://cubepath.com/security/cve/CVE-2026-46300) | Linux Kernel Missing Initialization of a Variable Vulnerability Linux / Kernel | Oct 28, 2026 | Oct 31, 2026 | | | [CVE-2026-111497](https://cubepath.com/security/cve/CVE-2026-111497) | Google Brotli Unchecked Return Value Vulnerability Google / Brotli | Oct 27, 2026 | Nov 10, 2026 | | | [CVE-2026-48356](https://cubepath.com/security/cve/CVE-2026-48356) | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability Adobe / Commerce and Magento | Oct 27, 2026 | Nov 10, 2026 | | | [CVE-2026-109618](https://cubepath.com/security/cve/CVE-2026-109618) | PHP Memory Corruption Vulnerability PHP Group / PHP | Oct 26, 2026 | Oct 29, 2026 | | | [CVE-2026-109619](https://cubepath.com/security/cve/CVE-2026-109619) | PHP Stale Internal Request-State Vulnerability PHP Group / PHP | Oct 26, 2026 | Oct 29, 2026 | | | [CVE-2026-110447](https://cubepath.com/security/cve/CVE-2026-110447) | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora / Collabora Online – Built-in CODE Server | Oct 23, 2026 | Oct 26, 2026 | | | [CVE-2026-114625](https://cubepath.com/security/cve/CVE-2026-114625) | Arista VeloCloud Orchestrator SQL Injection Vulnerability Arista / VeloCloud Orchestrator | Oct 23, 2026 | Oct 26, 2026 | | | [CVE-2026-106931](https://cubepath.com/security/cve/CVE-2026-106931) | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions / SiteGuard Server Edition | Oct 20, 2026 | Oct 23, 2026 | | | [CVE-2026-110936](https://cubepath.com/security/cve/CVE-2026-110936) | Siemens Software Center Uncontrolled Search Path Element Vulnerability Siemens / Software Center | Oct 20, 2026 | Nov 3, 2026 | | | [CVE-2026-96652](https://cubepath.com/security/cve/CVE-2026-96652) | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex / Media Server | Oct 20, 2026 | Nov 3, 2026 | | | [CVE-2026-96654](https://cubepath.com/security/cve/CVE-2026-96654) | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability Plex / Media Server | Oct 20, 2026 | Oct 23, 2026 | | | [CVE-2026-96655](https://cubepath.com/security/cve/CVE-2026-96655) | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex / Media Server | Oct 20, 2026 | Nov 3, 2026 | | | [CVE-2026-96656](https://cubepath.com/security/cve/CVE-2026-96656) | Plex Media Server External Control of File Name or Path Vulnerability Plex / Media Server | Oct 20, 2026 | Oct 23, 2026 | | | [CVE-2025-61624](https://cubepath.com/security/cve/CVE-2025-61624) | Fortinet Multiple Products Path Traversal Vulnerability Fortinet / Multiple Products | Oct 16, 2026 | Oct 19, 2026 | | | [CVE-2026-102764](https://cubepath.com/security/cve/CVE-2026-102764) | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust / Remote Support | Oct 16, 2026 | Oct 19, 2026 | | | [CVE-2026-21589](https://cubepath.com/security/cve/CVE-2026-21589) | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Atlassian / Multiple Products | Oct 15, 2026 | Oct 18, 2026 | | | [CVE-2026-0322](https://cubepath.com/security/cve/CVE-2026-0322) | Palo Alto Networks PAN-OS Code Injection Vulnerability Palo Alto Networks / PAN-OS | Oct 14, 2026 | Oct 17, 2026 | | | [CVE-2026-105133](https://cubepath.com/security/cve/CVE-2026-105133) | Ahsay AhsayCBS Improper Authentication Vulnerability Ahsay / AhsayCBS | Oct 14, 2026 | Oct 17, 2026 | | | [CVE-2026-105134](https://cubepath.com/security/cve/CVE-2026-105134) | Ahsay AhsayCBS Command Injection Vulnerability Ahsay / AhsayCBS | Oct 14, 2026 | Oct 17, 2026 | | | [CVE-2026-76519](https://cubepath.com/security/cve/CVE-2026-76519) | Cisco Secure Email Gateway Relative Path Traversal Vulnerability Cisco / Secure Email Gateway | Oct 14, 2026 | Oct 17, 2026 | | | [CVE-2026-104935](https://cubepath.com/security/cve/CVE-2026-104935) | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Ivanti / Connect Secure | Oct 13, 2026 | Oct 16, 2026 | | | [CVE-2026-96951](https://cubepath.com/security/cve/CVE-2026-96951) | Microsoft Windows Command Injection Vulnerability Microsoft / Windows | Oct 13, 2026 | Oct 16, 2026 | | | [CVE-2015-3306](https://cubepath.com/security/cve/CVE-2015-3306) | ProFTPD Improper Access Control Vulnerability ProFTPD / ProFTPD | Oct 8, 2026 | Oct 11, 2026 | | | [CVE-2015-5477](https://cubepath.com/security/cve/CVE-2015-5477) | ISC BIND Data Processing Errors Vulnerability ISC / BIND | Oct 8, 2026 | Oct 11, 2026 | | | [CVE-2016-3081](https://cubepath.com/security/cve/CVE-2016-3081) | Apache Struts Command Injection Vulnerability Apache / Struts | Oct 8, 2026 | Oct 11, 2026 | | | [CVE-2021-3199](https://cubepath.com/security/cve/CVE-2021-3199) | ONLYOFFICE Docs Server Path Traversal Vulnerability ONLYOFFICE / Docs | Oct 8, 2026 | Oct 11, 2026 | | | [CVE-2023-22894](https://cubepath.com/security/cve/CVE-2023-22894) | Strapi Cleartext Storage of Sensitive Information Vulnerability Strapi / Strapi | Oct 8, 2026 | Oct 11, 2026 | | | [CVE-2026-88779](https://cubepath.com/security/cve/CVE-2026-88779) | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix / NetScaler | Oct 4, 2026 | Oct 7, 2026 | | | [CVE-2026-102489](https://cubepath.com/security/cve/CVE-2026-102489) | Zammad GmbH Zammad Session Fixation Vulnerability Zammad GmbH / Zammad | Oct 2, 2026 | Oct 5, 2026 | | | [CVE-2026-102490](https://cubepath.com/security/cve/CVE-2026-102490) | Zammad GmbH Zammad Improper Privilege Management Vulnerability Zammad GmbH / Zammad | Oct 2, 2026 | Oct 5, 2026 | | | [CVE-2026-104286](https://cubepath.com/security/cve/CVE-2026-104286) | Fortinet FortiMail Path Traversal Vulnerability Fortinet / FortiMail | Oct 1, 2026 | Oct 4, 2026 | | | [CVE-2026-76504](https://cubepath.com/security/cve/CVE-2026-76504) | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Cisco / Catalyst SD-WAN Manager | Sep 30, 2026 | Oct 3, 2026 | | | [CVE-2026-86950](https://cubepath.com/security/cve/CVE-2026-86950) | Apple Multiple Products Out-of-Bounds Write Vulnerability Apple / Multiple Products | Sep 29, 2026 | Oct 13, 2026 | | | [CVE-2026-88771](https://cubepath.com/security/cve/CVE-2026-88771) | Citrix NetScaler Improper Input Validation Vulnerability Citrix / NetScaler | Sep 27, 2026 | Sep 30, 2026 | | | [CVE-2026-88772](https://cubepath.com/security/cve/CVE-2026-88772) | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix / NetScaler | Sep 27, 2026 | Sep 30, 2026 | | | [CVE-2026-65660](https://cubepath.com/security/cve/CVE-2026-65660) | Microsoft SharePoint Code Injection Vulnerability Microsoft / SharePoint | Sep 25, 2026 | Sep 28, 2026 | | | [CVE-2026-67279](https://cubepath.com/security/cve/CVE-2026-67279) | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability MikroTik / RouterOS | Sep 25, 2026 | Sep 28, 2026 | | | [CVE-2026-87902](https://cubepath.com/security/cve/CVE-2026-87902) | WordPress Core Remote File Inclusion Vulnerability WordPress / Core | Sep 25, 2026 | Sep 28, 2026 | | | [CVE-2026-5430](https://cubepath.com/security/cve/CVE-2026-5430) | WSO2 Multiple Products Path Traversal Vulnerability WSO2 / Multiple Products | Sep 24, 2026 | Sep 27, 2026 | | | [CVE-2026-71362](https://cubepath.com/security/cve/CVE-2026-71362) | Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe / Commerce and Magento | Sep 24, 2026 | Sep 27, 2026 | | | [CVE-2026-85102](https://cubepath.com/security/cve/CVE-2026-85102) | Check Point Multiple Products Improper Certificate Validation Vulnerability Check Point / Multiple Products | Sep 22, 2026 | Sep 25, 2026 | | | [CVE-2026-93616](https://cubepath.com/security/cve/CVE-2026-93616) | Check Point Multiple Products Path Traversal Vulnerability Check Point / Multiple Products | Sep 22, 2026 | Sep 25, 2026 | | | [CVE-2026-93952](https://cubepath.com/security/cve/CVE-2026-93952) | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability Arista / VeloCloud Orchestrator | Sep 22, 2026 | Sep 25, 2026 | | | [CVE-2026-94127](https://cubepath.com/security/cve/CVE-2026-94127) | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability F5 / BIG-IP APM | Sep 22, 2026 | Sep 25, 2026 | | | [CVE-2026-7273](https://cubepath.com/security/cve/CVE-2026-7273) | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Zyxel / GS1900 Series Switches | Sep 21, 2026 | Sep 24, 2026 | | | [CVE-2025-39682](https://cubepath.com/security/cve/CVE-2025-39682) | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability Linux / Kernel | Sep 18, 2026 | Sep 21, 2026 | | | [CVE-2025-39964](https://cubepath.com/security/cve/CVE-2025-39964) | Linux Kernel Race Condition Vulnerability Linux / Kernel | Sep 18, 2026 | Sep 21, 2026 | | | [CVE-2026-53266](https://cubepath.com/security/cve/CVE-2026-53266) | Linux Kernel Out-of-Bounds Write Vulnerability Linux / Kernel | Sep 18, 2026 | Sep 21, 2026 | | | [CVE-2026-58704](https://cubepath.com/security/cve/CVE-2026-58704) | Google Pixel Improper Authorization Vulnerability Google / Pixel | Sep 16, 2026 | Sep 19, 2026 | | | [CVE-2026-76460](https://cubepath.com/security/cve/CVE-2026-76460) | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability Cisco / Identity Services Engine | Sep 16, 2026 | Sep 19, 2026 | | | [CVE-2026-87886](https://cubepath.com/security/cve/CVE-2026-87886) | Acronis Backup Incorrect Default Permissions Vulnerability Acronis / Backup | Sep 16, 2026 | Sep 19, 2026 | | | [CVE-2026-76461](https://cubepath.com/security/cve/CVE-2026-76461) | Cisco Secure Email Gateway SQL Injection Vulnerability Cisco / Secure Email Gateway | Sep 14, 2026 | Sep 17, 2026 | | | [CVE-2026-42016](https://cubepath.com/security/cve/CVE-2026-42016) | JFrog Artifactory Incorrect Authorization Vulnerability JFrog / Artifactory | Sep 11, 2026 | Sep 25, 2026 | | | [CVE-2026-42018](https://cubepath.com/security/cve/CVE-2026-42018) | JFrog Artifactory Improper Authentication Vulnerability JFrog / Artifactory | Sep 11, 2026 | Sep 25, 2026 | | | [CVE-2026-84869](https://cubepath.com/security/cve/CVE-2026-84869) | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability ConnectWise / ScreenConnect | Sep 11, 2026 | Sep 14, 2026 | | | [CVE-2026-85706](https://cubepath.com/security/cve/CVE-2026-85706) | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability GitLab / Community Edition and Enterprise Edition | Sep 11, 2026 | Sep 14, 2026 | | | [CVE-2026-67277](https://cubepath.com/security/cve/CVE-2026-67277) | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability MikroTik / RouterOS | Sep 10, 2026 | Sep 13, 2026 | | | [CVE-2026-86060](https://cubepath.com/security/cve/CVE-2026-86060) | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability MikroTik / RouterOS | Sep 10, 2026 | Sep 13, 2026 | | | [CVE-2025-25249](https://cubepath.com/security/cve/CVE-2025-25249) | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Fortinet / Multiple Products | Sep 9, 2026 | Sep 12, 2026 | | | [CVE-2026-19490](https://cubepath.com/security/cve/CVE-2026-19490) | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability Citrix / NetScaler | Sep 9, 2026 | Sep 12, 2026 | | | [CVE-2026-20079](https://cubepath.com/security/cve/CVE-2026-20079) | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Cisco / Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Sep 9, 2026 | Sep 12, 2026 | | | [CVE-2026-87491](https://cubepath.com/security/cve/CVE-2026-87491) | Google Chromium V8 Out of Bounds Write Vulnerability Google / Chromium V8 | Sep 9, 2026 | Sep 23, 2026 | | | [CVE-2026-75650](https://cubepath.com/security/cve/CVE-2026-75650) | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability Adobe / Commerce and Magento | Sep 8, 2026 | Sep 11, 2026 | | | [CVE-2026-81963](https://cubepath.com/security/cve/CVE-2026-81963) | Microsoft Windows Link Following Vulnerability Microsoft / Windows | Sep 8, 2026 | Sep 22, 2026 | | | [CVE-2026-85880](https://cubepath.com/security/cve/CVE-2026-85880) | Microsoft Windows Heap-Based Buffer Overflow Vulnerability Microsoft / Windows | Sep 8, 2026 | Sep 22, 2026 | | | [CVE-2026-86218](https://cubepath.com/security/cve/CVE-2026-86218) | N-able N-central Static Code Injection Vulnerability N-able / N-central | Sep 8, 2026 | Sep 11, 2026 | | | [CVE-2026-85046](https://cubepath.com/security/cve/CVE-2026-85046) | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Sep 4, 2026 | Sep 18, 2026 | | | [CVE-2026-48710](https://cubepath.com/security/cve/CVE-2026-48710) | Kludex Starlette HTTP Request/Response Smuggling Vulnerability Kludex / Starlette | Sep 2, 2026 | Sep 16, 2026 | | | [CVE-2026-49869](https://cubepath.com/security/cve/CVE-2026-49869) | Kestra OSS OS Command Injection Vulnerability Kestra / Kestra OSS | Sep 2, 2026 | Sep 5, 2026 | | | [CVE-2026-59822](https://cubepath.com/security/cve/CVE-2026-59822) | BerriAI LiteLLM Improper Authentication Vulnerability BerriAI / LiteLLM | Sep 2, 2026 | Sep 16, 2026 | | | [CVE-2026-82329](https://cubepath.com/security/cve/CVE-2026-82329) | JFrog Artifactory Improper Authentication Vulnerability JFrog / Artifactory | Sep 2, 2026 | Sep 5, 2026 | | | [CVE-2026-83548](https://cubepath.com/security/cve/CVE-2026-83548) | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall / SMA1000 Appliances | Sep 2, 2026 | Sep 5, 2026 | | | [CVE-2026-83549](https://cubepath.com/security/cve/CVE-2026-83549) | SonicWall SMA1000 Appliances OS Command Injection Vulnerability SonicWall / SMA1000 Appliances | Sep 2, 2026 | Sep 5, 2026 | | | [CVE-2026-9586](https://cubepath.com/security/cve/CVE-2026-9586) | Sangoma Switchvox SQL Injection Vulnerability Sangoma / Switchvox | Sep 2, 2026 | Sep 5, 2026 | | | [CVE-2026-81578](https://cubepath.com/security/cve/CVE-2026-81578) | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability PaperCut / NG/MF | Aug 31, 2026 | Sep 14, 2026 | | | [CVE-2026-82078](https://cubepath.com/security/cve/CVE-2026-82078) | PaperCut NG/MF Unsafe Reflection Vulnerability PaperCut / NG/MF | Aug 31, 2026 | Sep 14, 2026 | | | [CVE-2023-49105](https://cubepath.com/security/cve/CVE-2023-49105) | ownCloud Improper Authentication Vulnerability ownCloud / ownCloud | Aug 27, 2026 | Aug 30, 2026 | | | [CVE-2026-53362](https://cubepath.com/security/cve/CVE-2026-53362) | Linux Kernel Unspecified Vulnerability Linux / Kernel | Aug 27, 2026 | Aug 30, 2026 | | | [CVE-2026-66384](https://cubepath.com/security/cve/CVE-2026-66384) | JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability JFrog / Artifactory | Aug 27, 2026 | Sep 10, 2026 | | | [CVE-2015-3246](https://cubepath.com/security/cve/CVE-2015-3246) | Red Hat Libuser Race Condition Vulnerability Red Hat / Libuser | Aug 26, 2026 | Sep 9, 2026 | | | [CVE-2015-5287](https://cubepath.com/security/cve/CVE-2015-5287) | Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Red Hat / Automatic Bug Reporting Tool | Aug 26, 2026 | Sep 9, 2026 | | | [CVE-2019-1068](https://cubepath.com/security/cve/CVE-2019-1068) | Microsoft SQL Server Remote Code Execution Vulnerability Microsoft / SQL Server | Aug 26, 2026 | Aug 29, 2026 | | | [CVE-2021-23758](https://cubepath.com/security/cve/CVE-2021-23758) | Ajax.NET Professional Deserialization of Untrusted Data Vulnerability Ajax.NET Professional / Ajax.NET Professional | Aug 26, 2026 | Sep 9, 2026 | | | [CVE-2022-0995](https://cubepath.com/security/cve/CVE-2022-0995) | Linux Kernel Out-of-Bounds Write Vulnerability Linux / Kernel | Aug 26, 2026 | Aug 29, 2026 | | | [CVE-2026-8452](https://cubepath.com/security/cve/CVE-2026-8452) | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Citrix / NetScaler ADC and NetScaler Gateway | Aug 26, 2026 | Aug 29, 2026 | | | [CVE-2026-60004](https://cubepath.com/security/cve/CVE-2026-60004) | Gitea Code Injection Vulnerability Gitea / Gitea | Aug 25, 2026 | Aug 28, 2026 | | | [CVE-2026-21962](https://cubepath.com/security/cve/CVE-2026-21962) | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Oracle / HTTP Server and Oracle Weblogic Server Proxy Plug-in | Aug 24, 2026 | Aug 27, 2026 | | | [CVE-2026-73570](https://cubepath.com/security/cve/CVE-2026-73570) | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability Synacor / Zimbra Collaboration Suite (ZCS) | Aug 21, 2026 | Aug 24, 2026 | | Page 1 of 18 [Older](https://cubepath.com/security/cve/kev?page=2) Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. [Sources and licenses](https://cubepath.com/security/cve/legal)