SubZer0 · Patch nowhttps://iliya-bashrc.github.io/SubZer0/CVEs that are being exploited, are weaponized in Metasploit/Nuclei, or have public exploit code with a high EPSS. Updated every 6 hours.Fri, 23 Oct 2026 05:55:25 +0000CVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-109618https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-109618Wed, 21 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.2 · EPSS 5.3%CVE-2026-106931: SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-106931https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-106931Tue, 20 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 8.5 · EPSS 1.2%CVE-2026-96656: Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96656https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96656Tue, 20 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 8.6 · EPSS 0.8%CVE-2026-96654: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,'…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96654https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96654Tue, 20 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 6.9 · EPSS 0.5%CVE-2026-96655: Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96655https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96655Tue, 20 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 5.3 · EPSS 0.5%CVE-2026-96652: Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96652https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96652Tue, 20 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 5.3 · EPSS 0.5%CVE-2026-110936: A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8).https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-110936https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-110936Tue, 20 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 8.4 · EPSS 0.2%CVE-2026-110372: Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-110372https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-110372Sun, 18 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.8 · EPSS 0.3%CVE-2026-94169: Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-94169https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-94169Fri, 16 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 10.0 · EPSS 3.3%CVE-2026-102764: The vulnerability exists within internal components of BeyondTrust’s Remote Support product.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-102764https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-102764Fri, 16 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 9.3 · EPSS 1.2%CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2025-61624https://iliya-bashrc.github.io/SubZer0/cve/CVE-2025-61624Fri, 16 Oct 2026 00:00:00 +0000On CISA KEV · EPSS 1.1%CVE-2026-21589: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-21589https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-21589Thu, 15 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 9.3 · EPSS 12.7%CVE-2026-111214: Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-111214https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-111214Thu, 15 Oct 2026 00:00:00 +0000Public exploit, high EPSS · CVSS 8.6 · EPSS 10.0%CVE-2026-105134: A flaw has been found in Ahsay AhsayCBS up to 10.3.2.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-105134https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-105134Wed, 14 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 9.3 · EPSS 38.3%CVE-2026-59774: Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-59774https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-59774Wed, 14 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.8 · EPSS 28.3%CVE-2026-105133: A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-105133https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-105133Wed, 14 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 5.5 · EPSS 5.8%CVE-2026-76519: A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-76519https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-76519Wed, 14 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 9.8 · EPSS 1.6%CVE-2026-0322: A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS®…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-0322https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-0322Wed, 14 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 8.6 · EPSS 1.2%CVE-2026-85714: Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-85714https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-85714Wed, 14 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.1 · EPSS 0.6%CVE-2026-104935: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-104935https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-104935Tue, 13 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 8.6 · EPSS 26.0%CVE-2026-96951: Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96951https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-96951Tue, 13 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 8.8 · EPSS 1.5%CVE-2026-91136: The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-91136https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-91136Sat, 10 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 7.5 · EPSS 1.8%CVE-2015-3306: ProFTPD Improper Access Control Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2015-3306https://iliya-bashrc.github.io/SubZer0/cve/CVE-2015-3306Thu, 08 Oct 2026 00:00:00 +0000On CISA KEV · EPSS 99.5%CVE-2015-5477: ISC BIND Data Processing Errors Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2015-5477https://iliya-bashrc.github.io/SubZer0/cve/CVE-2015-5477Thu, 08 Oct 2026 00:00:00 +0000On CISA KEV · EPSS 99.4%CVE-2016-3081: Apache Struts Command Injection Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2016-3081https://iliya-bashrc.github.io/SubZer0/cve/CVE-2016-3081Thu, 08 Oct 2026 00:00:00 +0000On CISA KEV · EPSS 96.1%CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2021-3199https://iliya-bashrc.github.io/SubZer0/cve/CVE-2021-3199Thu, 08 Oct 2026 00:00:00 +0000On CISA KEV · EPSS 20.1%CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2023-22894https://iliya-bashrc.github.io/SubZer0/cve/CVE-2023-22894Thu, 08 Oct 2026 00:00:00 +0000On CISA KEV · EPSS 3.6%CVE-2026-85097: The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-85097https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-85097Thu, 08 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.8 · EPSS 0.3%CVE-2026-93674: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-93674https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-93674Wed, 07 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.8 · EPSS 6.2%CVE-2026-76268: In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-76268https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-76268Wed, 07 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.8 · EPSS 1.6%CVE-2026-88779: Vulnerability in NetScaler ADC and NetScaler Gateway.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-88779https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-88779Sun, 04 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 8.7 · EPSS 0.6%CVE-2009-20011: ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are...https://iliya-bashrc.github.io/SubZer0/cve/CVE-2009-20011https://iliya-bashrc.github.io/SubZer0/cve/CVE-2009-20011Fri, 02 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 10.0 · EPSS 1.9%CVE-2009-20010: Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php...https://iliya-bashrc.github.io/SubZer0/cve/CVE-2009-20010https://iliya-bashrc.github.io/SubZer0/cve/CVE-2009-20010Fri, 02 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.3 · EPSS 1.9%CVE-2009-20009: Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability...https://iliya-bashrc.github.io/SubZer0/cve/CVE-2009-20009https://iliya-bashrc.github.io/SubZer0/cve/CVE-2009-20009Fri, 02 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.3 · EPSS 1.8%CVE-2009-20008: Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when...https://iliya-bashrc.github.io/SubZer0/cve/CVE-2009-20008https://iliya-bashrc.github.io/SubZer0/cve/CVE-2009-20008Fri, 02 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 8.6 · EPSS 1.3%CVE-2026-102489: Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-102489https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-102489Fri, 02 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 9.4 · EPSS 1.3%CVE-2026-102490: Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-102490https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-102490Fri, 02 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 9.4 · EPSS 0.5%CVE-2026-103956: Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-103956https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-103956Fri, 02 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 10.0 · EPSS 0.5%CVE-2026-104286: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-104286https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-104286Thu, 01 Oct 2026 00:00:00 +0000On CISA KEV · CVSS 9.8 · EPSS 2.2%CVE-2026-69085: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-69085https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-69085Thu, 01 Oct 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 10.0 · EPSS 1.5%CVE-2026-76504: A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-76504https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-76504Wed, 30 Sep 2026 00:00:00 +0000On CISA KEV · CVSS 9.8 · EPSS 1.8%CVE-2026-55224: MineAdmin is a ready-to-use backend management system suitable for quickly building website backends…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-55224https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-55224Wed, 30 Sep 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 8.7 · EPSS 1.2%CVE-2026-86950: An out-of-bounds write issue was addressed with improved bounds checking.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-86950https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-86950Tue, 29 Sep 2026 00:00:00 +0000On CISA KEV · CVSS 8.8 · EPSS 1.2%CVE-2026-88772: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-88772https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-88772Sun, 27 Sep 2026 00:00:00 +0000On CISA KEV · CVSS 9.5 · EPSS 1.3%CVE-2026-88771: Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-88771https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-88771Sun, 27 Sep 2026 00:00:00 +0000On CISA KEV · CVSS 9.5 · EPSS 1.1%CVE-2026-88773: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-88773https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-88773Sun, 27 Sep 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.3 · EPSS 0.4%CVE-2026-18143: The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all…https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-18143https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-18143Sat, 26 Sep 2026 00:00:00 +0000Metasploit/Nuclei can already hit it · CVSS 9.8 · EPSS 1.7%CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-87902https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-87902Fri, 25 Sep 2026 00:00:00 +0000On CISA KEV · EPSS 40.0%CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-65660https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-65660Fri, 25 Sep 2026 00:00:00 +0000On CISA KEV · EPSS 2.1%CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerabilityhttps://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-67279https://iliya-bashrc.github.io/SubZer0/cve/CVE-2026-67279Fri, 25 Sep 2026 00:00:00 +0000On CISA KEV · EPSS 1.0%