Search CVEs, research… / diras.sa

UPDATED SEP 30, 2026

CVE Radar: latest vulnerabilities, exploited CVEs and patches

A daily, analyst-curated feed of new and actively exploited CVEs, with severity, exploitation status, affected versions and remediation steps for each.

  1. CVE-2026-8037
    LoadMaster command injection pre-auth remote code execution Progress LoadMaster ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  2. CVE-2026-25089
    FortiSandbox OS command injection unauthenticated remote command execution Fortinet FortiSandbox ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    CRITICAL 9.8
  3. CVE-2026-86060
    RouterOS SSH login username handling lets unauthenticated users escalate privileges MikroTik RouterOS ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  4. CVE-2026-85102
    Quantum Security Gateway improper certificate validation lets unauthenticated attacker run code Check Point Quantum Security Gateway ·
    • CISA KEV
    • EXPLOITED
    CRITICAL 9.8
  5. CVE-2026-76461
    Cisco Secure Email Gateway SQL injection leads to pre-auth remote code execution Cisco Secure Email Gateway ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    CRITICAL 9.8
  6. CVE-2026-93616
    Quantum Security Management directory traversal allows unauthenticated code execution Check Point Quantum Security Management ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    CRITICAL 9.8
  7. CVE-2026-20079
    Cisco Secure Firewall Management Center authentication bypass and RCE Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    CRITICAL 10
  8. CVE-2026-15409
    SonicWall SMA1000 SSRF allows unauthenticated request forging SonicWall SMA1000 Appliances ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    CRITICAL 10
  9. CVE-2026-0770
    Langflow exec_globals pre-auth remote code execution Langflow Langflow ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    CRITICAL 9.8
  10. CVE-2026-8452
    Citrix NetScaler ADC and Gateway memory overflow pre-auth remote code execution Citrix NetScaler ADC and NetScaler Gateway ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  11. CVE-2026-50522
    SharePoint deserialization pre-auth remote code execution Microsoft SharePoint ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  12. CVE-2026-56164
    SharePoint Server missing authentication allows privilege elevation Microsoft SharePoint Server ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  13. CVE-2026-59310
    VMware vCenter directory traversal lets network attacker execute code Broadcom VMware vCenter ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  14. CVE-2026-65400
    MacOS Screen Sharing improper authentication lets network attacker bypass credentials Apple macOS ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  15. CVE-2026-19478
    GitLab GraphQL directive lets unauthenticated users modify public projects GitLab GitLab ·
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.1
  16. CVE-2026-18577
    N-central authentication bypass that can enable account takeover N-able N-central ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    HIGH 8.1
  17. CVE-2026-56291
    Balbooa Forms unauthenticated file upload remote code execution Balbooa Forms ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    CRITICAL 9.8
  18. CVE-2026-9586
    Switchvox SQL injection allows unauthenticated remote SQL execution Sangoma Switchvox ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  19. CVE-2026-60004
    Gitea code injection via diffpatch API remote code execution Gitea Gitea ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  20. CVE-2026-82329
    Artifactory authentication weakness allows pre-auth admin takeover JFrog Artifactory ·
    • CISA KEV
    • EXPLOITED
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
20 CVEs · page 21 of 23

About CVE Radar

CVE Radar tracks newly published Common Vulnerabilities and Exposures (CVEs) from NVD, the CISA Known Exploited Vulnerabilities catalog and vendor security advisories. Each entry is reviewed by Diras Labs analysts and includes affected versions, exploitation status, remediation guidance and relevance to organizations in Saudi Arabia and the GCC.