Zero Day MonitorZDM

Dashboard Vulnerabilities Trending Zero-Days News About

Impressum Privacy Policy

Zero Day Monitor © 2026

5021 articles · 188910 vulns · 37/41 feeds (7d)

Trending Vulnerabilities

Top vulnerabilities ranked by news velocity, CISA KEV status, EPSS exploitation probability, and independent source coverage.

1

microsoft · CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityKEVEXPLOITEDPATCHED

windows 10 version· CVSS 7.0· CWE-416

2

microsoft · CVE-2026-55040 — Microsoft SharePoint Server Security Feature Bypass VulnerabilityKEVEXPLOITEDPATCHED

sharepoint_server· CVSS 9.1· CWE-1390

3

microsoft · CVE-2026-45659 — Microsoft SharePoint Remote Code Execution VulnerabilityKEVEXPLOITEDPATCHED

sharepoint_server· CVSS 8.8· CWE-502

4

VMware · CVE-2026-59310 — vCenter directory-traversal vulnerabilityKEVEXPLOITEDPATCHED

Cloud Foundation· CVSS 9.8· CWE-22

5

metaba · CVE-2026-72898 — Metabase SQL injection via password reset endpointKEVEXPLOITEDPATCHED

metaba· CVSS 10.0· CWE-89

6

wordpress · CVE-2026-63030 — WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionKEVEXPLOITEDPATCHED

wordpress· CVSS 9.8

7

jetbrains · CVE-2026-63077 — CVE-2026-63077: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollinKEVEXPLOITEDPATCHED

teamcity· CVSS 9.8· CWE-502

8

langflow · CVE-2026-9198 — Unauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationKEVEXPLOITEDPATCHED

langflow· CVSS 9.8· CWE-94

9

progress · CVE-2026-8037 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAFKEVEXPLOITEDPATCHED

connection_manager_for_objectscale· CVSS 9.6· CWE-77

10

wordpress · CVE-2026-60137 — WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryKEVEXPLOITEDPATCHED

wordpress· CVSS 5.9

11

widgetfactory · CVE-2026-48907 — Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5KEVEXPLOITED

jce· CVSS 7.5· CWE-284

12

microsoft · CVE-2026-50656 — Microsoft Defender Elevation of Privilege VulnerabilityEXPLOITEDPATCHED

malware_protection_engine· CVSS 7.8· CWE-59

13

linux · CVE-2026-53359 — KVM: x86: Fix shadow paging use-after-free due to unexpected roleEXPLOITEDPATCHED

linux_kernel· CVSS 8.8

14

blocksy · CVE-2026-58480 — Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachmentsKEVEXPLOITEDPATCHED

blocksy companion pro· CVSS 9.8· CWE-434

15

sonicwall · CVE-2026-15409 — CVE-2026-15409: A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A EXPLOITEDPATCHED

sma6210_firmware· CVSS 10.0· CWE-918

16

apache · CVE-2026-49975 — Apache HTTP Server: mod_http2 denial of serviceEXPLOITEDPATCHED

http_server· CVSS 8.8· CWE-789

17

cis · CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

cisco secure firewall adaptive security appliance (asa)· CVSS 8.6· CWE-244

18

sonicwall · CVE-2026-15410 — CVE-2026-15410: Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SEXPLOITEDPATCHED

sma6210_firmware· CVSS 7.2· CWE-94

19

conductor-oss · CVE-2026-58138 — Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script EvaluatorsKEVEXPLOITEDPATCHED

conductor· CVSS 9.8· CWE-94

20

microsoft · CVE-2026-56164 — Microsoft SharePoint Server Elevation of Privilege VulnerabilityKEVEXPLOITEDPATCHED

sharepoint_server· CVSS 5.3· CWE-306

21

microsoft · CVE-2026-50522 — Microsoft SharePoint Remote Code Execution VulnerabilityKEVEXPLOITEDPATCHED

sharepoint_server· CVSS 9.8· CWE-502

22

sap · CVE-2026-58231 — Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

sap commerce cloud (data hub adapter)· CVSS 10.0· CWE-94

23

linux · CVE-2026-53360 — KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in useEXPLOITEDPATCHED

linux_kernel· CVSS 8.8

24

microsoft · CVE-2026-65667 — Microsoft Teams Elevation of Privilege VulnerabilityPATCHED

teams· CVSS 10.0· CWE-862

25

microsoft · CVE-2026-65791 — Windows iSCSI Target Service Remote Code Execution VulnerabilityPATCHED

windows 10 version· CVSS 9.8· CWE-122

26

Microsoft · CVE-2026-59124 — Microsoft High Performance Computing (HPC) Pack Remote Code Execution VulnerabilityPATCHED

Windows App Client for Windows Desktop· CVSS 9.8· CWE-502

27

Microsoft · CVE-2026-62893 — Windows Deployment Services TFTP Server Remote Code Execution VulnerabilityPATCHED

Windows 10 Version 1607· CVSS 9.8· CWE-416

28

n-able · CVE-2026-18577 — Incomplete patch leads to administrative account takeoverPATCHED

n-central· CWE-288

29

Microsoft · CVE-2026-62832 — Windows User Profile Service Elevation of Privilege VulnerabilityPATCHED

Windows 10 Version 21H2· CVSS 7.8· CWE-59

30

adobe · CVE-2026-48362 — ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)PATCHED

coldfusion· CVSS 10.0· CWE-78

31

microsoft · CVE-2026-56162 — Azure SQL Database Elevation of Privilege VulnerabilityPATCHED

azure_sql_database· CVSS 10.0· CWE-287

32

adobe · CVE-2026-71362 — Adobe Commerce | Incorrect Authorization (CWE-863)PATCHED

adobe commerce· CVSS 9.1· CWE-863

33

Microsoft · CVE-2026-62815 — Microsoft QUIC Remote Code Execution VulnerabilityPATCHED

Windows 11 version 23H2· CVSS 9.8· CWE-416

34

Cisco · CVE-2026-20337 — ClamAV ZIP File Format Processing Memory Corruption Vulnerability

Cisco Secure Endpoint· CVSS 7.5· CWE-120

35

Cisco · CVE-2026-20338 — ClamAV ZIP File Format Processing Memory Corruption Vulnerability

Cisco Secure Endpoint· CVSS 7.5· CWE-415

36

Microsoft · CVE-2026-63520 — Microsoft SharePoint Server Remote Code Execution VulnerabilityPATCHED

Microsoft SharePoint Enterprise Server 2016· CVSS 8.1· CWE-20

37

dhcpcd-project · CVE-2026-14258 — Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handlingEXPLOITEDPATCHED

dhcpcd· CVSS 6.5· CWE-835

38

sap · CVE-2026-34265 — Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform

sap netweaver and abap platform· CVSS 9.8· CWE-787

39

microsoft · CVE-2026-62873 — Microsoft 365 Admin Center Elevation of Privilege VulnerabilityPATCHED

windows_admin_center· CVSS 9.8· CWE-347

40

praisonai · CVE-2026-61447 — PraisonAI before 1.6.78 Remote Code Execution via CodeAgentEXPLOITEDPATCHED

praisonai· CVSS 7.5· CWE-94

41

suyogs · CVE-2026-61459 — MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured ToolsEXPLOITEDPATCHED

mcp-server-kubernetes· CVSS 9.8· CWE-88

42

sonicwall · CVE-2026-66145 — CVE-2026-66145: An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versionPATCHED

gms· CVSS 9.1· CWE-94

43

sonicwall · CVE-2026-66147 — CVE-2026-66147: An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlierPATCHED

gms· CVSS 9.4· CWE-94

44

Microsoft · CVE-2026-59132 — Windows TCP/IP Denial of Service VulnerabilityPATCHED

Windows 10 Version 1607· CVSS 7.5· CWE-476

45

microsoft · CVE-2026-62918 — Microsoft Teams Spoofing VulnerabilityPATCHED

teams· CVSS 7.5· CWE-347

46

apache · CVE-2026-57914 — Apache Kerby: StackOverflow on parsing deeply nested ASN1 structuresEXPLOITEDPATCHED

kerby· CVSS 6.5· CWE-400

47

microsoft · CVE-2026-62830 — Azure SRE Agent Elevation of Privilege VulnerabilityPATCHED

azure_sre_agent· CVSS 9.9· CWE-862

48

microsoft · CVE-2026-59115 — Microsoft Entra Provisioning Service Elevation of Privilege VulnerabilityPATCHED

entra_provisioning_service· CVSS 9.9· CWE-35

49

rubygems · CVE-2026-66066 — Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingPATCHED

activestorage· CWE-1188

50

microsoft · CVE-2026-50481 — Azure Active Directory Elevation of Privilege VulnerabilityPATCHED

azure_active_directory· CVSS 9.9· CWE-471