BEGIN:VCALENDAR VERSION:2.0 PRODID:-//BaselineWatch//KEV due dates//EN CALSCALE:GREGORIAN METHOD:PUBLISH X-WR-CALNAME:BaselineWatch · KEV due dates BEGIN:VEVENT UID:kev-CVE-2026-65660@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20260928 DTEND;VALUE=DATE:20260929 SUMMARY:KEV due: CVE-2026-65660 — Improper control of generation of code ('code injection') in Microsoft Office S… DESCRIPTION:Improper control of generation of code ('code injection') in Mi crosoft Office SharePoint allows an authorized attacker to execute code ov er a network. Added to CISA's catalog 2026-09-25. http://localhost:8790/vu lnerabilities/CVE-2026-65660 URL:http://localhost:8790/vulnerabilities/CVE-2026-65660 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-104286@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261004 DTEND;VALUE=DATE:20261005 SUMMARY:KEV due: CVE-2026-104286 — An improper limitation of a pathname t o a restricted directory ('path traversal… DESCRIPTION:An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 \, FortiMail 7.6.0 through 7.6.6\, FortiMail 7.4.0 through 7.4.8\, FortiMa il 7.2.0 through 7.2.9\, FortiMail 7.0 all versions may allow an unauthent icated attacker to write arbitrary files on the underlying system via craf ted HTTP or HTTPS requests. Added to CISA's catalog 2026-10-01. http://loc alhost:8790/vulnerabilities/CVE-2026-104286 URL:http://localhost:8790/vulnerabilities/CVE-2026-104286 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-102489@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261005 DTEND;VALUE=DATE:20261006 SUMMARY:KEV due: CVE-2026-102489 — Zammad versions 6.3.0 to 6.5.4 are vul nerable a session hijack vulnerability th… DESCRIPTION:Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2\, but not exploitabl e due to changes in the underlying framework. Added to CISA's catalog 2026 -10-02. http://localhost:8790/vulnerabilities/CVE-2026-102489 URL:http://localhost:8790/vulnerabilities/CVE-2026-102489 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-102490@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261005 DTEND;VALUE=DATE:20261006 SUMMARY:KEV due: CVE-2026-102490 — Zammad packages built with packager.io (DEB and RPM) could have allowed a local… DESCRIPTION:Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privilege s on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their i dentity to that account. An attacker holding that foothold could have esca lated within seconds\, because the affected services were restarted automa tically whenever they stopped\; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — instal lations from source or the official container images were not. All release d packaged versions were affected. Added to CISA's catalog 2026-10-02. htt p://localhost:8790/vulnerabilities/CVE-2026-102490 URL:http://localhost:8790/vulnerabilities/CVE-2026-102490 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2015-3306@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261011 DTEND;VALUE=DATE:20261012 SUMMARY:KEV due: CVE-2015-3306 — The mod_copy module in ProFTPD 1.3.5 all ows remote attackers to read and write … DESCRIPTION:The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto command s. Added to CISA's catalog 2026-10-08. http://localhost:8790/vulnerabiliti es/CVE-2015-3306 URL:http://localhost:8790/vulnerabilities/CVE-2015-3306 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2015-5477@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261011 DTEND;VALUE=DATE:20261012 SUMMARY:KEV due: CVE-2015-5477 — named in ISC BIND 9.x before 9.9.7-P2 an d 9.10.x before 9.10.2-P3 allows remote… DESCRIPTION:named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2- P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. Added to CISA's catalog 2026-1 0-08. http://localhost:8790/vulnerabilities/CVE-2015-5477 URL:http://localhost:8790/vulnerabilities/CVE-2015-5477 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2016-3081@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261011 DTEND;VALUE=DATE:20261012 SUMMARY:KEV due: CVE-2016-3081 — Apache Struts 2.3.19 to 2.3.20.2\, 2.3.2 1 to 2.3.24.1\, and 2.3.25 to 2.3.28\, whe… DESCRIPTION:Apache Struts 2.3.19 to 2.3.20.2\, 2.3.21 to 2.3.24.1\, and 2.3 .25 to 2.3.28\, when Dynamic Method Invocation is enabled\, allow remote a ttackers to execute arbitrary code via method: prefix\, related to chained expressions. Added to CISA's catalog 2026-10-08. http://localhost:8790/vu lnerabilities/CVE-2016-3081 URL:http://localhost:8790/vulnerabilities/CVE-2016-3081 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2021-3199@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261011 DTEND;VALUE=DATE:20261012 SUMMARY:KEV due: CVE-2021-3199 — Directory traversal with remote code exe cution can occur in /upload in ONLYOFFI… DESCRIPTION:Directory traversal with remote code execution can occur in /up load in ONLYOFFICE Document Server before 5.6.3\, when JWT is used\, via a /.. sequence in an image upload parameter. Added to CISA's catalog 2026-1 0-08. http://localhost:8790/vulnerabilities/CVE-2021-3199 URL:http://localhost:8790/vulnerabilities/CVE-2021-3199 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2023-22894@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261011 DTEND;VALUE=DATE:20261012 SUMMARY:KEV due: CVE-2023-22894 — Strapi through 4.5.5 allows attackers ( with access to the admin panel) to disco… DESCRIPTION:Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive informati on and infer a value from API responses. If the attacker has super admin a ccess\, then this can be exploited to discover the password hash and passw ord reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users wit h a lower privileged role (e.g.\, Editor or Author)\, then this can be exp loited to discover sensitive information for all API users but not other a dmin accounts. Added to CISA's catalog 2026-10-08. http://localhost:8790/v ulnerabilities/CVE-2023-22894 URL:http://localhost:8790/vulnerabilities/CVE-2023-22894 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-86950@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261013 DTEND;VALUE=DATE:20261014 SUMMARY:KEV due: CVE-2026-86950 — An out-of-bounds write issue was addres sed with improved bounds checking. This … DESCRIPTION:An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11\, iOS 26. 7.1 and iPadOS 26.7.1\, macOS Sequoia 15.8.1\, macOS Tahoe 26.7.1. Process ing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extrem ely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Added to CISA's catalog 2026-09-29. http://localhos t:8790/vulnerabilities/CVE-2026-86950 URL:http://localhost:8790/vulnerabilities/CVE-2026-86950 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-104935@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261016 DTEND;VALUE=DATE:20261017 SUMMARY:KEV due: CVE-2026-104935 — Authentication bypass by spoofing in I CS before version 25.1.3.0 allows a remot… DESCRIPTION:Authentication bypass by spoofing in ICS before version 25.1.3. 0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior. Added to CISA's catal og 2026-10-13. http://localhost:8790/vulnerabilities/CVE-2026-104935 URL:http://localhost:8790/vulnerabilities/CVE-2026-104935 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-96951@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261016 DTEND;VALUE=DATE:20261017 SUMMARY:KEV due: CVE-2026-96951 — Improper neutralization of special elem ents used in a command ('command injecti… DESCRIPTION:Improper neutralization of special elements used in a command ( 'command injection') in Windows Shell allows an unauthorized attacker to b ypass a security feature over a network. Added to CISA's catalog 2026-10-1 3. http://localhost:8790/vulnerabilities/CVE-2026-96951 URL:http://localhost:8790/vulnerabilities/CVE-2026-96951 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-0322@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261017 DTEND;VALUE=DATE:20261018 SUMMARY:KEV due: CVE-2026-0322 — A remote code execution (RCE) vulnerabil ity in the management interface of Palo… DESCRIPTION:A remote code execution (RCE) vulnerability in the management i nterface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privilege s on the firewall. The security risk posed by this issue is minimized by r estricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how- to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is a pplicable to PAN-OS software on PA-Series and VM-Series firewalls and on P anorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not imp acted by this vulnerability. Added to CISA's catalog 2026-10-14. http://lo calhost:8790/vulnerabilities/CVE-2026-0322 URL:http://localhost:8790/vulnerabilities/CVE-2026-0322 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-105133@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261017 DTEND;VALUE=DATE:20261018 SUMMARY:KEV due: CVE-2026-105133 — A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This … DESCRIPTION:A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/ 10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs /api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be use d. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this i ssue. It is recommended to upgrade the affected component. The initial pat ch did not fix the security vulnerability properly. An update of the CVE e ntry to reflect this became necessary. Added to CISA's catalog 2026-10-14. http://localhost:8790/vulnerabilities/CVE-2026-105133 URL:http://localhost:8790/vulnerabilities/CVE-2026-105133 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-105134@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261017 DTEND;VALUE=DATE:20261018 SUMMARY:KEV due: CVE-2026-105134 — A flaw has been found in Ahsay AhsayCB S up to 9.15.2.69/10.3.4.44. This vulnera… DESCRIPTION:A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4. 44. This vulnerability affects unknown code of the file /rps/api/json/Upda teReceivers.do of the component Replication Receiver. Executing a manipula tion of the argument random can lead to os command injection. It is possib le to launch the attack remotely. The exploit has been published and may b e used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve th is issue. Upgrading the affected component is advised. The initial patch d id not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary. Added to CISA's catalog 2026-10-14. htt p://localhost:8790/vulnerabilities/CVE-2026-105134 URL:http://localhost:8790/vulnerabilities/CVE-2026-105134 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-76519@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261017 DTEND;VALUE=DATE:20261018 SUMMARY:KEV due: CVE-2026-76519 — A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secur… DESCRIPTION:A vulnerability in the Advanced Malware Protection (AMP) featur e of Cisco Secure Email Gateway could allow an unauthenticated\, remote at tacker to write arbitrary files on the underlying operating system. This v ulnerability is due to improper handling of email attachments when the fil e reputation service is enabled. An attacker could exploit this vulnerabil ity by sending an email that contains a crafted attachment through an affe cted device. A successful exploit could allow the attacker to write arbitr ary files and execute commands with \;root privileges on the underlyin g operating system. Added to CISA's catalog 2026-10-14. http://localhost:8 790/vulnerabilities/CVE-2026-76519 URL:http://localhost:8790/vulnerabilities/CVE-2026-76519 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-21589@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261018 DTEND;VALUE=DATE:20261019 SUMMARY:KEV due: CVE-2026-21589 — This is a vulnerability in Bitbucket Da ta Center\, Confluence Data Center\, Jira … DESCRIPTION:This is a vulnerability in Bitbucket Data Center\, Confluence D ata Center\, Jira Service Management Data Center\, Jira Software Data Cent er\, Bamboo Data Center. Crowd Data Center\, Crucible and Fisheye. This Ar bitrary File Access vulnerability allows an unauthenticated attacker to ac cess specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path\; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations\, there may be some sen sitive files that make this highly severe. This vulnerability allows an un authenticated remote attacker to access specific files within the web appl ication root directory in affected versions. The vulnerability must be add ressed for affected versions of: -- Bitbucket Data Center\, introduced in version >= 4.6.0\, fix versions: 9.4.26\, 10.2.8\, 10.5.1 -- Confluence Da ta Center\, introduced in version >= 5.10.0\, fix versions 9.2.26\, 10.2.1 9 -- Crowd Data Center\, introduced in version >= 2.11.0\, fix versions 6. 3.7\, 7.0.3\, 7.1.7\, 7.2.4 -- Jira Software Data Center\, introduced in v ersion >= 7.1.0\, fix versions 9.12.40\, 10.3.26\, 11.3.12 -- Jira Service Management Data Center\, introduced in version >= 3.1.0\, fix versions 5. 12.40\, 10.3.26\, 11.3.12 -- Bamboo Data Center >= 7.0.1\, fix versions 10 .2.24\, 12.1.12 -- Crucible\, fix versions 4.9.15 -- Fisheye\, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exac t name and path. The vulnerability does not include the capability to enum erate or list directory contents. Added to CISA's catalog 2026-10-15. http ://localhost:8790/vulnerabilities/CVE-2026-21589 URL:http://localhost:8790/vulnerabilities/CVE-2026-21589 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2025-61624@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261019 DTEND;VALUE=DATE:20261020 SUMMARY:KEV due: CVE-2025-61624 — An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal… DESCRIPTION:An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 throug h 7.6.4\, FortiOS 7.4.0 through 7.4.9\, FortiOS 7.2 all versions\, FortiOS 7.0 all versions\, FortiOS 6.4 all versions\, FortiPAM 1.7.0\, FortiPAM 1 .6 all versions\, FortiPAM 1.5 all versions\, FortiPAM 1.4 all versions\, FortiPAM 1.3 all versions\, FortiPAM 1.2 all versions\, FortiPAM 1.1 all v ersions\, FortiPAM 1.0 all versions\, FortiProxy 7.6.0 through 7.6.4\, For tiProxy 7.4.0 through 7.4.11\, FortiProxy 7.2 all versions\, FortiProxy 7. 0 all versions\, FortiSwitchManager 7.2.0 through 7.2.7\, FortiSwitchManag er 7.0.0 through 7.0.6 may allow an authenticated attacker with admin prof ile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA's catalog 2026-10-16. http://loc alhost:8790/vulnerabilities/CVE-2025-61624 URL:http://localhost:8790/vulnerabilities/CVE-2025-61624 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-102764@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261019 DTEND;VALUE=DATE:20261020 SUMMARY:KEV due: CVE-2026-102764 — The vulnerability exists within intern al components of BeyondTrust’s Remote Sup… DESCRIPTION:The vulnerability exists within internal components of BeyondTr ust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions\, this could allow an attacker to perform file operations on the appliance. Adde d to CISA's catalog 2026-10-16. http://localhost:8790/vulnerabilities/CVE- 2026-102764 URL:http://localhost:8790/vulnerabilities/CVE-2026-102764 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-106931@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261023 DTEND;VALUE=DATE:20261024 SUMMARY:KEV due: CVE-2026-106931 — SiteGuard Server Edition contains an O S command injection vulnerability\, which … DESCRIPTION:SiteGuard Server Edition contains an OS command injection vulne rability\, which may allow an attacker to execute arbitrary OS commands wi th root or SYSTEM privileges on the system running the affected product. A dded to CISA's catalog 2026-10-20. http://localhost:8790/vulnerabilities/C VE-2026-106931 URL:http://localhost:8790/vulnerabilities/CVE-2026-106931 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-96654@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261023 DTEND;VALUE=DATE:20261024 SUMMARY:KEV due: CVE-2026-96654 — Plex Media Server before 1.43.3.10861 d oes not correctly neutralize URL values … DESCRIPTION:Plex Media Server before 1.43.3.10861 does not correctly neutra lize URL values included in 'searchOne\,' allowing an attacker to call oth er plugins' functions and supply their own parameters. Added to CISA's cat alog 2026-10-20. http://localhost:8790/vulnerabilities/CVE-2026-96654 URL:http://localhost:8790/vulnerabilities/CVE-2026-96654 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-96656@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261023 DTEND;VALUE=DATE:20261024 SUMMARY:KEV due: CVE-2026-96656 — Plex Media Server before 1.43.3.10861 a llows an admin user to write arbitrary f… DESCRIPTION:Plex Media Server before 1.43.3.10861 allows an admin user to w rite arbitrary files that may be executed on load. The preference Transcod erH264Options is appended verbatim to x264's option string on every transc ode. At startup\, all .so files are run without signature\, execute bit\, or symbol checks. Added to CISA's catalog 2026-10-20. http://localhost:879 0/vulnerabilities/CVE-2026-96656 URL:http://localhost:8790/vulnerabilities/CVE-2026-96656 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-110447@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261026 DTEND;VALUE=DATE:20261027 SUMMARY:KEV due: CVE-2026-110447 — Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode)\, a Ne… DESCRIPTION:Collabora Online Built-in CODE Server before 26.4.303 (richdocu mentscode)\, a Nextcloud app\, allows remote code execution\, as exploited in the wild in September and October 2026\, a different vulnerability tha n CVE-2025-66208. This is an OS command injection in proxy.php when the CO DE server isn't running (e.g.\, the product was recently restarted). The v ulnerability is not present in standalone Collabora Online servers\; only this deployment with CODE Server is affected. Added to CISA's catalog 2026 -10-23. http://localhost:8790/vulnerabilities/CVE-2026-110447 URL:http://localhost:8790/vulnerabilities/CVE-2026-110447 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-114625@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261026 DTEND;VALUE=DATE:20261027 SUMMARY:KEV due: CVE-2026-114625 — VeloCloud Orchestrator (VCO) on-prem h as a security issue where this issue may … DESCRIPTION:VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal func tionality and impact the VCO host. Successful exploitation may compromise the confidentiality\, integrity\, and availability of the orchestrator and data managed by the orchestrator. On an affected system\, any authenticat ed user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Ho sted\, including Dedicated\, versions of VCO were impacted and have alread y been patched. Added to CISA's catalog 2026-10-23. http://localhost:8790/ vulnerabilities/CVE-2026-114625 URL:http://localhost:8790/vulnerabilities/CVE-2026-114625 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-109618@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261029 DTEND;VALUE=DATE:20261030 SUMMARY:KEV due: CVE-2026-109618 — PHP uses longjmp() for out-of-memory ( OOM) errors to exit the current context a… DESCRIPTION:PHP uses longjmp() for out-of-memory (OOM) errors to exit the c urrent context and abort handling of the request. Some contexts may not pr operly account for this scenario and leave request memory in an uninitiali zed state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can c onsistently trigger this condition and lead to remote code execution (RCE) . Added to CISA's catalog 2026-10-26. http://localhost:8790/vulnerabilitie s/CVE-2026-109618 URL:http://localhost:8790/vulnerabilities/CVE-2026-109618 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-109619@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261029 DTEND;VALUE=DATE:20261030 SUMMARY:KEV due: CVE-2026-109619 — PHP has various global state that temp orarily points into request memory. In so… DESCRIPTION:PHP has various global state that temporarily points into reque st memory. In some scenarios\, global state may not be correctly reset\, o r may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple st rategies can trigger this condition and produce remote code execution (RCE ). Added to CISA's catalog 2026-10-26. http://localhost:8790/vulnerabiliti es/CVE-2026-109619 URL:http://localhost:8790/vulnerabilities/CVE-2026-109619 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-110936@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261103 DTEND;VALUE=DATE:20261104 SUMMARY:KEV due: CVE-2026-110936 — A vulnerability has been identified in Siemens Software Center (All versions < … DESCRIPTION:A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link lib raries (DLLs) from an uncontrolled search path. This could allow an authen ticated local attacker to place a specially crafted DLL in a directory tha t the application searches\, leading to arbitrary code execution with the privileges of the affected application. Added to CISA's catalog 2026-10-20 . http://localhost:8790/vulnerabilities/CVE-2026-110936 URL:http://localhost:8790/vulnerabilities/CVE-2026-110936 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-96652@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261103 DTEND;VALUE=DATE:20261104 SUMMARY:KEV due: CVE-2026-96652 — Plex Media Server before 1.43.3.10861 a llows SSRF via '/player/timeline'. An at… DESCRIPTION:Plex Media Server before 1.43.3.10861 allows SSRF via '/player/ timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the atta cker's chosen destination. Added to CISA's catalog 2026-10-20. http://loca lhost:8790/vulnerabilities/CVE-2026-96652 URL:http://localhost:8790/vulnerabilities/CVE-2026-96652 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-96655@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261103 DTEND;VALUE=DATE:20261104 SUMMARY:KEV due: CVE-2026-96655 — Plex Media Server before 1.43.3.10861 a llows an authenticated user to request a… DESCRIPTION:Plex Media Server before 1.43.3.10861 allows an authenticated u ser to request arbitrary internal or external addresses via the '/video/:/ transcode/universal' path parameter. Added to CISA's catalog 2026-10-20. h ttp://localhost:8790/vulnerabilities/CVE-2026-96655 URL:http://localhost:8790/vulnerabilities/CVE-2026-96655 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-111497@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261110 DTEND;VALUE=DATE:20261111 SUMMARY:KEV due: CVE-2026-111497 — A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Googl… DESCRIPTION:A buffer overflow vulnerability in the Brotli decoder (c/dec/de code.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms all ows a remote unauthenticated attacker to corrupt adjacent decoder state me mory\, disclose sensitive memory contents\, cause a denial of service\, or potentially execute arbitrary code using a crafted Brotli-compressed stre am. Users need to update any Brotli libraries or binaries between 1.0.3 th rough 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Add ed to CISA's catalog 2026-10-27. http://localhost:8790/vulnerabilities/CVE -2026-111497 URL:http://localhost:8790/vulnerabilities/CVE-2026-111497 END:VEVENT BEGIN:VEVENT UID:kev-CVE-2026-48356@baselinewatch DTSTAMP:20261028T193454Z DTSTART;VALUE=DATE:20261110 DTEND;VALUE=DATE:20261111 SUMMARY:KEV due: CVE-2026-48356 — Adobe Commerce is affected by an Unrest ricted Upload of File with Dangerous Typ… DESCRIPTION:Adobe Commerce is affected by an Unrestricted Upload of File wi th Dangerous Type vulnerability that could result in arbitrary code execut ion in the context of the current user\, potentially gaining elevated acce ss or control over the victim's account or session. Exploitation of this i ssue requires user interaction in that a victim must visit a maliciously c rafted URL or interact with a compromised web page. Scope is changed. Adde d to CISA's catalog 2026-10-27. http://localhost:8790/vulnerabilities/CVE- 2026-48356 URL:http://localhost:8790/vulnerabilities/CVE-2026-48356 END:VEVENT END:VCALENDAR