Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-18577KEVexploit | 8.2 high | 15.0% | n-able, n-central | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | Fri 23 Oct |
| CVE-2026-18556KEVexploit | 8.2 high | 8.0% | n-able, n-central | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1. | Fri 23 Oct |
| CVE-2025-11700exploit | 8.4 high | 32.0% | n-able, n-central | N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure | Fri 23 Oct |
| CVE-2025-11367 | 10.0 critical | 1.0% | n-able, n-central | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization | Fri 23 Oct |
| CVE-2025-11366 | 9.4 critical | 1.0% | n-able, n-central | N-central < 2025.4 is vulnerable to authentication bypass via path traversal | Fri 23 Oct |
| CVE-2026-15580 | 6.9 medium | 0.00% | no CPE yet | vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6. | 15 Oct |
| CVE-2025-68624 | 4.3 medium | 0.00% | no CPE yet | N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding. | 14 Oct |
7 of 7
Download these 7 as CSV · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-28 22:21. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.