Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-106042 | 9.9 critical | 1.0% | no CPE yet | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application. | 14 Oct |
| CVE-2026-8043 | 9.6 critical | 1.0% | ivanti, xtraction | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks. | Mon 26 Oct |
| CVE-2026-106047 | 7.7 high | 1.0% | no CPE yet | A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files. | 14 Oct |
| CVE-2026-106043 | 7.5 high | 1.0% | no CPE yet | A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site. | 14 Oct |
| CVE-2026-14903 | 6.5 medium | 1.0% | ivanti, xtraction | Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root. | Sat 24 Oct |
| CVE-2026-14902 | 6.1 medium | 1.0% | ivanti, xtraction | An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs. | Sat 24 Oct |
| CVE-2026-106035 | 5.5 medium | 0.00% | no CPE yet | An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log. | 14 Oct |
| CVE-2026-106034 | 5.0 medium | 0.00% | no CPE yet | A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system. | 14 Oct |
8 of 8
Download these 8 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.