The
Reassessment
Feed.

⌕

All — ↑ Upgraded — ↓ Downgraded — = Unchanged —

Sort

All reassessments—

showing 1–20 of 2,221

2026-10-27

CVE-2026-10520

CWE-78

Ivanti Sentry MICS API unauthenticated OS command injection via handleMessage endpoint

One curl command, no creds, root shell on your mobile gateway. Patch now.

CRITICAL 10.0 → = CRITICAL

Splunk Enterprise PostgreSQL sidecar pre-auth arbitrary file write to RCE via recovery endpoint

Pre-auth RCE in your SIEM: the watchtower just handed out its own keys.

CRITICAL 9.8 → = CRITICAL

Ubiquiti UniFi OS NGINX auth gate path traversal via percent-encoded URI normalization mismatch

Unauth path traversal on your network gateway is as bad as it sounds. Patch now or lose the perimeter.

CRITICAL 10.0 → = CRITICAL

Microsoft AD FS Distributed Key Manager container ACL privilege escalation enabling Golden SAML

AD FS DKM ACL flaw hands domain users the keys to forge tokens for every federated app.

HIGH 7.8 → ↑ CRITICAL

KNX Protocol Connection Authorization Option 1 BCU key lockout denial of service

Actively exploited OT lockout: attackers permanently brick KNX building devices with no software fix.

Fortinet FortiSandbox pre-auth OS command injection via tracer-behavior jid parameter

Pre-auth root RCE on a security appliance with active exploitation — patch now.

CRITICAL 9.8 → = CRITICAL

PHP core cross-request use-after-free via stale global state in worker processes

Pre-auth PHP use-after-free with active exploitation and EPSS 0.99997 — patch NOW.

HIGH 8.1 → ↑ CRITICAL

PHP core use-after-free via longjmp OOM bailout in session upload progress handler

Unauthenticated pre-auth RCE in PHP core, actively exploited in the wild, patch now.

CRITICAL 9.8 → = CRITICAL

Rust zip2 crate Zip Cloaking via Central/Local File Header filename divergence

Zip Cloaking bypasses scanners and overwrites files via Rust zip crate streaming extraction

CRITICAL 10.0 → ↓ HIGH

Wasmtime Cranelift aarch64 br_table miscompilation sandbox escape via offset wrap

Sandbox escape in Wasmtime on ARM64 — if you run untrusted Wasm on Graviton, patch now.

CRITICAL 9.9 → = CRITICAL

Wasmtime Cranelift compiler SSA index bit-packing overflow enabling sandbox escape

Wasmtime sandbox escape via Cranelift integer overflow — CRITICAL for any host running untrusted Wasm

CRITICAL 9.9 → = CRITICAL

Adobe Commerce guest-cart REST API unrestricted polyglot file upload (PolyShell)

PolyShell is as bad as it sounds: unauthenticated RCE on every Magento store, actively exploited at scale

CRITICAL 9.3 → = CRITICAL

Microsoft .NET SocketAsyncEventArgs IPv4/IPv6 datagram reuse out-of-bounds write

Windows-only .NET UDP socket memory corruption: real RCE risk, but narrow code path keeps most fleets safe.

ASP.NET Core Blazor WebAssembly debug proxy code injection via unescaped expression evaluation

Dev-tooling vuln in Blazor WASM debug proxy; only fires during active debug sessions with poisoned data

Fortinet FortiSandbox pre-auth OS command injection via VNC web UI endpoint

Unauthenticated RCE in FortiSandbox poisons the trust chain for your entire Fortinet fabric.

CRITICAL 9.8 → = CRITICAL

Time4Popcorn auto-updater unsigned HTTP code execution via lapsed domain hijack

Abandoned piracy app updater gives SYSTEM/root to anyone who registers a lapsed domain, but 98% already neutered.

CRITICAL 9.8 → ↓ MEDIUM

Microsoft SharePoint Server pre-auth BinaryFormatter deserialization remote code execution

Pre-auth RCE in SharePoint, zero-day exploited, direct path to domain compromise. Patch now.

CRITICAL 9.8 → = CRITICAL

WordPress Core WP_Query author__not_in facilitated SQL injection via REST API

Vendor says MEDIUM; attackers say pre-auth RCE. 45M exploit attempts in week one.

MEDIUM 5.9 → ↑ CRITICAL

WordPress Core REST API batch endpoint route confusion enabling unauthenticated RCE chain

Pre-auth WordPress RCE on default installs. Zero friction. Patch now or get owned.

CRITICAL 9.8 → = CRITICAL

DD-WRT UPnP SSDP M-SEARCH stack-based buffer overflow via oversized ST:uuid: value

Actively botnetted DD-WRT stack smash — disable UPnP immediately if you run this firmware

HIGH 8.1 → = HIGH

EPSS 0.04 KEV

›

TheReassessmentFeed.

The
Reassessment
Feed.