ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 3h Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 6h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 9h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 9h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 10h Vulnerabilitas in software Sparx Systems Enterprise Architect · 10h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 10h Vulnerabilitates in Slican telephonis · 11h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 14h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 15h ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 3h Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 6h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 9h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 9h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 10h Vulnerabilitas in software Sparx Systems Enterprise Architect · 10h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 10h Vulnerabilitates in Slican telephonis · 11h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 14h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 15h

ACyber Sentinel Turma Aestimationis Securitatis

← Redire

⚠️ Renuntiatio Vulnerabilitatis

CVE-2026-106042

CRITICAL CVSS 9.9 CVSS 3.1 📌 Received

CVE-2026-106042 - Ivanti Xtraction External Control of File Name or Path Vulnerability

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.

Publicatum: Oct 13, 2026 17:17

Ultima Mutatio: Oct 13, 2026 17:17