The
Reassessment
Feed.

⌕

All — ↑ Upgraded — ↓ Downgraded — = Unchanged —

Sort

All reassessments—

showing 1–20 of 2,244

2026-10-29

CVE-2026-111357

CWE-829

Ivanti Connect Secure dsinvoked untrusted DSCache privilege escalation to root

Proven zero-day chain to root on your VPN appliance; patch released yesterday, adopt now.

HIGH 7.0 → ↑ CRITICAL

Apereo openEQUELLA scripting engine unrestricted OS command execution via system.execute()

Script-editing admins can run OS commands on the host. HIGH risk, but the privilege gate and niche footprint narrow the real threat.

Yamaha NWR100 Wireless LAN Router pre-auth OS command injection via crafted HTTP request

Pre-auth RCE on a SOHO router, but LAN-only by default — not the internet-facing 9.8 the CVSS implies.

CRITICAL 9.8 → ↓ HIGH

MCP Python SDK server bearer-token authentication audience confusion via missing resource validation

Token audience confusion in MCP SDK is real but narrow — most deployments aren't exposed.

MEDIUM 6.8 → = MEDIUM

Linux kernel IPv4 TCP SYN handling use-after-free via RCU-unsafe inet_opt freeing

Kernel TCP UAF is remote and real, but the race condition makes 9.8 a fantasy score.

CRITICAL 9.8 → ↓ HIGH

VMware ESX insufficient logging allowing unaudited administrator operations

Nation-state logging bypass on a hypervisor is worse than CVSS 2.7, but it still needs stolen admin creds first.

Linux kernel skbuff shared-frag marker loss enabling ESP page-cache corruption

Deterministic kernel root from any shell. Metasploit-ready, KEV-listed, no race needed. Patch or block ESP now.

D-Link DIR-505 Web Management CGI hidden maintenance backdoor via secmark1524.cgi

Real backdoor, dead product. Replace the DIR-505; do not waste a patch cycle on a 2012 travel router.

Jenkins XStream deserialization filter bypass via resolves-to attribute

Jenkins XStream filter bypass lets any config-level user achieve RCE on the CI/CD controller — patch to 2.588 now

HIGH 8.8 → ↑ CRITICAL

Cisco ASA/FTD SSL VPN secondary auth NULL pointer dereference DoS

The MFA you added to harden VPN is exactly what lets attackers crash your firewall with one packet

Adobe Connect Desktop App client-side code injection via crafted URL

Client-side RCE via crafted URL in a niche meeting app — painful but not fleet-scale.

CRITICAL 9.6 → ↓ HIGH

Adobe Campaign Classic server-side code injection via authenticated SOAP endpoint

Authenticated ACC users can break out to OS-level code execution; patch within 30 days.

CRITICAL 9.9 → ↓ HIGH

Veeam Backup & Replication CDP Coordinator Service unauthenticated authorization bypass via fail-open error handling

Unauthenticated auth bypass on Veeam's CDP Coordinator fails open — backup infrastructure at risk

CRITICAL 9.1 → ↓ HIGH

Windows HTTP.sys QUIC parsing out-of-bounds read denial of service

Kernel-mode DoS with no PoC or exploitation drops HTTP.sys from HIGH to MEDIUM for now

EPICS Base Channel Access RSRV pre-auth integer overflow in network request size calculation

Pre-auth RCE in ICS/SCADA controller software — if you run EPICS, this is an emergency patch.

CRITICAL 9.8 → = CRITICAL

IBM i Host-Based Printer Subsystem missing authorization information disclosure

IBM i printer auth bypass leaks files but requires internal access and high complexity

MEDIUM 4.8 → = MEDIUM

Adobe Commerce and Magento Open Source guest cart REST API unrestricted file upload (PolyShell)

Unauthenticated webshell upload actively mass-exploited since March; patch or block immediately

CRITICAL 9.3 → = CRITICAL

Google Brotli decoder out-of-bounds write via unchecked block type switch

KEV-listed Brotli decoder OOB write hits Node.js, Python, Envoy, curl — block br encoding or patch now

Splunk Enterprise PostgreSQL sidecar pre-auth arbitrary file write via unauthenticated recovery endpoint

Pre-auth RCE on your SIEM — the fox guards the henhouse and the door is unlocked.

CRITICAL 9.8 → = CRITICAL

NVIDIA NeMo Agent Toolkit MCP server missing authentication for critical function

CVSS 10 on paper, but default localhost binding and niche install base drop real-world risk to HIGH.

CRITICAL 10.0 → ↓ HIGH

›

TheReassessmentFeed.

The
Reassessment
Feed.