Emerging BETA · EXPERIMENTAL RSS ↗
Emerging is a BETA feed that watches a curated set of trusted security-news outlets and links what they report to the 649 products IsItPatched tracks — often ahead of full NVD enrichment. Every item is attributed to its source and links out; IsItPatched never asserts its own findings here. Right now it surfaces 120 machine-linked reports, 26 describing active exploitation.
⚠ Items are machine-linked third-party reporting and may be wrong. Each shows its source and links out — we never assert our own findings here. Treat low-confidence items as leads, and always verify against the source and the vendor advisory.
120
linked reports · last 45 days
26
describing active exploitation
103
CVEs referenced
See news about the software you run Add your products to My Stack and Emerging flags reporting that hits them — a violet node on the graph, “you run this” on the feed.
Open My Stack → Sign in free → Thursday 17 September
CVE-2026-55039 Microsoft Excel Remote Code Execution Vulnerability
CVE-2026-66809 Microsoft Office Graphics Component Information Disclosure Vulnerability
CVE-2026-62819 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2026-68794 Microsoft Excel Remote Code Execution Vulnerability
No items match.
Unlock the full newsroom — free 115 more linked reports, the live Connections graph, filters, and “you run this” flags on software in your stack.
Sign in free → or RSS ↗ CVE-2026-69724 Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-81957 Microsoft Excel Remote Code Execution Vulnerability
CVE-2026-33835 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Windows 11 24H2 Home and Pro reach end of support in October
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspaces
Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks
One Compromised Kubernetes Node Can Expose Every Workload Identity Running on It
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
ZDI-26-714: Samsung rlottie Stack-based Buffer Overflow Remote Code Execution Vulnerability
Windows 11 KB5124008 update breaks domain trust for some users
Cisco Identity Services Engine Remote Code Execution Vulnerabilities
Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities
Cisco Identity Services Engine Vulnerabilities
Cisco Identity Services Engine RADIUS Denial of Service Vulnerability
Cisco Identity Services Engine 802.1X Session Hijack and Information Disclosure Vulnerabilities
Cisco Identity Services Engine Hardening Release: September 2026
Cisco Identity Services Engine Multiple Path Traversal Vulnerabilities
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
Cisco Identity Services Engine Command Injection Vulnerabilities
Cisco Identity Services Engine Authentication Bypass Vulnerability
Cisco Identity Services Engine Authorization Bypass Vulnerabilities
Cisco Identity Services Engine Authentication Bypass Vulnerabilities
Cisco Identity Services Engine SQL and HQL Injection Vulnerabilities
Cisco Identity Services Engine SQL Injection Vulnerabilities
Cisco Identity Services Engine Information Disclosure Vulnerability
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Microsoft says Copilot buttons still missing in classic Outlook
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Critical ScreenConnect flaw now actively exploited in attacks
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
ZDI-26-713: GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-707: (0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
ZDI-26-706: (0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability
ZDI-26-705: (0Day) BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability
ZDI-26-704: (0Day) Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
ZDI-26-703: (0Day) Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)
Cisco IOS XR Software Security Hardening Release: September 2026
CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild
Siemens Reyrolle 7SR5
CareCam CM2507
Wärtsilä FOS-Onboard
Siemens Mendix SAML
mySCADA myPRO Manager
Digital Watchdog VMAX DVR and NVR Product Lineups
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
Maximum Severity GitLab Flaw Puts Supply Chains at Risk
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026
Cisco Secure Email Gateway SQL Injection Vulnerability
Perfect-10 GitLab bug under attack days after patch lands
CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
ZDI-26-702: Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability
ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI-26-700: Linux Kernel QFQ Plus Scheduler Use-After-Free Local Privilege Escalation Vulnerability
ZDI-26-699: Linux Kernel NTFS3 Out-of-Bounds Read Information Disclosure Vulnerability
ZDI-26-698: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI-26-697: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
CVE-2026-0295 GlobalProtect App: Local Privilege Escalation via Race Condition on macOS (Severity: MEDIUM)
CVE-2026-0250 GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway (Severity: MEDIUM)
CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP) (Severity: MEDIUM)
CVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)
CVE-2026-0297 GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake (Severity: MEDIUM)
CVE-2026-0296 GlobalProtect App: Improper Certificate Validation Bypass Vulnerability (Severity: MEDIUM)
More JFrog Artifactory bugs under attack, and all 3 have patches
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
Metasploit Wrap Up: This One Goes to Sixteen!
CISA Adds Three Known Exploited Vulnerabilities to Catalog
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Indonesia Hit by Android Banking App-Cloning Campaign
AVEVA Pipeline Integrity Monitor
Orthanc DICOM Server
ST Engineering iDirect iQ-Series Terminals (Update A)
NextGen Healthcare Mirth Connect
GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
Serial Microsoft 0-day hunter drops yet another Defender exploit
CVE-2026-0305 Prisma Access Agent: Information Disclosure Vulnerability on Linux (Severity: MEDIUM)
CVE-2026-0310 PAN-OS: Buffer Overflow Vulnerability via XML Processing (Severity: HIGH)
CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (Severity: LOW)
CVE-2026-0304 Cortex XDR Broker VM: Privilege Escalation Vulnerability (Severity: MEDIUM)
CVE-2026-0309 PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration (Severity: MEDIUM)
CVE-2026-0306 Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows (Severity: MEDIUM)
CVE-2026-0303 Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File (Severity: LOW)
CVE-2026-0302 Checkov by Prisma Cloud: OS Command Injection Vulnerability (Severity: LOW)
CISA Adds Four Known Exploited Vulnerabilities to Catalog
Microsoft breaks Patch Tuesday record with 974-CVE deluge
CareCam Pro IP Cameras
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Cron Job Injection in Remote Backup
Improper Authentication of FortiPAM Server
Rockwell Automation 1756-ENBT Module
Tycon Systems TPDIN-Monitor-WEB2 (Update A)
OPCFoundation OPC UA LocalDiscoveryServer (LDS)
Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users
Attackers Pounce on Critical Artifactory Bug Following Disclosure
Critical Langflow Vulnerability Exploited as Attacks on AI Platform Rise
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
CVE-2026-0251 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: HIGH)
How this week’s reporting connects — 25 products, 42 CVEs and 13 sources. Lines are attributed links from the items above; positions are illustrative. Tap a node to open it. Violet = software in your stack.
In your stack Product CVE CVE (exploited) Source
Prefer the list? Switch back to . The graph is a visual aid; the timeline above carries every item with full attribution.
About this BETA
Emerging ingests only a hard-coded allow-list of trusted outlets — first-party vendor advisories (Microsoft MSRC, Cisco PSIRT, Fortinet, Palo Alto, Ivanti), security research (Google Project Zero, Rapid7, Qualys) and established reporting (CISA, Krebs on Security, BleepingComputer, The Hacker News, SecurityWeek, Dark Reading, The Register) — no open-web crawl, no social feeds, no user submissions. We store and show only a headline, the source, the time, an outbound link and (where available) a short own-words takeaway — never article text. Links between a report and a product or CVE are made by software and carry a confidence level; they can be wrong. This is an early experiment in linking breaking reporting to the software you actually run — tell us when we get a link wrong →.
Newest first · refreshes on every sync · sources retain all rights to their reporting. See our disclaimer.