tag:myipscan.net,2026:changes MyIPScan changes Exploited router and firewall flaws, VPN incidents and VPN audits, from MyIPScan's sourced data 2026-10-16T00:00:00Z MyIPScanhttps://myipscan.net/ CC BY 4.0 tag:myipscan.net,2026:kev:CVE-2025-61624 CISA lists CVE-2025-61624 as exploited: Fortinet Multiple Products Path Traversal Vulnerability 2026-10-16T00:00:00Z FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. tag:myipscan.net,2026:kev:CVE-2026-0322 CISA lists CVE-2026-0322 as exploited: Palo Alto Networks PAN-OS Code Injection Vulnerability 2026-10-14T00:00:00Z Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. tag:myipscan.net,2026:kev:CVE-2026-104935 CISA lists CVE-2026-104935 as exploited: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability 2026-10-13T00:00:00Z Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. tag:myipscan.net,2026:kev:CVE-2026-88779 CISA lists CVE-2026-88779 as exploited: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability 2026-10-04T00:00:00Z Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. tag:myipscan.net,2026:kev:CVE-2026-88772 CISA lists CVE-2026-88772 as exploited: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability 2026-09-27T00:00:00Z Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service tag:myipscan.net,2026:kev:CVE-2026-88771 CISA lists CVE-2026-88771 as exploited: Citrix NetScaler Improper Input Validation Vulnerability 2026-09-27T00:00:00Z Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. tag:myipscan.net,2026:kev:CVE-2026-67279 CISA lists CVE-2026-67279 as exploited: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability 2026-09-25T00:00:00Z Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. tag:myipscan.net,2026:kev:CVE-2026-94127 CISA lists CVE-2026-94127 as exploited: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability 2026-09-22T00:00:00Z F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. tag:myipscan.net,2026:kev:CVE-2026-85102 CISA lists CVE-2026-85102 as exploited: Check Point Multiple Products Improper Certificate Validation Vulnerability 2026-09-22T00:00:00Z Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. tag:myipscan.net,2026:kev:CVE-2026-86060 CISA lists CVE-2026-86060 as exploited: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability 2026-09-10T00:00:00Z MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. tag:myipscan.net,2026:kev:CVE-2026-67277 CISA lists CVE-2026-67277 as exploited: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability 2026-09-10T00:00:00Z MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. tag:myipscan.net,2026:kev:CVE-2026-19490 CISA lists CVE-2026-19490 as exploited: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability 2026-09-09T00:00:00Z Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. tag:myipscan.net,2026:kev:CVE-2025-25249 CISA lists CVE-2025-25249 as exploited: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability 2026-09-09T00:00:00Z Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. tag:myipscan.net,2026:kev:CVE-2026-83549 CISA lists CVE-2026-83549 as exploited: SonicWall SMA1000 Appliances OS Command Injection Vulnerability 2026-09-02T00:00:00Z SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. tag:myipscan.net,2026:kev:CVE-2026-83548 CISA lists CVE-2026-83548 as exploited: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability 2026-09-02T00:00:00Z SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. tag:myipscan.net,2026:kev:CVE-2026-8452 CISA lists CVE-2026-8452 as exploited: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability 2026-08-26T00:00:00Z Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. tag:myipscan.net,2026:kev:CVE-2026-20349 CISA lists CVE-2026-20349 as exploited: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability 2026-08-11T00:00:00Z Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. tag:myipscan.net,2026:kev:CVE-2025-68686 CISA lists CVE-2025-68686 as exploited: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability 2026-07-27T00:00:00Z Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. tag:myipscan.net,2026:kev:CVE-2026-15410 CISA lists CVE-2026-15410 as exploited: SonicWall SMA1000 Appliances Code Injection Vulnerability 2026-07-14T00:00:00Z SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. tag:myipscan.net,2026:kev:CVE-2026-15409 CISA lists CVE-2026-15409 as exploited: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability 2026-07-14T00:00:00Z SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. tag:myipscan.net,2026:vpn-incident:mysterium-vpn:2026-07-08:other Mysterium VPN: CVE-2026-31309: an unauthenticated request to Mysterium Node's /tequilapi/config/user endpoint could overwrite its configuration and take over the node (versions 1.21.1-rc0 to before 1.36.0) 2026-07-08T00:00:00Z CVE-2026-31309: an unauthenticated request to Mysterium Node's /tequilapi/config/user endpoint could overwrite its configuration and take over the node (versions 1.21.1-rc0 to before 1.36.0). tag:myipscan.net,2026:kev:CVE-2026-34910 CISA lists CVE-2026-34910 as exploited: Ubiquiti UniFi OS Improper Input Validation Vulnerability 2026-06-23T00:00:00Z Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection. tag:myipscan.net,2026:kev:CVE-2026-34909 CISA lists CVE-2026-34909 as exploited: Ubiquiti UniFi OS Path Traversal Vulnerability 2026-06-23T00:00:00Z Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account. tag:myipscan.net,2026:kev:CVE-2026-34908 CISA lists CVE-2026-34908 as exploited: Ubiquiti UniFi OS Improper Access Control Vulnerability 2026-06-23T00:00:00Z Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system. tag:myipscan.net,2026:kev:CVE-2026-50751 CISA lists CVE-2026-50751 as exploited: Check Point Security Gateway Improper Authentication Vulnerability 2026-06-08T00:00:00Z Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. tag:myipscan.net,2026:vpn-audit:mullvad:2026-06-01:Leviathan Security Mullvad audited by Leviathan Security 2026-06-01T00:00:00Z Android app 2026.2 against the App Defense Alliance MASA profile; black-box, no code review. tag:myipscan.net,2026:kev:CVE-2026-0257 CISA lists CVE-2026-0257 as exploited: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability 2026-05-29T00:00:00Z Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. tag:myipscan.net,2026:kev:CVE-2026-0300 CISA lists CVE-2026-0300 as exploited: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability 2026-05-06T00:00:00Z Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. tag:myipscan.net,2026:vpn-incident:norton-vpn:2026-05-04:other Norton VPN: CVE-2025-58074: a low-privilege user could replace files while Norton Secure VPN installs from the Microsoft Store, leading to file deletion and privilege escalation (Talos TALOS-2025-2276) 2026-05-04T00:00:00Z CVE-2025-58074: a low-privilege user could replace files while Norton Secure VPN installs from the Microsoft Store, leading to file deletion and privilege escalation (Talos TALOS-2025-2276). tag:myipscan.net,2026:vpn-audit:x-vpn:2026-04-30:Deloitte X-VPN audited by Deloitte 2026-04-30T00:00:00Z Deloitte Singapore, ISAE 3000 limited assurance on configuration and operations against the no-logs statements, as of 28 February 2026; two observations reported fixed. tag:myipscan.net,2026:kev:CVE-2025-29635 CISA lists CVE-2025-29635 as exploited: D-Link DIR-823X Command Injection Vulnerability 2026-04-24T00:00:00Z D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. tag:myipscan.net,2026:vpn-audit:malwarebytes-privacy-vpn:2026-04-02:X41 D-Sec Malwarebytes Privacy VPN audited by X41 D-Sec 2026-04-02T00:00:00Z Server infrastructure shared with AzireVPN: hardware and server-side software tag:myipscan.net,2026:kev:CVE-2026-3055 CISA lists CVE-2026-3055 as exploited: Citrix NetScaler Out-of-Bounds Read Vulnerability 2026-03-30T00:00:00Z Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread. tag:myipscan.net,2026:kev:CVE-2025-53521 CISA lists CVE-2025-53521 as exploited: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability 2026-03-27T00:00:00Z F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. tag:myipscan.net,2026:vpn-audit:mullvad:2026-03-06:Assured Mullvad audited by Assured 2026-03-06T00:00:00Z GotaTun 0.2.0, Mullvad's WireGuard implementation; DAITA, the CLI and external dependencies excluded. tag:myipscan.net,2026:vpn-incident:vpn-unlimited:2026-02-03:other VPN Unlimited: CVE-2020-37101: VPN Unlimited 6.1 for Windows installs its service under an unquoted path, allowing local privilege escalation 2026-02-03T00:00:00Z CVE-2020-37101: VPN Unlimited 6.1 for Windows installs its service under an unquoted path, allowing local privilege escalation. Found in 2020; NVD published it in February 2026. tag:myipscan.net,2026:kev:CVE-2026-24858 CISA lists CVE-2026-24858 as exploited: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability 2026-01-27T00:00:00Z Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. tag:myipscan.net,2026:vpn-audit:surfshark:2026-01-23:SecuRing Surfshark audited by SecuRing 2026-01-23T00:00:00Z Black-box penetration test of the network infrastructure, 1 to 10 December 2025. tag:myipscan.net,2026:vpn-audit:mullvad:2026-01-21:X41 D-Sec Mullvad audited by X41 D-Sec 2026-01-21T00:00:00Z White-box review of the account and payment API and backend; some findings redacted. tag:myipscan.net,2026:kev:CVE-2025-14733 CISA lists CVE-2025-14733 as exploited: WatchGuard Firebox Out of Bounds Write Vulnerability 2025-12-19T00:00:00Z WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. tag:myipscan.net,2026:kev:CVE-2025-40602 CISA lists CVE-2025-40602 as exploited: SonicWall SMA1000 Missing Authorization Vulnerability 2025-12-17T00:00:00Z SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. tag:myipscan.net,2026:kev:CVE-2025-59718 CISA lists CVE-2025-59718 as exploited: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability 2025-12-16T00:00:00Z Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches ment tag:myipscan.net,2026:vpn-incident:urban-vpn:2025-12-15:other Urban VPN: Koi Security reported that the Urban VPN Proxy extension and other Urban extensions capture prompts and replies on ten AI chat sites and send them to Urban's analytics servers, on by default 2025-12-15T00:00:00Z Koi Security reported that the Urban VPN Proxy extension and other Urban extensions capture prompts and replies on ten AI chat sites and send them to Urban's analytics servers, on by default. tag:myipscan.net,2026:vpn-audit:pia:2025-12-08:Deloitte Private Internet Access audited by Deloitte 2025-12-08T00:00:00Z Deloitte Audit Romania, ISAE 3000: server configuration as of 31 October 2025, including dedicated-IP tokens. tag:myipscan.net,2026:vpn-audit:cyberghost:2025-12-08:Deloitte CyberGhost audited by Deloitte 2025-12-08T00:00:00Z Deloitte Audit Romania, ISAE 3000 limited assurance: server network, configuration, change management, incident response and dedicated-IP tokens. Third review. tag:myipscan.net,2026:kev:CVE-2022-37055 CISA lists CVE-2022-37055 as exploited: D-Link Routers Buffer Overflow Vulnerability 2025-12-08T00:00:00Z D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. tag:myipscan.net,2026:vpn-audit:proton-vpn:2025-12-01:Ruben Santamarta Proton VPN audited by Ruben Santamarta 2025-12-01T00:00:00Z Security audits of the apps by an independent researcher; the date is when Proton's article was updated. tag:myipscan.net,2026:vpn-audit:tunnelbear:2025-11-24:Cure53 TunnelBear audited by Cure53 2025-11-24T00:00:00Z Eighth annual white-box audit, October to November 2024: apps, backend and server configuration, public APIs and encryption. tag:myipscan.net,2026:kev:CVE-2025-58034 CISA lists CVE-2025-58034 as exploited: Fortinet FortiWeb OS Command Injection Vulnerability 2025-11-18T00:00:00Z Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. tag:myipscan.net,2026:kev:CVE-2025-64446 CISA lists CVE-2025-64446 as exploited: Fortinet FortiWeb Path Traversal Vulnerability 2025-11-14T00:00:00Z Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.