Company
ZoomEye, run by Knownsec, is an internet-wide scanning search engine that indexes exposed devices and services, often used for security reconnaissance.
Citrix's critical NetScaler flaw CVE-2026-19490 is exploitable only on appliances running a Gateway or AAA virtual server role, a DEV Community analysis of the advisory says. The other August flaw depends on a different setting, so role sets the patch order.
Reality
CISA added CVE-2026-93616, a 9.8-rated Check Point management flaw, to its Known Exploited Vulnerabilities catalog on September 22, 2026. A dev.to write-up says no final patch covers every release yet, so port exposure is the control.
Reality
Port counts for 102, 502 and 44818 in a 22 September 2026 ZoomEye snapshot cannot be summed into one exposure figure, a dev.to analysis says. The totals are index entries for protocols with different vendor bases and risk profiles, so none of them is a count of vulnerable devices.
Reality
ZoomEye's Couchbase fingerprint matched 9,045 services reachable from the public internet on 24 September 2026. The query cannot say which Couchbase surface answered, so each team has to check its own inventory against the result.
Reality
ZoomEye's fingerprint query found 29,265 HashiCorp Vault management APIs answering from the public internet on 24 September 2026. A match proves only that an admin interface answers, so the useful check for each team is whether its own address is in the results.
Reality
Citrix shipped one NetScaler ADC and Gateway release that fixes eight flaws, two of them rated CVSS v4 9.5 and already exploited. Teams running their own appliances on older 13.1 or 14.1 builds should treat the upgrade as an emergency change.
Reality
GROWI, Inc. shipped GROWI 7.5.5 to close CVE-2026-100727, a flaw letting visitors with no account read files from non-public pages on local-upload wikis. Because the read needs no login, any reachable Local-mode instance on an older release is a patch-now item.
Reality
ZoomEye queries run on 27 September counted 4.9 million services answering on Redis's default port 6379, against 142 fingerprinted as Redis. The larger figure counts reachable listeners, a list owners can check against Redis's rule that the server stay on trusted networks.
Reality
Alluxio's S3 REST proxy skipped AWS signature checks by default, a flaw NVD scores 9.3 as CVE-2026-79787. An attacker needs only a network route to the port, so internal reachability decides which clusters are exposed until they upgrade.
Reality
FreeSWITCH shipped version 1.11.1 to fix CVE-2026-49841, a CVSS 9.8 heap overflow in mod_verto that an unauthenticated browser request can trigger. The read loop copies up to the client's declared Content-Length into a fixed 2 MiB buffer.
Reality
CISA added Kestra's unauthenticated code-execution flaw CVE-2026-49869, rated 10.0, to its exploited list on 2 September, three months after the fix. Orchestrators hold their workflows' credentials, so any reachable unpatched instance needs a compromise check as well as an upgrade.
Reality
ZoomEye queries on 22 September 2026 found 1,538 Jenkins, 169 Harbor and 32 SonarQube instances reachable from the internet. These tools hold deploy credentials by design, so every reachable instance is a possible route into production.
Reality
CISA says an integer underflow in MikroTik RouterOS web management gives an unauthenticated attacker root with one crafted request on versions below 7.24. No exploitation has been reported, but MikroTik's fix advice sets a 7.23 floor that CISA's own affected range still covers.
Perspective Coverage
3 publishersReality
CERT-BUND has rated 36 CVEs in 16 contributed Drupal projects high risk, and Drupal core is not listed as affected. Each site team has to check the modules it has installed against 19 fixed releases and confirm that the code serving requests actually changed.
Reality
DIVD says an attacker chained two unpublished Zammad bugs from an unauthenticated web session to root on its helpdesk host. Its claim that an autonomous AI agent did it is still a first-party assessment with no independent confirmation yet.
Reality
Automated exploit attempts hit MediaWiki's External Data extension within a day of the 25 September disclosure of CVE-2026-100382, a CVSS 10.0 flaw. Upgrading to 3.7 closes the entry point but leaves behind any PHP shell an attacker already wrote to disk.
Reality
Attackers using two NetScaler zero-days since early September left webshells that patching to 14.1-73.37 or 13.1-64.23 does not remove. Operators have to search every appliance for those traces, patched or not, and move OT remote access onto a jump host of its own.
Reality
Gunra affiliates get in through two FortiOS and FortiProxy authentication bypasses, CVE-2024-55591 and CVE-2025-24472, says a 10 August 2026 advisory. Its fix for exposed RDP routes remote access through that same class of appliance, so the gateway has to be secured before RDP moves behind it.
Reality
CVE-2026-65660, an exploited SharePoint Server code injection flaw rated 8.8, lets any user with a low-privilege login run code on the farm. Farms that admit vendors and contractors need to count who can sign in, alongside what faces the internet.
Reality
CERT-In bundled 14 ISC BIND CVEs, including cache-poisoning and zone-data modification flaws, under one HIGH rating on 21 September 2026. The batch suits one planned upgrade window, provided recursion and zone transfers are locked down until it runs.
Reality
Build · September 19, 2026 · Confirmed2 publishers
Build · August 19, 2026 · Confirmed2 publishers