CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-04-20 (6)

2026-04-20 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-04-20

6 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-33557 — 9.1 — A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. …
  • CVE-2025-2749 — 0.0 — Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations. [KEV]
  • CVE-2023-27351 — 0.0 — PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class. [KEV]
  • CVE-2025-48700 — 0.0 — Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to s… [KEV]
  • CVE-2025-32975 — 0.0 — Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials. [KEV]
  • CVE-2024-27199 — 0.0 — JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. [KEV]

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.