{"items":[{"id":"CVE-2026-65639","published":"2026-09-10T16:24:52.871Z","updated":"2026-09-10T18:19:47.504Z","title":"OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to…","severity":"CRITICAL","score":9.5,"vendor":"WebPros","product":"ConfigServer Security & Firewall","kev":false,"epss":0.01419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65638","published":"2026-09-10T16:24:52.785Z","updated":"2026-09-10T18:19:18.373Z","title":"Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF…","severity":"CRITICAL","score":9.2,"vendor":"WebPros","product":"ConfigServer Security & Firewall","kev":false,"epss":0.0233,"kevAdded":null,"exploit":false},{"id":"CVE-2026-67402","published":"2026-09-03T23:57:15.878Z","updated":"2026-09-04T19:47:36.330Z","title":"An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote…","severity":"CRITICAL","score":9.2,"vendor":"WebPros","product":"ConfigServer Security & Firewall","kev":false,"epss":0.00544,"kevAdded":null,"exploit":false}]}