{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T11:29:21.621Z", "changes": [ { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything.", "body": null, "sourceUrl": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC.", "body": null, "sourceUrl": "https://status.railway.com/", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation).", "body": null, "sourceUrl": "https://blog.railway.com/", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "CEO: builds ramping up overnight; full post-mortem promised.", "body": null, "sourceUrl": "https://x.com/JustJake/status/2113126674103722181", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis.", "body": null, "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" }, { "incident": "emudhra-intermediate-ca-compromise", "incidentTitle": "eMudhra intermediate CA private keys compromised", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs.", "body": null, "sourceUrl": "https://emudhra.we-have-a-problem.com/", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise" }, { "incident": "emudhra-intermediate-ca-compromise", "incidentTitle": "eMudhra intermediate CA private keys compromised", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/22/certification-authority-emudhra-defends-its-laughably-weak-private-keys/5304647", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise" }, { "incident": "connectwise-cloud-backup-m365-hijack", "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Microsoft details Storm-0940's Oct 10-14 password spray (151,000+ failed logons, peak 2,900/min) before the Oct 15 takeover of ConnectWise cloud app identities; ConnectWise says phased service restoration will take several days.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html", "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established.", "body": null, "sourceUrl": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands.", "body": null, "sourceUrl": "https://www.forum-nas.fr/threads/vuln%C3%A9rabilit%C3%A9s-dans-php-php2shell-affectant-plusieurs-produits-qnap.27227/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21.", "body": null, "sourceUrl": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "gitlab-cve-2026-110264-regex-rce", "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T11:39Z", "title": "Malicious 1.107.0 wheels appear on PyPI.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T11:39Z", "title": "Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC.", "body": null, "sourceUrl": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T13:23Z", "title": "PyPI quarantines/pulls the package (~2h window).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T14:20Z", "title": "Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T16:20Z", "title": "Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T20:30Z", "title": "LiteLLM posts containment update; investigation ongoing.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "nodejs-october-2026-security-releases", "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Node.js published the Wednesday security releases and advisory.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nodejs-october-2026-security-releases" }, { "incident": "nodejs-october-2026-security-releases", "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nodejs-october-2026-security-releases" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Public security disclosure; deployments paused; users told to rotate all env vars and registry credentials.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Status page: investigating issues; builds paused (07:24 UTC), then dashboard/API/CLI unavailable (11:33 UTC).", "body": null, "sourceUrl": "https://status.railway.com/", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "OAuth sessions invalidated as part of mitigation; users signed out (20:30 UTC).", "body": null, "sourceUrl": "https://status.railway.com/", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Railway posts 'urgent notice' on X; CEO says servers were compromised and urges key rotation (21:51-22:04 UTC).", "body": null, "sourceUrl": "https://x.com/Railway/status/2113025284148715845", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21 morning", "title": "Railway detects anomalous activity; investigates.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" }, { "incident": "emudhra-intermediate-ca-compromise", "incidentTitle": "eMudhra intermediate CA private keys compromised", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "eMudhra published statements; Node.js security release refreshed CA store.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise" }, { "incident": "emudhra-intermediate-ca-compromise", "incidentTitle": "eMudhra intermediate CA private keys compromised", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided.", "body": null, "sourceUrl": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise" }, { "incident": "emudhra-intermediate-ca-compromise", "incidentTitle": "eMudhra intermediate CA private keys compromised", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited.", "body": null, "sourceUrl": "https://x.com/ETNOWlive/status/2112914822019137966", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise" }, { "incident": "connectwise-cloud-backup-m365-hijack", "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, using the agentic AI framework ARTEX; 2,250+ Microsoft 365 tenants targeted.", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation.", "body": null, "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases.", "body": null, "sourceUrl": "https://www.php.net/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Cloudflare deploys free default WAF rules (request + response signals) for all customers.", "body": null, "sourceUrl": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21/22", "title": "PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix.", "body": null, "sourceUrl": "https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "CISA KEV warning; patch-by Oct 23 for federal agencies.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "nginx-october-2026-advisories", "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2026-10-21", "title": "Security advisories and patched releases published on nginx.org.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nginx-october-2026-advisories" }, { "incident": "nginx-october-2026-advisories", "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2026-10-21", "title": "nginx 1.31.8 mainline released.", "body": null, "sourceUrl": "https://nginx.org/", "url": "https://pwn.watch/i/nginx-october-2026-advisories" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PingCAP Japan adds support-ticket information to the list of exposed data.", "body": null, "sourceUrl": "https://pingcap.co.jp/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "fearless-wallet-extension-key-leak", "incidentTitle": "Fearless Wallet browser extension leaked private keys for ~20 months", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-21", "title": "Polkadot Community Foundation publishes security notice (14:00 UTC); 8 users report 17,286 DOT lost.", "body": null, "sourceUrl": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058", "url": "https://pwn.watch/i/fearless-wallet-extension-key-leak" }, { "incident": "signal-ringrtc-cve-2026-113380", "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-20", "title": "CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0.", "body": null, "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2026-113380", "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380" }, { "incident": "eg-secure-solutions-siteguard-server-edition-cve-2026-106931", "incidentTitle": "EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-20", "title": "CISA added CVE-2026-106931 to the KEV catalog (due 2026-10-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931" }, { "incident": "siemens-software-center-cve-2026-110936", "incidentTitle": "Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-20", "title": "CISA added CVE-2026-110936 to the KEV catalog (due 2026-11-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/siemens-software-center-cve-2026-110936" }, { "incident": "http3-qpack-header-accordions", "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS", "severity": "unknown", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "FoxIO blog + PoC published; several stacks still unpatched.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/http3-qpack-header-accordions" }, { "incident": "emudhra-intermediate-ca-compromise", "incidentTitle": "eMudhra intermediate CA private keys compromised", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week.", "body": null, "sourceUrl": "https://ctxsec.com/items/opencode-console-provider-key-breach-2026-10", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-20", "title": "CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655).", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there.", "body": null, "sourceUrl": "https://cryptobriefing.com/bitget-no-user-data-tidb-cloud-breach/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-19", "title": "LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports).", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "emudhra-intermediate-ca-compromise", "incidentTitle": "eMudhra intermediate CA private keys compromised", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "eMudhra revoked the eight intermediates; browsers continued emergency distrust.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records.", "body": null, "sourceUrl": "https://pingcap.co.jp/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "emudhra-intermediate-ca-compromise", "incidentTitle": "eMudhra intermediate CA private keys compromised", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-18", "title": "Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-18", "title": "Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened.", "body": null, "sourceUrl": "https://x.com/thdxr/status/2111790511409258796", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure.", "body": null, "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17T00:30Z", "title": "Earliest possible exposure of saved provider keys (per OpenCode's email to affected users).", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "OpenCode emails affected users, then announces the breach on X, tied to a 'large scale distillation attack' affecting 1.4% of Console users.", "body": null, "sourceUrl": "https://x.com/opencode/status/2111519637049319818", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "Dax (OpenCode) clarifies only the hosted Console is affected; keys used locally with the OpenCode app never reach OpenCode. Anthropic and Google revoke/block exposed keys; refunds start.", "body": null, "sourceUrl": "https://x.com/thdxr/status/2111572618340188393", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-17", "title": "Honeypot exploitation (XMRig + proxy) observed.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-16", "title": "Public write-up.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "fortinet-multiple-products-cve-2025-61624", "incidentTitle": "Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-16", "title": "CISA added CVE-2025-61624 to the KEV catalog (due 2026-10-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-61624" }, { "incident": "ghostaction-github-workflows-oct-2026", "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-16", "title": "OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron.", "body": null, "sourceUrl": "https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file", "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026" }, { "incident": "atlassian-multiple-products-cve-2026-21589", "incidentTitle": "Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-15", "title": "CISA added CVE-2026-21589 to the KEV catalog (due 2026-10-18).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-multiple-products-cve-2026-21589" }, { "incident": "zeabur-october-2026-breach-shutdown", "incidentTitle": "Zeabur breach exposes 3.2M env-var records; company to shut down", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-15", "title": "Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05.", "body": null, "sourceUrl": "https://zeabur.com/blogs/october-2026-security-incident", "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown" }, { "incident": "beyondtrust-remote-support-cve-2026-102764", "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-15/16", "title": "Public disclosure / Mandiant blog; CISA KEV Oct 16.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764" }, { "incident": "zeabur-october-2026-breach-shutdown", "incidentTitle": "Zeabur breach exposes 3.2M env-var records; company to shut down", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-14", "title": "Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers.", "body": null, "sourceUrl": "https://zeabur.com/blogs/october-2026-security-incident", "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown" }, { "incident": "ahsay-ahsaycbs-cve-2026-105134", "incidentTitle": "Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "CISA added CVE-2026-105134, CVE-2026-105133 to the KEV catalog (due 2026-10-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134" }, { "incident": "cisco-secure-email-gateway-cve-2026-76519", "incidentTitle": "Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "CISA added CVE-2026-76519 to the KEV catalog (due 2026-10-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519" }, { "incident": "palo-alto-networks-pan-os-cve-2026-0322", "incidentTitle": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "CISA added CVE-2026-0322 to the KEV catalog (due 2026-10-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322" }, { "incident": "nginx-october-2026-advisories", "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2026-10-14", "title": "nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025.", "body": null, "sourceUrl": "https://nginx.org/", "url": "https://pwn.watch/i/nginx-october-2026-advisories" }, { "incident": "pwnescape-cve-2026-99999", "incidentTitle": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-14/15", "title": "Mainline merge / public write-ups.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/pwnescape-cve-2026-99999" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-14", "title": "All identified compromised credentials invalidated and access paths blocked; four vulnerabilities found by IR firm fixed.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "windows-shell-cve-2026-96951-motw", "incidentTitle": "Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-10-13", "title": "Microsoft ships patches; CISA KEV lists CVE-2026-96951.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw" }, { "incident": "ghostaction-github-workflows-oct-2026", "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-13", "title": "GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted.", "body": null, "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/", "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-13", "title": "Ivanti discloses and patches CVE-2026-104935; Volexity publishes.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-13/16", "title": "CISA KEV listing; federal patching deadline reported as Oct 16.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "gitlab-cve-2026-110264-regex-rce", "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-12", "title": "Prior critical regex patch released (separate CVE); some operators stopped there.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce" }, { "incident": "ghostaction-github-workflows-oct-2026", "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-11", "title": "Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html", "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-10", "title": "SubQuery maintainer: compromised token deleted, security review started.", "body": null, "sourceUrl": "https://github.com/subquery/subql/issues/3047", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "fearless-wallet-extension-key-leak", "incidentTitle": "Fearless Wallet browser extension leaked private keys for ~20 months", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-10", "title": "Last known period the exfiltration code was active (it could be re-enabled).", "body": null, "sourceUrl": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058", "url": "https://pwn.watch/i/fearless-wallet-extension-key-leak" }, { "incident": "ghostaction-github-workflows-oct-2026", "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-09", "title": "Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered.", "body": null, "sourceUrl": "https://socket.dev/blog/ghostaction-cloud-credentials", "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026" }, { "incident": "ghostaction-github-workflows-oct-2026", "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-08", "title": "Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration.", "body": null, "sourceUrl": "https://www.stepsecurity.io/blog/ghostaction-returns", "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026" }, { "incident": "tensorlake-npm-shai-hulud-worm", "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-08", "title": "0.5.144 published via the project’s release workflow.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm" }, { "incident": "tensorlake-npm-shai-hulud-worm", "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-08+", "title": "StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm" }, { "incident": "telegram-desktop-cve-2026-107181", "incidentTitle": "Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-10-08/10", "title": "Public write-ups and X discussion peak.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/telegram-desktop-cve-2026-107181" }, { "incident": "beyondtrust-remote-support-cve-2026-102764", "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-08/09", "title": "BeyondTrust patches; SaaS auto-fixed.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764" }, { "incident": "pwnescape-cve-2026-99999", "incidentTitle": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-07/08", "title": "Upstream IPv4 checksum guard accepted into net.git.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/pwnescape-cve-2026-99999" }, { "incident": "tensorlake-npm-shai-hulud-worm", "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-07", "title": "Malicious commits land on tensorlakeai/tensorlake main.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-07", "title": "PingCAP detects the intrusion and starts disabling credentials.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-06", "title": "GMO Flatt Security publishes payload analysis and response guidance.", "body": null, "sourceUrl": "https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-05T11:56Z", "title": "Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier).", "body": null, "sourceUrl": "https://www.stepsecurity.io/blog/subql-ecosystem-compromised", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-05T12:14Z", "title": "StepSecurity opens security issue #3047 in subquery/subql.", "body": null, "sourceUrl": "https://github.com/subquery/subql/issues/3047", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-05T12:46Z", "title": "GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2.", "body": null, "sourceUrl": "https://github.com/advisories/GHSA-9333-3c4x-x3h5", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "fortimail-cve-2026-104286", "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-05", "title": "Fortinet remediates FortiMail Cloud by updating all instances to 7.6.7 / 8.0.2 GA.", "body": null, "sourceUrl": "https://www.fortiguard.com/psirt/FG-IR-26-175", "url": "https://pwn.watch/i/fortimail-cve-2026-104286" }, { "incident": "citrix-netscaler-cve-2026-88779", "incidentTitle": "Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-04", "title": "CISA added CVE-2026-88779 to the KEV catalog (due 2026-10-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-netscaler-cve-2026-88779" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-03", "title": "Volexity sees UTA0576 chaining for unauth root.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-03", "title": "Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root.", "body": null, "sourceUrl": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "zammad-gmbh-zammad-cve-2026-102490", "incidentTitle": "Zammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-02", "title": "CISA added CVE-2026-102490, CVE-2026-102489 to the KEV catalog (due 2026-10-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zammad-gmbh-zammad-cve-2026-102490" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-01", "title": "Defused reports first signs of exploitation.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "fortimail-cve-2026-104286", "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10", "title": "Fortinet PSIRT FG-IR-26-175 patches and mitigations.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortimail-cve-2026-104286" }, { "incident": "fortimail-cve-2026-104286", "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "~2026-09-30/10-01", "title": "Active exploitation and CISA alerts begin circulating.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortimail-cve-2026-104286" }, { "incident": "cisco-catalyst-sd-wan-manager-cve-2026-76504", "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-30", "title": "CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504" }, { "incident": "microsoft-sharepoint-cve-2026-65660", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-25", "title": "CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660" }, { "incident": "wordpress-core-cve-2026-87902", "incidentTitle": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-25", "title": "CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902" }, { "incident": "adobe-commerce-and-magento-cve-2026-71362", "incidentTitle": "Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-24", "title": "CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362" }, { "incident": "linux-kernel-cve-2025-39964", "incidentTitle": "Linux Kernel: Linux Kernel Race Condition Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-18", "title": "CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the KEV catalog (due 2026-09-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/linux-kernel-cve-2025-39964" }, { "incident": "cisco-identity-services-engine-cve-2026-76460", "incidentTitle": "Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-16", "title": "CISA added CVE-2026-76460 to the KEV catalog (due 2026-09-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460" }, { "incident": "google-pixel-cve-2026-58704", "incidentTitle": "Google Pixel: Google Pixel Improper Authorization Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-16", "title": "CISA added CVE-2026-58704 to the KEV catalog (due 2026-09-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/google-pixel-cve-2026-58704" }, { "incident": "telegram-desktop-cve-2026-107181", "incidentTitle": "Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-16", "title": "Telegram Desktop 7.2.9 ships the fix.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/telegram-desktop-cve-2026-107181" }, { "incident": "cisco-secure-email-gateway-cve-2026-76461", "incidentTitle": "Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-14", "title": "CISA added CVE-2026-76461 to the KEV catalog (due 2026-09-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461" }, { "incident": "connectwise-screenconnect-cve-2026-84869", "incidentTitle": "ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-11", "title": "CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869" }, { "incident": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706", "incidentTitle": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-11", "title": "CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706" }, { "incident": "jfrog-artifactory-cve-2026-42016", "incidentTitle": "JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-11", "title": "CISA added CVE-2026-42016, CVE-2026-42018 to the KEV catalog (due 2026-09-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016" }, { "incident": "mikrotik-routeros-cve-2026-86060", "incidentTitle": "MikroTik RouterOS: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-10", "title": "CISA added CVE-2026-86060, CVE-2026-67277, CVE-2026-67279 to the KEV catalog (due 2026-09-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mikrotik-routeros-cve-2026-86060" }, { "incident": "cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew", "incidentTitle": "Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-09", "title": "CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew" }, { "incident": "citrix-netscaler-cve-2026-19490", "incidentTitle": "Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-09", "title": "CISA added CVE-2026-19490 to the KEV catalog (due 2026-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-netscaler-cve-2026-19490" }, { "incident": "fortinet-multiple-products-cve-2025-25249", "incidentTitle": "Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-09", "title": "CISA added CVE-2025-25249 to the KEV catalog (due 2026-09-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-25249" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-09-09", "title": "Unauthorized access with stolen service-account credentials begins.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "adobe-commerce-and-magento-cve-2026-75650", "incidentTitle": "Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-08", "title": "CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650" }, { "incident": "microsoft-windows-cve-2026-81963", "incidentTitle": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-08", "title": "CISA added CVE-2026-81963, CVE-2026-85880 to the KEV catalog (due 2026-09-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-81963" }, { "incident": "n-able-n-central-cve-2026-86218", "incidentTitle": "N-able N-central: N-able N-central Static Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-08", "title": "CISA added CVE-2026-86218 to the KEV catalog (due 2026-09-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/n-able-n-central-cve-2026-86218" }, { "incident": "berriai-litellm-cve-2026-59822", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822" }, { "incident": "jfrog-artifactory-cve-2026-82329", "incidentTitle": "JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329" }, { "incident": "kestra-kestra-oss-cve-2026-49869", "incidentTitle": "Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-49869 to the KEV catalog (due 2026-09-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869" }, { "incident": "sangoma-switchvox-cve-2026-9586", "incidentTitle": "Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-9586 to the KEV catalog (due 2026-09-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sangoma-switchvox-cve-2026-9586" }, { "incident": "sonicwall-sma1000-appliances-cve-2026-83548", "incidentTitle": "SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-83548, CVE-2026-83549 to the KEV catalog (due 2026-09-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-83548" }, { "incident": "ghostaction-github-workflows-oct-2026", "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-08-31", "title": "2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4.", "body": null, "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/", "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026" }, { "incident": "beyondtrust-remote-support-cve-2026-102764", "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-08-29", "title": "Mandiant/GTIG: exploitation of zero-day begins (limited victims).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764" }, { "incident": "jfrog-artifactory-cve-2026-66384", "incidentTitle": "JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-27", "title": "CISA added CVE-2026-66384 to the KEV catalog (due 2026-09-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-66384" }, { "incident": "linux-kernel-cve-2026-53362", "incidentTitle": "Linux Kernel: Linux Kernel Unspecified Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-27", "title": "CISA added CVE-2026-53362 to the KEV catalog (due 2026-08-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/linux-kernel-cve-2026-53362" }, { "incident": "gitea-gitea-cve-2026-60004", "incidentTitle": "Gitea Gitea: Gitea Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-25", "title": "CISA added CVE-2026-60004 to the KEV catalog (due 2026-08-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gitea-gitea-cve-2026-60004" }, { "incident": "oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962", "incidentTitle": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-24", "title": "CISA added CVE-2026-21962 to the KEV catalog (due 2026-08-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962" }, { "incident": "synacor-zimbra-collaboration-suite-zcs-cve-2026-73570", "incidentTitle": "Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-21", "title": "CISA added CVE-2026-73570 to the KEV catalog (due 2026-08-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570" }, { "incident": "pwnescape-cve-2026-99999", "incidentTitle": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-08-20", "title": "Initial host-memory disclosure reported.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/pwnescape-cve-2026-99999" }, { "incident": "trueconf-server-cve-2026-72530", "incidentTitle": "TrueConf Server: TrueConf Server Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-20", "title": "CISA added CVE-2026-72530, CVE-2026-72529 to the KEV catalog (due 2026-09-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/trueconf-server-cve-2026-72530" }, { "incident": "mlflow-mlflow-cve-2026-64849", "incidentTitle": "MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-19", "title": "CISA added CVE-2026-64849 to the KEV catalog (due 2026-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849" }, { "incident": "pwnescape-cve-2026-99999", "incidentTitle": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-08-18", "title": "Vercel Sandbox challenge opens.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/pwnescape-cve-2026-99999" }, { "incident": "apple-macos-cve-2026-65400", "incidentTitle": "Apple macOS: Apple macOS Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-65400 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apple-macos-cve-2026-65400" }, { "incident": "broadcom-vmware-vcenter-cve-2026-59310", "incidentTitle": "Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-59310 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310" }, { "incident": "microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824", "incidentTitle": "Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-33824 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824" }, { "incident": "microsoft-sharepoint-cve-2026-55040", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Weak Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-55040 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040" }, { "incident": "ray-project-ray-cve-2025-62593", "incidentTitle": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-17", "title": "CISA added CVE-2025-62593 to the KEV catalog (due 2026-08-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593" }, { "incident": "cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat", "incidentTitle": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and S", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-11", "title": "CISA added CVE-2026-20349 to the KEV catalog (due 2026-08-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat" }, { "incident": "metabase-metabase-cve-2026-72898", "incidentTitle": "Metabase Metabase: Metabase SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-11", "title": "CISA added CVE-2026-72898 to the KEV catalog (due 2026-08-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/metabase-metabase-cve-2026-72898" }, { "incident": "microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820", "incidentTitle": "Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-11", "title": "CISA added CVE-2026-68820 to the KEV catalog (due 2026-08-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820" }, { "incident": "progress-loadmaster-cve-2026-8037", "incidentTitle": "Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-07", "title": "CISA added CVE-2026-8037 to the KEV catalog (due 2026-08-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/progress-loadmaster-cve-2026-8037" }, { "incident": "jetbrains-teamcity-cve-2026-63077", "incidentTitle": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-05", "title": "CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-08-04", "title": "Plex ships 1.43.3.10861.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "shai-hulud-chaindrop-npm-keyv-august", "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)", "severity": "critical", "status": "closed", "patchStatus": "partial", "date": "2026-08-04", "title": "keyv/cacheable malicious releases observed; worm begins propagating.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august" }, { "incident": "shai-hulud-chaindrop-npm-keyv-august", "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)", "severity": "critical", "status": "closed", "patchStatus": "partial", "date": "2026-08-04/06", "title": "Microsoft, Elastic, JFrog publish analyses; 400+ packages listed.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august" }, { "incident": "apache-tomcat-cve-2026-34486", "incidentTitle": "Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-04", "title": "CISA added CVE-2026-34486 to the KEV catalog (due 2026-08-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-tomcat-cve-2026-34486" }, { "incident": "ibm-langflow-cve-2026-9198", "incidentTitle": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-04", "title": "CISA added CVE-2026-9198 to the KEV catalog (due 2026-08-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198" }, { "incident": "n-able-n-central-cve-2026-18577", "incidentTitle": "N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-03", "title": "CISA added CVE-2026-18577, CVE-2026-18556 to the KEV catalog (due 2026-08-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/n-able-n-central-cve-2026-18577" }, { "incident": "cisco-secure-firewall-management-center-fmc-cve-2026-20316", "incidentTitle": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-29", "title": "CISA added CVE-2026-20316 to the KEV catalog (due 2026-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-07-27", "title": "Zach Main reports issues to Plex.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "arista-velocloud-orchestrator-cve-2026-16812", "incidentTitle": "Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-27", "title": "CISA added CVE-2026-16812 to the KEV catalog (due 2026-07-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812" }, { "incident": "fortinet-fortios-cve-2025-68686", "incidentTitle": "Fortinet FortiOS: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-27", "title": "CISA added CVE-2025-68686 to the KEV catalog (due 2026-08-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortios-cve-2025-68686" }, { "incident": "check-point-smartconsole-cve-2026-16232", "incidentTitle": "Check Point SmartConsole: Check Point SmartConsole Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-22", "title": "CISA added CVE-2026-16232 to the KEV catalog (due 2026-07-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/check-point-smartconsole-cve-2026-16232" }, { "incident": "microsoft-sharepoint-cve-2026-50522", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-22", "title": "CISA added CVE-2026-50522 to the KEV catalog (due 2026-07-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522" }, { "incident": "langflow-langflow-cve-2026-0770", "incidentTitle": "Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-21", "title": "CISA added CVE-2026-0770 to the KEV catalog (due 2026-07-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-0770" }, { "incident": "wordpress-core-cve-2026-60137", "incidentTitle": "WordPress Core: WordPress Core SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-21", "title": "CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137" }, { "incident": "fortinet-fortisandbox-cve-2026-25089", "incidentTitle": "Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-16", "title": "CISA added CVE-2026-25089, CVE-2026-39808 to the KEV catalog (due 2026-07-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089" }, { "incident": "microsoft-sharepoint-cve-2026-58644", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-16", "title": "CISA added CVE-2026-58644 to the KEV catalog (due 2026-07-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644" }, { "incident": "oracle-e-business-suite-cve-2026-46817", "incidentTitle": "Oracle E-Business Suite: Oracle E-Business Suite Improper Privilege Management Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-15", "title": "CISA added CVE-2026-46817 to the KEV catalog (due 2026-07-18).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2026-46817" }, { "incident": "microsoft-active-directory-federation-services-cve-2026-56155", "incidentTitle": "Microsoft Active Directory Federation Services: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-14", "title": "CISA added CVE-2026-56155 to the KEV catalog (due 2026-07-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-active-directory-federation-services-cve-2026-56155" }, { "incident": "microsoft-sharepoint-server-cve-2026-56164", "incidentTitle": "Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-14", "title": "CISA added CVE-2026-56164 to the KEV catalog (due 2026-07-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164" }, { "incident": "sonicwall-sma1000-appliances-cve-2026-15409", "incidentTitle": "SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-14", "title": "CISA added CVE-2026-15409, CVE-2026-15410 to the KEV catalog (due 2026-07-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409" }, { "incident": "adobe-coldfusion-cve-2026-48282", "incidentTitle": "Adobe ColdFusion: Adobe ColdFusion Path Traversal Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-07", "title": "CISA added CVE-2026-48282 to the KEV catalog (due 2026-07-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/adobe-coldfusion-cve-2026-48282" }, { "incident": "joomlack-page-builder-cve-2026-56290", "incidentTitle": "Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-07", "title": "CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290" }, { "incident": "langflow-langflow-cve-2026-55255", "incidentTitle": "Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-07", "title": "CISA added CVE-2026-55255 to the KEV catalog (due 2026-07-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-55255" }, { "incident": "microsoft-sharepoint-server-cve-2026-45659", "incidentTitle": "Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-01", "title": "CISA added CVE-2026-45659 to the KEV catalog (due 2026-07-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659" }, { "incident": "cisco-unified-communications-manager-cve-2026-20230", "incidentTitle": "Cisco Unified Communications Manager: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-25", "title": "CISA added CVE-2026-20230 to the KEV catalog (due 2026-06-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20230" }, { "incident": "ptc-windchill-and-flexplm-cve-2026-12569", "incidentTitle": "PTC Windchill and FlexPLM: PTC Windchill and FlexPLM Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-25", "title": "CISA added CVE-2026-12569 to the KEV catalog (due 2026-06-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ptc-windchill-and-flexplm-cve-2026-12569" }, { "incident": "widget-factory-joomla-content-editor-cve-2026-48907", "incidentTitle": "Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-16", "title": "CISA added CVE-2026-48907 to the KEV catalog (due 2026-06-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907" }, { "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20262", "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-15", "title": "CISA added CVE-2026-20262 to the KEV catalog (due 2026-06-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262" }, { "incident": "oracle-peoplesoft-enterprise-peopletools-cve-2026-35273", "incidentTitle": "Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-12", "title": "CISA added CVE-2026-35273 to the KEV catalog (due 2026-06-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273" }, { "incident": "ivanti-sentry-cve-2026-10520", "incidentTitle": "Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-11", "title": "CISA added CVE-2026-10520 to the KEV catalog (due 2026-06-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-sentry-cve-2026-10520" }, { "incident": "arista-extensible-operating-system-cve-2026-7473", "incidentTitle": "Arista Extensible Operating System: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-09", "title": "CISA added CVE-2026-7473 to the KEV catalog (due 2026-06-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/arista-extensible-operating-system-cve-2026-7473" }, { "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20245", "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-09", "title": "CISA added CVE-2026-20245 to the KEV catalog (due 2026-06-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245" }, { "incident": "berriai-litellm-cve-2026-42271", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-08", "title": "CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271" }, { "incident": "check-point-security-gateway-cve-2026-50751", "incidentTitle": "Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-08", "title": "CISA added CVE-2026-50751 to the KEV catalog (due 2026-06-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/check-point-security-gateway-cve-2026-50751" }, { "incident": "solarwinds-serv-u-cve-2026-28318", "incidentTitle": "SolarWinds Serv-U: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-05", "title": "CISA added CVE-2026-28318 to the KEV catalog (due 2026-06-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/solarwinds-serv-u-cve-2026-28318" }, { "incident": "android-framework-cve-2025-48595", "incidentTitle": "Android Framework: Android Framework Integer Overflow Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-02", "title": "CISA added CVE-2025-48595 to the KEV catalog (due 2026-06-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/android-framework-cve-2025-48595" }, { "incident": "palo-alto-networks-pan-os-cve-2026-0257", "incidentTitle": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-29", "title": "CISA added CVE-2026-0257 to the KEV catalog (due 2026-06-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257" }, { "incident": "nx-nx-console-cve-2026-48027", "incidentTitle": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-27", "title": "CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027" }, { "incident": "tanstack-tanstack-cve-2026-45321", "incidentTitle": "TanStack TanStack: TanStack Unspecified Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-27", "title": "CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321" }, { "incident": "drupal-core-cve-2026-9082", "incidentTitle": "Drupal Core: Drupal Core SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-22", "title": "CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/drupal-core-cve-2026-9082" }, { "incident": "langflow-langflow-cve-2025-34291", "incidentTitle": "Langflow Langflow: Langflow Origin Validation Error Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-21", "title": "CISA added CVE-2025-34291 to the KEV catalog (due 2026-06-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2025-34291" }, { "incident": "microsoft-defender-cve-2026-41091", "incidentTitle": "Microsoft Defender: Microsoft Defender Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-20", "title": "CISA added CVE-2026-41091, CVE-2026-45498 to the KEV catalog (due 2026-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-defender-cve-2026-41091" }, { "incident": "microsoft-microsoft-cve-2026-42897", "incidentTitle": "Microsoft Microsoft: Microsoft Exchange Server Cross-Site Scripting Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-15", "title": "CISA added CVE-2026-42897 to the KEV catalog (due 2026-05-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-microsoft-cve-2026-42897" }, { "incident": "cisco-catalyst-sd-wan-cve-2026-20182", "incidentTitle": "Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-14", "title": "CISA added CVE-2026-20182 to the KEV catalog (due 2026-05-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182" }, { "incident": "berriai-litellm-cve-2026-42208", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-08", "title": "CISA added CVE-2026-42208 to the KEV catalog (due 2026-05-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2026-6973", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-07", "title": "CISA added CVE-2026-6973 to the KEV catalog (due 2026-05-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973" }, { "incident": "palo-alto-networks-pan-os-cve-2026-0300", "incidentTitle": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-06", "title": "CISA added CVE-2026-0300 to the KEV catalog (due 2026-05-09).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0300" }, { "incident": "linux-kernel-cve-2026-31431", "incidentTitle": "Linux Kernel: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-01", "title": "CISA added CVE-2026-31431 to the KEV catalog (due 2026-05-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/linux-kernel-cve-2026-31431" }, { "incident": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "incidentTitle": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-30", "title": "CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940" }, { "incident": "microsoft-windows-cve-2026-32202", "incidentTitle": "Microsoft Windows: Microsoft Windows Protection Mechanism Failure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-28", "title": "CISA added CVE-2026-32202 to the KEV catalog (due 2026-05-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-32202" }, { "incident": "microsoft-defender-cve-2026-33825", "incidentTitle": "Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-22", "title": "CISA added CVE-2026-33825 to the KEV catalog (due 2026-05-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-defender-cve-2026-33825" }, { "incident": "cisco-catalyst-sd-wan-manager-cve-2026-20133", "incidentTitle": "Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-20", "title": "CISA added CVE-2026-20133, CVE-2026-20128 to the KEV catalog (due 2026-04-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133" }, { "incident": "cisco-catalyst-sd-wan-manger-cve-2026-20122", "incidentTitle": "Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-20", "title": "CISA added CVE-2026-20122 to the KEV catalog (due 2026-04-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122" }, { "incident": "synacor-zimbra-collaboration-suite-zcs-cve-2025-48700", "incidentTitle": "Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-20", "title": "CISA added CVE-2025-48700 to the KEV catalog (due 2026-04-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-48700" }, { "incident": "apache-activemq-cve-2026-34197", "incidentTitle": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-16", "title": "CISA added CVE-2026-34197 to the KEV catalog (due 2026-04-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197" }, { "incident": "microsoft-sharepoint-server-cve-2026-32201", "incidentTitle": "Microsoft SharePoint Server: Microsoft SharePoint Server Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-14", "title": "CISA added CVE-2026-32201 to the KEV catalog (due 2026-04-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201" }, { "incident": "adobe-acrobat-and-reader-cve-2026-34621", "incidentTitle": "Adobe Acrobat and Reader: Adobe Acrobat and Reader Prototype Pollution Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-13", "title": "CISA added CVE-2026-34621 to the KEV catalog (due 2026-04-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/adobe-acrobat-and-reader-cve-2026-34621" }, { "incident": "fortinet-forticlient-ems-cve-2026-21643", "incidentTitle": "Fortinet FortiClient EMS: Fortinet FortiClient EMS SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-13", "title": "CISA added CVE-2026-21643 to the KEV catalog (due 2026-04-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643" }, { "incident": "microsoft-windows-cve-2025-60710", "incidentTitle": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-13", "title": "CISA added CVE-2025-60710, CVE-2023-36424 to the KEV catalog (due 2026-04-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-60710" }, { "incident": "citrix-netscaler-cve-2026-3055", "incidentTitle": "Citrix NetScaler: Citrix NetScaler Out-of-Bounds Read Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-30", "title": "CISA added CVE-2026-3055 to the KEV catalog (due 2026-04-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-netscaler-cve-2026-3055" }, { "incident": "f5-big-ip-cve-2025-53521", "incidentTitle": "F5 BIG-IP: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-27", "title": "CISA added CVE-2025-53521 to the KEV catalog (due 2026-03-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/f5-big-ip-cve-2025-53521" }, { "incident": "langflow-langflow-cve-2026-33017", "incidentTitle": "Langflow Langflow: Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-25", "title": "CISA added CVE-2026-33017 to the KEV catalog (due 2026-04-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017" }, { "incident": "apple-multiple-products-cve-2025-43510", "incidentTitle": "Apple Multiple Products: Apple Multiple Products Improper Locking Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-20", "title": "CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the KEV catalog (due 2026-04-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-43510" }, { "incident": "cisco-secure-firewall-management-center-fmc-cve-2026-20131", "incidentTitle": "Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-19", "title": "CISA added CVE-2026-20131 to the KEV catalog (due 2026-03-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131" }, { "incident": "microsoft-sharepoint-cve-2026-20963", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-18", "title": "CISA added CVE-2026-20963 to the KEV catalog (due 2026-03-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963" }, { "incident": "synacor-zimbra-collaboration-suite-zcs-cve-2025-66376", "incidentTitle": "Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-18", "title": "CISA added CVE-2025-66376 to the KEV catalog (due 2026-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-66376" }, { "incident": "ivanti-endpoint-manager-epm-cve-2026-1603", "incidentTitle": "Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-09", "title": "CISA added CVE-2026-1603 to the KEV catalog (due 2026-03-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603" }, { "incident": "solarwinds-web-help-desk-cve-2025-26399", "incidentTitle": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-09", "title": "CISA added CVE-2025-26399 to the KEV catalog (due 2026-03-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399" }, { "incident": "broadcom-vmware-aria-operations-cve-2026-22719", "incidentTitle": "Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-03", "title": "CISA added CVE-2026-22719 to the KEV catalog (due 2026-03-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719" }, { "incident": "teampcp-trivy-checkmarx-supply-chain", "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-03", "title": "Trivy compromise disclosed; Microsoft guidance published.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain" }, { "incident": "teampcp-trivy-checkmarx-supply-chain", "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-03", "title": "Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain" }, { "incident": "cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127", "incidentTitle": "Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-25", "title": "CISA added CVE-2026-20127 to the KEV catalog (due 2026-02-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127" }, { "incident": "roundcube-webmail-cve-2025-49113", "incidentTitle": "Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-20", "title": "CISA added CVE-2025-49113, CVE-2025-68461 to the KEV catalog (due 2026-03-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/roundcube-webmail-cve-2025-49113" }, { "incident": "beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731", "incidentTitle": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-13", "title": "CISA added CVE-2026-1731 to the KEV catalog (due 2026-02-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731" }, { "incident": "apple-multiple-products-cve-2026-20700", "incidentTitle": "Apple Multiple Products: Apple Multiple Buffer Overflow Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-12", "title": "CISA added CVE-2026-20700 to the KEV catalog (due 2026-03-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apple-multiple-products-cve-2026-20700" }, { "incident": "solarwinds-web-help-desk-cve-2025-40536", "incidentTitle": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Security Control Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-12", "title": "CISA added CVE-2025-40536 to the KEV catalog (due 2026-02-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40536" }, { "incident": "microsoft-office-cve-2026-21514", "incidentTitle": "Microsoft Office: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-10", "title": "CISA added CVE-2026-21514 to the KEV catalog (due 2026-03-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-cve-2026-21514" }, { "incident": "microsoft-windows-cve-2026-21513", "incidentTitle": "Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-10", "title": "CISA added CVE-2026-21513, CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519 to the KEV catalog (due 2026-03-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-21513" }, { "incident": "react-native-community-cli-cve-2025-11953", "incidentTitle": "React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-05", "title": "CISA added CVE-2025-11953 to the KEV catalog (due 2026-02-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953" }, { "incident": "smartertools-smartermail-cve-2026-24423", "incidentTitle": "SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-05", "title": "CISA added CVE-2026-24423 to the KEV catalog (due 2026-02-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/smartertools-smartermail-cve-2026-24423" }, { "incident": "sangoma-freepbx-cve-2025-64328", "incidentTitle": "Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-03", "title": "CISA added CVE-2025-64328 to the KEV catalog (due 2026-02-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-64328" }, { "incident": "solarwinds-web-help-desk-cve-2025-40551", "incidentTitle": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-03", "title": "CISA added CVE-2025-40551 to the KEV catalog (due 2026-02-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2026-1281", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-29", "title": "CISA added CVE-2026-1281 to the KEV catalog (due 2026-02-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281" }, { "incident": "fortinet-multiple-products-cve-2026-24858", "incidentTitle": "Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-27", "title": "CISA added CVE-2026-24858 to the KEV catalog (due 2026-01-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858" }, { "incident": "microsoft-office-cve-2026-21509", "incidentTitle": "Microsoft Office: Microsoft Office Security Feature Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-26", "title": "CISA added CVE-2026-21509 to the KEV catalog (due 2026-02-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-cve-2026-21509" }, { "incident": "smartertools-smartermail-cve-2025-52691", "incidentTitle": "SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-26", "title": "CISA added CVE-2025-52691, CVE-2026-23760 to the KEV catalog (due 2026-02-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/smartertools-smartermail-cve-2025-52691" }, { "incident": "synacor-zimbra-collaboration-suite-zcs-cve-2025-68645", "incidentTitle": "Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-22", "title": "CISA added CVE-2025-68645 to the KEV catalog (due 2026-02-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-68645" }, { "incident": "cisco-unified-communications-manager-cve-2026-20045", "incidentTitle": "Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-21", "title": "CISA added CVE-2026-20045 to the KEV catalog (due 2026-02-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045" }, { "incident": "microsoft-windows-cve-2026-20805", "incidentTitle": "Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-13", "title": "CISA added CVE-2026-20805 to the KEV catalog (due 2026-02-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-20805" }, { "incident": "http3-qpack-header-accordions", "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS", "severity": "unknown", "status": "live", "patchStatus": "partial", "date": "2025-11 → 2026-07", "title": "Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/http3-qpack-header-accordions" }, { "incident": "ghostaction-github-workflows-oct-2026", "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2025-09", "title": "GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.)", "body": null, "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/", "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026" }, { "incident": "fearless-wallet-extension-key-leak", "incidentTitle": "Fearless Wallet browser extension leaked private keys for ~20 months", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2025-02-19", "title": "Malicious code merged into the extension's public source as part of a 'TON ecosystem' PR.", "body": null, "sourceUrl": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058", "url": "https://pwn.watch/i/fearless-wallet-extension-key-leak" } ] }