Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents

Sep 6, 2026

0 new incidents, 1 with updates.

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Updated

  • LivePatched

    Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3

    NVD published a Chartbrew advisory cluster on 2026-11-06 for issues patched earlier in v5.2.1 and v5.2.3. Critical CVE-2026-85295 (CVSS 9.8): stock source/docker-compose installs keep the shipped CB_SECRET default, so an unauthenticated attacker forges session JWTs for any user (password/2FA bypass). Critical CVE-2026-54349 (CVSS 9.8): unauthenticated SQL injection via dashboard/chart filter variable substitution on public/embedded charts (fixed in 5.2.1). High CVE-2026-85712 (CVSS 8.8): authenticated cross-tenant project takeover via caller-controlled body.team_id. Same 5.2.3 wave also covers forgeable share tokens (CVE-2026-85708), MongoDB date-variable NoSQLi (CVE-2026-85726), root-path file deletion via SSL/SSH cleanup (CVE-2026-85736), unauthenticated BullMQ admin dashboard at /apps/queues (CVE-2026-86005), and NAT64 SSRF bypass in outbound URL guards (CVE-2026-54589, fixed in 5.2.1). Upgrade to Chartbrew 5.2.3 (at least 5.2.1 for the SQLi/SSRF subset) and rotate secrets.

    Chartbrew (chartbrew/chartbrew)Since Jul 6, 2026

Sponsored

Buy sponsor slot · $149/mo