{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "pwn.watch: incident updates (Patch now)",
  "home_page_url": "https://pwn.watch/",
  "feed_url": "https://pwn.watch/feed.json",
  "description": "Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them.",
  "language": "en",
  "_pwn": {
    "category": "patch",
    "rss": "https://pwn.watch/feed.xml",
    "changes": "https://pwn.watch/changes.json",
    "llms": "https://pwn.watch/llms.txt"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134",
      "url": "https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134",
      "title": "[high] Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability",
      "summary": "Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CISA added CVE-2026-105134, CVE-2026-105133 to the Known Exploited Vulnerabilities catalog on 2026-10-14 based on evidence of active exploitation.",
      "content_html": "<p>Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CISA added CVE-2026-105134, CVE-2026-105133 to the Known Exploited Vulnerabilities catalog on 2026-10-14 based on evidence of active exploitation.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-14: CISA added CVE-2026-105134, CVE-2026-105133 to the KEV catalog (due 2026-10-17).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-105134, CVE-2026-105133</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625",
      "title": "[critical] Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "summary": "Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.",
      "content_html": "<p>Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 5.2.3.18, 6.1.3.10, 6.4.2.12</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected. (<a href=\"https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-114625</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/atlassian-multiple-products-cve-2026-21589",
      "url": "https://pwn.watch/i/atlassian-multiple-products-cve-2026-21589",
      "title": "[high] Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
      "summary": "Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Added to CISA KEV on 2026-10-15.",
      "content_html": "<p>Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Added to CISA KEV on 2026-10-15.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-15: CISA added CVE-2026-21589 to the KEV catalog (due 2026-10-18).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-21589</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764",
      "title": "[critical] BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)",
      "summary": "China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).",
      "content_html": "<p>China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> BT26-05-RS patch for self-hosted RS 24.3.1-26.2.3 (older versions must upgrade first); SaaS auto-patched Oct 9</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-15/16: Public disclosure / Mandiant blog; CISA KEV Oct 16.</li><li>2026-10-08/09: BeyondTrust patches; SaaS auto-fixed.</li><li>2026-08-29: Mandiant/GTIG: exploitation of zero-day begins (limited victims).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-102764</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519",
      "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519",
      "title": "[high] Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability",
      "summary": "Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14.",
      "content_html": "<p>Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-14: CISA added CVE-2026-76519 to the KEV catalog (due 2026-10-17).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-76519</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/citrix-netscaler-cve-2026-88779",
      "url": "https://pwn.watch/i/citrix-netscaler-cve-2026-88779",
      "title": "[high] Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
      "summary": "Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Added to CISA KEV on 2026-10-04.",
      "content_html": "<p>Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Added to CISA KEV on 2026-10-04.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-04: CISA added CVE-2026-88779 to the KEV catalog (due 2026-10-07).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-88779</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits",
      "url": "https://pwn.watch/i/deadtag-coruna-darksword-iphone-exploits",
      "title": "[high] Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones",
      "summary": "Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't).",
      "content_html": "<p>Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't).</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Latest iOS 26, Latest updates for iOS 15 through iOS 18 (Apple says updated devices are protected)</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Report URI detailed the DeadTag operation: 660+ re-registered expired tag domains still loaded on thousands of sites (an estimated 135 million visits a month), selling visitor traffic to buyers including a Chinese-speaking crew that serves Coruna and DarkSword from a fake Polymarket page. The crew's DarkSword loader was also found on hundreds of hacked PrestaShop stores. (<a href=\"https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/\">source</a>)</li><li>2026-10-21: iVerify and Report URI published joint research: a World Cup themed Instagram ad served from ad-track[.]live infected a financial-institution employee's iPhone with P7 DarkSword while they scrolled their feed, and expired analytics and ad-tag domains were redirecting iPhone visitors to Coruna and DarkSword. (<a href=\"https://www.iverify.com/blog/blog-malvertising-coruna-darksword-iphone-exploits\">source</a>)</li></ul>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931",
      "url": "https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931",
      "title": "[high] EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability",
      "summary": "EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.",
      "content_html": "<p>EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-20: CISA added CVE-2026-106931 to the KEV catalog (due 2026-10-23).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-106931</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/fearless-wallet-extension-key-leak",
      "url": "https://pwn.watch/i/fearless-wallet-extension-key-leak",
      "title": "[critical] Fearless Wallet browser extension leaked private keys for ~20 months",
      "summary": "The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.",
      "content_html": "<p>The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> unpatched</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-21: Polkadot Community Foundation publishes security notice (14:00 UTC); 8 users report 17,286 DOT lost. (<a href=\"https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058\">source</a>)</li><li>2026-10-10: Last known period the exfiltration code was active (it could be re-enabled). (<a href=\"https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058\">source</a>)</li><li>2025-02-19: Malicious code merged into the extension's public source as part of a 'TON ecosystem' PR. (<a href=\"https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058\">source</a>)</li></ul>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/fortimail-cve-2026-104286",
      "url": "https://pwn.watch/i/fortimail-cve-2026-104286",
      "title": "[critical] FortiMail unauthenticated file-write zero-day CVE-2026-104286",
      "summary": "Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).",
      "content_html": "<p>Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 8.0.2+, 7.6.7+, 7.4.9+; 7.2.x migrate to 7.4.9+</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-05: Fortinet remediates FortiMail Cloud by updating all instances to 7.6.7 / 8.0.2 GA. (<a href=\"https://www.fortiguard.com/psirt/FG-IR-26-175\">source</a>)</li><li>2026-10: Fortinet PSIRT FG-IR-26-175 patches and mitigations.</li><li>~2026-09-30/10-01: Active exploitation and CISA alerts begin circulating.</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-104286</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-61624",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-61624",
      "title": "[high] Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability",
      "summary": "FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16.",
      "content_html": "<p>FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-16: CISA added CVE-2025-61624 to the KEV catalog (due 2026-10-19).</li></ul>\n<p><strong>CVEs:</strong> CVE-2025-61624</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce",
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce",
      "title": "[critical] GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "summary": "GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.",
      "content_html": "<p>GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne. (<a href=\"https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/\">source</a>)</li><li>2026-10-22: GitLab updated its advisory with two threat detections (&quot;Onigmo native worker crash&quot; and &quot;Org mode render error burst&quot;) to help self-managed customers spot exploitation attempts; GitLab.com and Dedicated remain patched. (<a href=\"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/\">source</a>)</li><li>2026-10-21: GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-110264</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/http3-qpack-header-accordions",
      "url": "https://pwn.watch/i/http3-qpack-header-accordions",
      "title": "[unknown] HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "summary": "FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.",
      "content_html": "<p>FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, Wireshark 4.6.2 / 4.4.12</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-20: FoxIO blog + PoC published; several stacks still unpatched.</li><li>2025-11 → 2026-07: Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.</li></ul>\n<p><strong>CVEs:</strong> CVE-2025-64702, CVE-2026-12523, CVE-2025-13945</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "unknown"
      ]
    },
    {
      "id": "https://pwn.watch/i/isc-bind-cve-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300",
      "title": "[high] ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "summary": "ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.",
      "content_html": "<p>ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> BIND 9.20.30, BIND 9.21.27, BIND Supported Preview Edition 9.20.30-S1, Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); unstable 1:9.20.30-1</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable. (<a href=\"https://security-tracker.debian.org/tracker/CVE-2026-94300\">source</a>)</li><li>2026-10-22: Japan's registry JPRS issues an urgent alert telling BIND operators to upgrade. (<a href=\"https://x.com/JPRS_official/status/2113158713569882272\">source</a>)</li><li>2026-10-21: ISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently. (<a href=\"https://kb.isc.org/docs/cve-2026-94300\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-94300</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935",
      "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935",
      "title": "[high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root",
      "summary": "Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.",
      "content_html": "<p>Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> 25.1.1.2, 25.1.3.0 / 25.1.3.1, 22.8R2.5</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-13: Ivanti discloses and patches CVE-2026-104935; Volexity publishes.</li><li>2026-10-13/16: CISA KEV listing; federal patching deadline reported as Oct 16.</li><li>2026-10-03: Volexity sees UTA0576 chaining for unauth root.</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-104935</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover",
      "url": "https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover",
      "title": "[critical] Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)",
      "summary": "A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.",
      "content_html": "<p>A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 26.4.15, 26.6.6, 26.7.2, 26.8.0 and later</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-21: Exploit-DB publishes EDB-52699 &quot;Keycloak 26.7.2 - Unauthenticated Account Takeover&quot; by Abel Maldonado (Orevim): a PoC with a safe --check mode and a --set-password takeover mode, tested on Keycloak 26.6.2. (<a href=\"https://www.exploit-db.com/exploits/52699\">source</a>)</li><li>2026-08-18: CVE-2026-18963 published with GitHub advisory GHSA-4gv3-mc9p-5wqc (critical); fixed in keycloak-services 26.4.15, 26.6.6 and 26.7.2, with Red Hat errata for Red Hat Build of Keycloak. (<a href=\"https://github.com/advisories/GHSA-4gv3-mc9p-5wqc\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-18963</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml",
      "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml",
      "title": "[critical] Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)",
      "summary": "On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.",
      "content_html": "<p>On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> unpatched · <strong>Fixed in:</strong> No fixed mainline or stable kernel yet, ksmbd race (ZDI-CAN-33774): fix commit 68f410faedaf in the ksmbd maintainer tree (linkinjeon/smb.git), not yet in a release, SMB Direct underflow (ZDI-CAN-33549): likely fixed in Stefan Metzmacher's for-7.5/smbdirect branch (unconfirmed)</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Greg Kroah-Hartman replies to the reports: &quot;For some reason you sent this to public lists, and did not include a patch&quot; and &quot;Please fix your submission process...&quot; (<a href=\"https://lore.kernel.org/dri-devel/2026102254-protector-seventy-6454@gregkh/\">source</a>)</li><li>2026-10-22: Eric Dumazet says a patch for the skb_zerocopy bug, reported by someone else a week earlier, will be available soon. (<a href=\"https://lore.kernel.org/lkml/BYAPR01MB3830CECF5D0871064C59BA0280662@BYAPR01MB3830.prod.exchangelabs.com/\">source</a>)</li><li>2026-10-22: Phoronix reports the leak. ksmbd maintainer Namjae Jeon says the ksmbd race is already fixed in his tree. (<a href=\"https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities\">source</a>)</li></ul>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nextjs-october-2026-rce-security-release",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release",
      "title": "[critical] Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)",
      "summary": "On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.",
      "content_html": "<p>On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> next 15.5.28, next 16.4.1, sharp 0.35.5 (librsvg 2.63.2)</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions. (<a href=\"https://github.com/advisories/GHSA-2464-fhr4-w9xw\">source</a>)</li><li>2026-10-14: Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features. (<a href=\"https://nextjs.org/blog/nextjs-security-update-october-14-2026\">source</a>)</li><li>2026-10-14: Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution. (<a href=\"https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-96889</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nodejs-october-2026-security-releases",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases",
      "title": "[critical] Node2Shell: Node.js Brotli RCE (CVE-2026-111497) + October security releases",
      "summary": "Node2Shell (CVE-2026-111497, also written Node 2 Shell) is a Brotli decoder out-of-bounds write in Node.js that can let an attacker run code when an app decompresses attacker-controlled Brotli data: Express 5 / body-parser 2.x request bodies sent with Content-Encoding: br, Brotli responses read by fetch(), or node:zlib on untrusted input. OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it; Node.js fixed it on Oct 21 2026 in 26.12.1, 24.22.1 and 22.23.4, alongside nine other CVEs (TLS hostname/IP bypasses, DNS NUL truncation) and a CA store refresh for the eMudhra incident. On Oct 22 Imperva Red Team, which coined the name Node2Shell, ran code on the official Node.js 24.22.0 image. NVD lists CVSS 4.0 9.2 (critical); Node.js rates it High. End-of-life lines (Node.js 20, 23, 25 and older) get no fix: upgrade to 26.12.1, 24.22.1 or 22.23.4. Bun is fixed in 1.4.4.",
      "content_html": "<p>Node2Shell (CVE-2026-111497, also written Node 2 Shell) is a Brotli decoder out-of-bounds write in Node.js that can let an attacker run code when an app decompresses attacker-controlled Brotli data: Express 5 / body-parser 2.x request bodies sent with Content-Encoding: br, Brotli responses read by fetch(), or node:zlib on untrusted input. OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it; Node.js fixed it on Oct 21 2026 in 26.12.1, 24.22.1 and 22.23.4, alongside nine other CVEs (TLS hostname/IP bypasses, DNS NUL truncation) and a CA store refresh for the eMudhra incident. On Oct 22 Imperva Red Team, which coined the name Node2Shell, ran code on the official Node.js 24.22.0 image. NVD lists CVSS 4.0 9.2 (critical); Node.js rates it High. End-of-life lines (Node.js 20, 23, 25 and older) get no fix: upgrade to 26.12.1, 24.22.1 or 22.23.4. Bun is fixed in 1.4.4.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 22.23.4, 24.22.1, 26.12.1, Bun 1.4.4</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: End-of-life Node.js 20, 23 and 25 get no fix. Anyone on them has to move to 26.12.1, 24.22.1 or 22.23.4. Bun shipped the fix in 1.4.4. (<a href=\"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497\">source</a>)</li><li>2026-10-22: NVD record for CVE-2026-111497 updated: the Google CNA scores it CVSS 9.2 (critical) and places the root bug in Google Brotli 1.0.3 through 1.2.0 (c/dec/decode.c), so other software bundling Brotli needs updating too. (<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-111497\">source</a>)</li><li>2026-10-22: Imperva Red Team (Ron Masas) names the bug Node2Shell and runs code on the official Node.js 24.22.0 image (Linux arm64) through fetch() and Express 5 / body-parser 2.x. It took several attempts; 24.22.1 rejected the same input. (<a href=\"https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows",
      "title": "[critical] OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "summary": "A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.",
      "content_html": "<p>A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> OpenCode 1.18.33</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers. (<a href=\"https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html\">source</a>)</li><li>2026-10-19: Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary. (<a href=\"https://x.com/Pillar_sec/status/2112166888985722937\">source</a>)</li><li>2026-09-28: OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security. (<a href=\"https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html\">source</a>)</li></ul>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322",
      "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322",
      "title": "[high] Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability",
      "summary": "Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14.",
      "content_html": "<p>Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-14: CISA added CVE-2026-0322 to the KEV catalog (due 2026-10-17).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-0322</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/php2shell-cve-2026-109618-109619",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619",
      "title": "[critical] PHP2Shell: critical unauthenticated RCE in PHP core",
      "summary": "Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.",
      "content_html": "<p>Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> 8.5.12, 8.4.27, 8.3.36, 8.2.35</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-23: The PHP Foundation advises keeping session.upload_progress.enabled=0 until the next PHP release to block a further, unlikely RCE vector (CVE-2026-115560). It already recommended this setting for CVE-2026-109619; only apps with a non-default serialize_handler that switch it to &quot;php&quot; at runtime can be affected. (<a href=\"https://x.com/ThePHPF/status/2113580383875019242\">source</a>)</li><li>2026-10-23: Palo Alto Networks published PAN-OS hotfix versions with ETAs from Oct 26 to Oct 30 depending on the branch (for example 12.2.4-h1 on Oct 28, 11.2.10-h16 and 10.2.18-h13 on Oct 26). Panorama and WildFire WF-500 appliances are still affected with no ETA. Until then, enable Threat IDs 543004 and 97622-97625 and lock down management access. (<a href=\"https://security.paloaltonetworks.com/CVE-2026-109618\">source</a>)</li><li>2026-10-23: Sophos and Arctic Wolf see PHP2Shell exploit attempts trying to install Potassium, a Mirai-derived DDoS botnet; SOCRadar and Hunt.io found attacker servers with exploit tooling for PHP 8.4.26. None of these attempts got a shell, and Previdian, Wordfence, Beelzebub and Dataminr also report no successful RCE so far. Censys still counts over 34.4M vulnerable PHP services as of Oct 23. (<a href=\"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-109618, CVE-2026-109619</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/plex2shell-cve-2026-96652",
      "url": "https://pwn.watch/i/plex2shell-cve-2026-96652",
      "title": "[critical] Plex2Shell: chained Plex Media Server RCE exploited for miners",
      "summary": "Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.",
      "content_html": "<p>Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 1.43.3.10861+</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-21: CISA KEV warning; patch-by Oct 23 for federal agencies.</li><li>2026-10-20: CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655). (<a href=\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\">source</a>)</li><li>2026-10-17: Honeypot exploitation (XMRig + proxy) observed.</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/pwnescape-cve-2026-99999",
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999",
      "title": "[critical] PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)",
      "summary": "Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.",
      "content_html": "<p>Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Upstream commit 6785011f8b16 and matching stable backports; vendor kernels as listed by distros</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-14/15: Mainline merge / public write-ups.</li><li>2026-10-07/08: Upstream IPv4 checksum guard accepted into net.git.</li><li>2026-08-20: Initial host-memory disclosure reported.</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-99999</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves",
      "url": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves",
      "title": "[critical] Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs",
      "summary": "Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.",
      "content_html": "<p>Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 4.0.9, 3.4.12, 3.3.13</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-23: Ruby releases 4.0.9, 3.4.12 and 3.3.13 with the upstream fixes: a double free when parsing fails after an alternation (#13332), an integer overflow in the compiled pattern size (#19020) and an overflow of internal IDs in patterns with many repeats (#16801). Ruby requested no CVEs of its own and says to track GitLab's IDs in scanners. Credit: Johan Carlsson (joaxcar) via GitLab's bug bounty; GitLab reported and coordinated. (<a href=\"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/\">source</a>)</li><li>2026-10-23: Ruby 3.3 is in security maintenance and gets the Regexp fixes as an exception. 3.3.13 also updates the default resolv gem to 0.3.2, fixing CVE-2026-80212 and CVE-2026-80213. (<a href=\"https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/\">source</a>)</li><li>2026-10-21: GitLab 19.5.1 and backports fix CVE-2026-110264 (CVSS 10.0, unauthenticated RCE from an integer overflow when compiling a crafted regex), affecting every CE/EE version from 7.0. (<a href=\"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/siemens-software-center-cve-2026-110936",
      "url": "https://pwn.watch/i/siemens-software-center-cve-2026-110936",
      "title": "[high] Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability",
      "summary": "Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20.",
      "content_html": "<p>Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-20: CISA added CVE-2026-110936 to the KEV catalog (due 2026-11-03).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-110936</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/x402-sdk-critical-flaws-v12",
      "url": "https://pwn.watch/i/x402-sdk-critical-flaws-v12",
      "title": "[critical] x402 SDK flaws could let malicious APIs drain AI agents' token balances",
      "summary": "V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical: the default client had no spending limit (a hostile API could ask for an agent's whole token balance), the TypeScript Solana facilitator accepted token approvals as payments, and the SIWx login helper signed messages for other websites. All three were fixed in the August 18 releases, but no advisory was published, so npm audit and PyPI don't warn. Update @x402/fetch, @x402/axios, @x402/extensions and @x402/svm to 2.23.0 or later.",
      "content_html": "<p>V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical: the default client had no spending limit (a hostile API could ask for an agent's whole token balance), the TypeScript Solana facilitator accepted token approvals as payments, and the SIWx login helper signed messages for other websites. All three were fixed in the August 18 releases, but no advisory was published, so npm audit and PyPI don't warn. Update @x402/fetch, @x402/axios, @x402/extensions and @x402/svm to 2.23.0 or later.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> @x402/fetch, @x402/axios, @x402/extensions, @x402/svm 2.23.0+ (latest 2.28.0), x402 (PyPI) 2.25.0 (latest), Go module v2.28.0 (latest)</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-23: The Hacker News found the foundation published no security advisory for the three flaws, so npm audit and PyPI report nothing for the last vulnerable releases. Patched clients now cap each payment at $1 and allow only recognized USD stablecoins unless the app sets its own spend controls. (<a href=\"https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html\">source</a>)</li><li>2026-10-22: V12 published 25 x402 findings with three critical ones detailed: no default spend limit, Solana ApproveChecked accepted as TransferChecked in the TypeScript facilitator (a complete payment bypass in local tests), and SIWx signing relayed login messages for other domains. The x402 Foundation had fixed all three in the August 18 releases. (<a href=\"https://v12.sh/blog/x402\">source</a>)</li></ul>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/zammad-gmbh-zammad-cve-2026-102490",
      "url": "https://pwn.watch/i/zammad-gmbh-zammad-cve-2026-102490",
      "title": "[high] Zammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerability",
      "summary": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. CISA added CVE-2026-102490, CVE-2026-102489 to the Known Exploited Vulnerabilities catalog on 2026-10-02 based on evidence of active exploitation.",
      "content_html": "<p>Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. CISA added CVE-2026-102490, CVE-2026-102489 to the Known Exploited Vulnerabilities catalog on 2026-10-02 based on evidence of active exploitation.</p>\n<p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-02: CISA added CVE-2026-102490, CVE-2026-102489 to the KEV catalog (due 2026-10-05).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-102490, CVE-2026-102489</p>",
      "date_modified": "2026-10-23T11:12:55.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380",
      "title": "[critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "summary": "A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.",
      "content_html": "<p>A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> RingRTC 2.72.0 (update Signal on every device)</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis. (<a href=\"https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/\">source</a>)</li><li>2026-10-22: SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up. (<a href=\"https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/\">source</a>)</li><li>2026-10-22: Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device. (<a href=\"https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-113380</p>",
      "date_modified": "2026-10-22T16:00:43.000Z",
      "tags": [
        "patch",
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125",
      "title": "[high] Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "summary": "Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.",
      "content_html": "<p>Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile. (<a href=\"https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8\">source</a>)</li><li>2026-10-21: Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again. (<a href=\"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8\">source</a>)</li><li>2026-10-12: Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour). (<a href=\"https://github.com/storybookjs/storybook/releases/tag/v10.6.2\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-114125</p>",
      "date_modified": "2026-10-22T12:43:45.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/nginx-october-2026-advisories",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories",
      "title": "[medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "summary": "nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.",
      "content_html": "<p>nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 1.31.7+, 1.30.6+</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-21: Security advisories and patched releases published on nginx.org.</li><li>2026-10-21: nginx 1.31.8 mainline released. (<a href=\"https://nginx.org/\">source</a>)</li><li>2026-10-14: nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025. (<a href=\"https://nginx.org/\">source</a>)</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205</p>",
      "date_modified": "2026-10-22T09:20:00.000Z",
      "tags": [
        "patch",
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/telegram-desktop-cve-2026-107181",
      "url": "https://pwn.watch/i/telegram-desktop-cve-2026-107181",
      "title": "[high] Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)",
      "summary": "CVE-2026-107181 (CVSS 8.1) in Telegram Desktop before 7.2.9 lets a crafted tg:// link inject IPC commands and exfiltrate tdata session files, enabling account takeover without the password/2FA. Fixed in 7.2.9 (mid-September); continued discussion into early October.",
      "content_html": "<p>CVE-2026-107181 (CVSS 8.1) in Telegram Desktop before 7.2.9 lets a crafted tg:// link inject IPC commands and exfiltrate tdata session files, enabling account takeover without the password/2FA. Fixed in 7.2.9 (mid-September); continued discussion into early October.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 7.2.9+</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-08/10: Public write-ups and X discussion peak.</li><li>2026-09-16: Telegram Desktop 7.2.9 ships the fix.</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-107181</p>",
      "date_modified": "2026-10-22T09:20:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw",
      "url": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw",
      "title": "[high] Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)",
      "summary": "Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.",
      "content_html": "<p>Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> October 2026 Patch Tuesday cumulative updates (KB packages per SKU)</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-10-13: Microsoft ships patches; CISA KEV lists CVE-2026-96951.</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-96951, CVE-2026-108398, CVE-2026-92707</p>",
      "date_modified": "2026-10-22T09:20:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504",
      "url": "https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504",
      "title": "[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
      "summary": "Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30.",
      "content_html": "<p>Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-30: CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-76504</p>",
      "date_modified": "2026-09-30T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/apple-coregraphics-cve-2026-86950",
      "url": "https://pwn.watch/i/apple-coregraphics-cve-2026-86950",
      "title": "[high] Apple CoreGraphics zero-day CVE-2026-86950",
      "summary": "Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.",
      "content_html": "<p>Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> iOS/iPadOS 26.7.1, macOS security updates per Apple HT149226/149228/149229</p>\n<p><strong>CVEs:</strong> CVE-2026-86950</p>",
      "date_modified": "2026-09-29T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660",
      "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660",
      "title": "[high] Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability",
      "summary": "Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25.",
      "content_html": "<p>Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-25: CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-65660</p>",
      "date_modified": "2026-09-25T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/mikrotik-routeros-cve-2026-86060",
      "url": "https://pwn.watch/i/mikrotik-routeros-cve-2026-86060",
      "title": "[high] MikroTik RouterOS: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability",
      "summary": "MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. CISA added CVE-2026-86060, CVE-2026-67277, CVE-2026-67279 to the Known Exploited Vulnerabilities catalog on 2026-09-10 based on evidence of active exploitation.",
      "content_html": "<p>MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. CISA added CVE-2026-86060, CVE-2026-67277, CVE-2026-67279 to the Known Exploited Vulnerabilities catalog on 2026-09-10 based on evidence of active exploitation.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-10: CISA added CVE-2026-86060, CVE-2026-67277, CVE-2026-67279 to the KEV catalog (due 2026-09-13).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-86060, CVE-2026-67277, CVE-2026-67279</p>",
      "date_modified": "2026-09-25T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/wordpress-core-cve-2026-87902",
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902",
      "title": "[high] WordPress Core: WordPress Core Remote File Inclusion Vulnerability",
      "summary": "WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.",
      "content_html": "<p>WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-25: CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-87902</p>",
      "date_modified": "2026-09-25T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362",
      "title": "[high] Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ",
      "summary": "Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24.",
      "content_html": "<p>Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-24: CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-71362</p>",
      "date_modified": "2026-09-24T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/linux-kernel-cve-2025-39964",
      "url": "https://pwn.watch/i/linux-kernel-cve-2025-39964",
      "title": "[high] Linux Kernel: Linux Kernel Race Condition Vulnerability",
      "summary": "Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the Known Exploited Vulnerabilities catalog on 2026-09-18 based on evidence of active exploitation.",
      "content_html": "<p>Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the Known Exploited Vulnerabilities catalog on 2026-09-18 based on evidence of active exploitation.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-18: CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the KEV catalog (due 2026-09-21).</li></ul>\n<p><strong>CVEs:</strong> CVE-2025-39964, CVE-2026-53266, CVE-2025-39682</p>",
      "date_modified": "2026-09-18T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460",
      "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460",
      "title": "[high] Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
      "summary": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Added to CISA KEV on 2026-09-16.",
      "content_html": "<p>Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Added to CISA KEV on 2026-09-16.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-16: CISA added CVE-2026-76460 to the KEV catalog (due 2026-09-19).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-76460</p>",
      "date_modified": "2026-09-16T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/google-pixel-cve-2026-58704",
      "url": "https://pwn.watch/i/google-pixel-cve-2026-58704",
      "title": "[high] Google Pixel: Google Pixel Improper Authorization Vulnerability",
      "summary": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16.",
      "content_html": "<p>Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-16: CISA added CVE-2026-58704 to the KEV catalog (due 2026-09-19).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-58704</p>",
      "date_modified": "2026-09-16T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461",
      "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461",
      "title": "[high] Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability",
      "summary": "Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Added to CISA KEV on 2026-09-14.",
      "content_html": "<p>Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Added to CISA KEV on 2026-09-14.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-14: CISA added CVE-2026-76461 to the KEV catalog (due 2026-09-17).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-76461</p>",
      "date_modified": "2026-09-14T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869",
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869",
      "title": "[high] ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
      "summary": "ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11.",
      "content_html": "<p>ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-11: CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-84869</p>",
      "date_modified": "2026-09-11T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "title": "[high] GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "summary": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.",
      "content_html": "<p>GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-11: CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-85706</p>",
      "date_modified": "2026-09-11T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016",
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016",
      "title": "[high] JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability",
      "summary": "JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. CISA added CVE-2026-42016, CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on 2026-09-11 based on evidence of active exploitation.",
      "content_html": "<p>JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. CISA added CVE-2026-42016, CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on 2026-09-11 based on evidence of active exploitation.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-11: CISA added CVE-2026-42016, CVE-2026-42018 to the KEV catalog (due 2026-09-25).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-42016, CVE-2026-42018</p>",
      "date_modified": "2026-09-11T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/chrome-zero-day-cve-2026-87491",
      "url": "https://pwn.watch/i/chrome-zero-day-cve-2026-87491",
      "title": "[high] Chrome zero-day CVE-2026-87491 (V8 OOB write)",
      "summary": "September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.",
      "content_html": "<p>September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 153.0.8010.36+, 153.0.8010.37+</p>\n<p><strong>CVEs:</strong> CVE-2026-87491</p>",
      "date_modified": "2026-09-09T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew",
      "url": "https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew",
      "title": "[high] Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using",
      "summary": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09.",
      "content_html": "<p>Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-09: CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-20079</p>",
      "date_modified": "2026-09-09T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/citrix-netscaler-cve-2026-19490",
      "url": "https://pwn.watch/i/citrix-netscaler-cve-2026-19490",
      "title": "[high] Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability",
      "summary": "Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. Added to CISA KEV on 2026-09-09.",
      "content_html": "<p>Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. Added to CISA KEV on 2026-09-09.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-09: CISA added CVE-2026-19490 to the KEV catalog (due 2026-09-12).</li></ul>\n<p><strong>CVEs:</strong> CVE-2026-19490</p>",
      "date_modified": "2026-09-09T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-25249",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-25249",
      "title": "[high] Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability",
      "summary": "Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Added to CISA KEV on 2026-09-09.",
      "content_html": "<p>Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Added to CISA KEV on 2026-09-09.</p>\n<p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p>\n<p><strong>Latest updates:</strong></p><ul><li>2026-09-09: CISA added CVE-2025-25249 to the KEV catalog (due 2026-09-12).</li></ul>\n<p><strong>CVEs:</strong> CVE-2025-25249</p>",
      "date_modified": "2026-09-09T00:00:00.000Z",
      "tags": [
        "patch",
        "high"
      ]
    }
  ]
}