# pwn.watch

> Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them.

Static site, rebuilt on every content change. All endpoints are plain files with CORS enabled; no auth, no rate limits on our side.

## Endpoints
- [All incidents](https://pwn.watch/incidents.json): summary of every incident (live first), with severity, patch status, CVEs, affected/fixed versions, updatedAt.
- [One incident](https://pwn.watch/i/{slug}.json): full data incl. timeline, chapters/day sections, sources, posts, and `agentBrief` (Markdown remediation brief).
- [Changes](https://pwn.watch/changes.json): every timeline update across incidents, newest first. Poll this to watch for news.
- [RSS](https://pwn.watch/feed.xml): the same updates as a feed.
- HTML pages: https://pwn.watch/ (live), https://pwn.watch/past (closed), https://pwn.watch/i/{slug}, https://pwn.watch/i/{slug}/{chapter-id | YYYY-MM-DD}.
- In-browser agents: pages register WebMCP tools (list_live_incidents, get_incident, search_incidents, list_changes_since) when navigator.modelContext exists.

## Live incidents
- [BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)](https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764.json): critical, partial, CVE-2026-102764
- [ConnectWise Cloud Backup shut down after M365 app-identity hijack](https://pwn.watch/i/connectwise-cloud-backup-m365-hijack.json): critical, partial
- [eMudhra intermediate CA private keys compromised](https://pwn.watch/i/emudhra-intermediate-ca-compromise.json): critical, partial, CVE-2026-111943, CVE-2026-91403
- [Fearless Wallet browser extension leaked private keys for ~20 months](https://pwn.watch/i/fearless-wallet-extension-key-leak.json): critical, unpatched
- [GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)](https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json): critical, patched, CVE-2026-110264
- [Plex2Shell: chained Plex Media Server RCE exploited for miners](https://pwn.watch/i/plex2shell-cve-2026-96652.json): critical, patched, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655
- [PHP2Shell: critical unauthenticated RCE in PHP core](https://pwn.watch/i/php2shell-cve-2026-109618-109619.json): critical, partial, CVE-2026-109618, CVE-2026-109619
- [FortiMail unauthenticated file-write zero-day CVE-2026-104286](https://pwn.watch/i/fortimail-cve-2026-104286.json): critical, patched, CVE-2026-104286
- [PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)](https://pwn.watch/i/pwnescape-cve-2026-99999.json): critical, patched, CVE-2026-99999
- [tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token](https://pwn.watch/i/tensorlake-npm-shai-hulud-worm.json): critical, partial, GHSA-8g63-53c9-65j2
- [LiteLLM 1.107.0 PyPI/Docker supply-chain compromise](https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json): critical, patched, MAL-2026-2144
- [Zeabur breach exposes 3.2M env-var records; company to shut down](https://pwn.watch/i/zeabur-october-2026-breach-shutdown.json): critical, partial
- [Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root](https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json): high, partial, CVE-2026-104935
- [PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken](https://pwn.watch/i/pingcap-tidb-cloud-breach.json): high, partial
- [Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)](https://pwn.watch/i/nodejs-october-2026-security-releases.json): high, patched, CVE-2026-111497, CVE-2026-105482, CVE-2026-105483
- [Railway discloses unauthorized access to customer environment variables](https://pwn.watch/i/railway-env-var-security-disclosure.json): high, partial
- [EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability](https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931.json): high, patched, CVE-2026-106931
- [GMO Onamae Desktop Cloud malware on customer VPS](https://pwn.watch/i/onamae-desktop-cloud-malware-oct.json): high, partial
- [Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability](https://pwn.watch/i/siemens-software-center-cve-2026-110936.json): high, patched, CVE-2026-110936
- [Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability](https://pwn.watch/i/fortinet-multiple-products-cve-2025-61624.json): high, patched, CVE-2025-61624
- [Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability](https://pwn.watch/i/atlassian-multiple-products-cve-2026-21589.json): high, patched, CVE-2026-21589
- [Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability](https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134.json): high, patched, CVE-2026-105134, CVE-2026-105133
- [Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability](https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519.json): high, patched, CVE-2026-76519
- [Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322.json): high, patched, CVE-2026-0322
- [Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability](https://pwn.watch/i/citrix-netscaler-cve-2026-88779.json): high, patched, CVE-2026-88779
- [Zammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerability](https://pwn.watch/i/zammad-gmbh-zammad-cve-2026-102490.json): high, patched, CVE-2026-102490, CVE-2026-102489
- [HTTP/3 QPACK “Header Accordions” memory-amplification DoS](https://pwn.watch/i/http3-qpack-header-accordions.json): unknown, partial, CVE-2025-64702, CVE-2026-12523, CVE-2025-13945

## Past incidents
- [Bullhorn staffing platform taken offline for cyber incident](https://pwn.watch/i/bullhorn-cyber-incident-oct.json): closed 2026-10-21
- [OVHcloud CLI releases backdoored on GitHub](https://pwn.watch/i/ovhcloud-cli-github-infostealer.json): closed 2026-10-20
- [TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored](https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor.json): closed 2026-10-20
- [AOMEI Backupper update servers backdoored (Mandiant)](https://pwn.watch/i/aomei-backupper-update-supply-chain.json): closed 2026-10-16
- [Rank Math PRO WordPress plugin download backdoored](https://pwn.watch/i/rank-math-pro-wordpress-backdoor.json): closed 2026-10-16
- [nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)](https://pwn.watch/i/nginx-october-2026-advisories.json): closed 2026-10-14
- [Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)](https://pwn.watch/i/windows-shell-cve-2026-96951-motw.json): closed 2026-10-13
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504.json): closed 2026-09-30
- [Apple CoreGraphics zero-day CVE-2026-86950](https://pwn.watch/i/apple-coregraphics-cve-2026-86950.json): closed 2026-09-29
- [Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660.json): closed 2026-09-25
- [WordPress Core: WordPress Core Remote File Inclusion Vulnerability](https://pwn.watch/i/wordpress-core-cve-2026-87902.json): closed 2026-09-25
- [Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ](https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362.json): closed 2026-09-24
- [Linux Kernel: Linux Kernel Race Condition Vulnerability](https://pwn.watch/i/linux-kernel-cve-2025-39964.json): closed 2026-09-18
- [Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability](https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460.json): closed 2026-09-16
- [Google Pixel: Google Pixel Improper Authorization Vulnerability](https://pwn.watch/i/google-pixel-cve-2026-58704.json): closed 2026-09-16
- [Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)](https://pwn.watch/i/telegram-desktop-cve-2026-107181.json): closed 2026-09-16
- [Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability](https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461.json): closed 2026-09-14
- [ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability](https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869.json): closed 2026-09-11
- [GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability](https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706.json): closed 2026-09-11
- [JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability](https://pwn.watch/i/jfrog-artifactory-cve-2026-42016.json): closed 2026-09-11
- [MikroTik RouterOS: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability](https://pwn.watch/i/mikrotik-routeros-cve-2026-86060.json): closed 2026-09-10
- [Chrome zero-day CVE-2026-87491 (V8 OOB write)](https://pwn.watch/i/chrome-zero-day-cve-2026-87491.json): closed 2026-09-09
- [Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew.json): closed 2026-09-09
- [Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability](https://pwn.watch/i/citrix-netscaler-cve-2026-19490.json): closed 2026-09-09
- [Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability](https://pwn.watch/i/fortinet-multiple-products-cve-2025-25249.json): closed 2026-09-09
- [Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability](https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650.json): closed 2026-09-08
- [Microsoft Windows: Microsoft Windows Link Following Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-81963.json): closed 2026-09-08
- [N-able N-central: N-able N-central Static Code Injection Vulnerability](https://pwn.watch/i/n-able-n-central-cve-2026-86218.json): closed 2026-09-08
- [Chrome zero-day CVE-2026-85046 (V8 type confusion)](https://pwn.watch/i/chrome-zero-day-cve-2026-85046.json): closed 2026-09-04
- [BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-59822.json): closed 2026-09-02
- [JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability](https://pwn.watch/i/jfrog-artifactory-cve-2026-82329.json): closed 2026-09-02
- [Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability](https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869.json): closed 2026-09-02
- [Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability](https://pwn.watch/i/sangoma-switchvox-cve-2026-9586.json): closed 2026-09-02
- [SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability](https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-83548.json): closed 2026-09-02
- [JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability](https://pwn.watch/i/jfrog-artifactory-cve-2026-66384.json): closed 2026-08-27
- [Linux Kernel: Linux Kernel Unspecified Vulnerability](https://pwn.watch/i/linux-kernel-cve-2026-53362.json): closed 2026-08-27
- [Gitea Gitea: Gitea Code Injection Vulnerability](https://pwn.watch/i/gitea-gitea-cve-2026-60004.json): closed 2026-08-25
- [Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability](https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962.json): closed 2026-08-24
- [Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability](https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570.json): closed 2026-08-21
- [TrueConf Server: TrueConf Server Code Injection Vulnerability](https://pwn.watch/i/trueconf-server-cve-2026-72530.json): closed 2026-08-20
- [MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability](https://pwn.watch/i/mlflow-mlflow-cve-2026-64849.json): closed 2026-08-19
- [Apple macOS: Apple macOS Improper Authentication Vulnerability](https://pwn.watch/i/apple-macos-cve-2026-65400.json): closed 2026-08-18
- [Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability](https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310.json): closed 2026-08-18
- [Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability](https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824.json): closed 2026-08-18
- [Microsoft SharePoint: Microsoft SharePoint Weak Authentication Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040.json): closed 2026-08-18
- [Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability](https://pwn.watch/i/ray-project-ray-cve-2025-62593.json): closed 2026-08-17
- [CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)](https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august.json): closed 2026-08-15
- [Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and S](https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-asa-and-secure-firewall-threat.json): closed 2026-08-11
- [Metabase Metabase: Metabase SQL Injection Vulnerability](https://pwn.watch/i/metabase-metabase-cve-2026-72898.json): closed 2026-08-11
- [Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability](https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820.json): closed 2026-08-11
- [Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability](https://pwn.watch/i/progress-loadmaster-cve-2026-8037.json): closed 2026-08-07
- [JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json): closed 2026-08-05
- [Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability](https://pwn.watch/i/apache-tomcat-cve-2026-34486.json): closed 2026-08-04
- [IBM Langflow: IBM Langflow Code Injection Vulnerability](https://pwn.watch/i/ibm-langflow-cve-2026-9198.json): closed 2026-08-04
- [N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability](https://pwn.watch/i/n-able-n-central-cve-2026-18577.json): closed 2026-08-03
- [Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316.json): closed 2026-07-29
- [Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812.json): closed 2026-07-27
- [Fortinet FortiOS: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability](https://pwn.watch/i/fortinet-fortios-cve-2025-68686.json): closed 2026-07-27
- [Check Point SmartConsole: Check Point SmartConsole Improper Authentication Vulnerability](https://pwn.watch/i/check-point-smartconsole-cve-2026-16232.json): closed 2026-07-22
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ](https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522.json): closed 2026-07-22
- [Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2026-0770.json): closed 2026-07-21
- [WordPress Core: WordPress Core SQL Injection Vulnerability](https://pwn.watch/i/wordpress-core-cve-2026-60137.json): closed 2026-07-21
- [Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability](https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089.json): closed 2026-07-16
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644.json): closed 2026-07-16
- [Oracle E-Business Suite: Oracle E-Business Suite Improper Privilege Management Vulnerability](https://pwn.watch/i/oracle-e-business-suite-cve-2026-46817.json): closed 2026-07-15
- [Microsoft Active Directory Federation Services: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ](https://pwn.watch/i/microsoft-active-directory-federation-services-cve-2026-56155.json): closed 2026-07-14
- [Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164.json): closed 2026-07-14
- [SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability](https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409.json): closed 2026-07-14
- [Adobe ColdFusion: Adobe ColdFusion Path Traversal Vulnerability](https://pwn.watch/i/adobe-coldfusion-cve-2026-48282.json): closed 2026-07-07
- [Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability](https://pwn.watch/i/joomlack-page-builder-cve-2026-56290.json): closed 2026-07-07
- [Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2026-55255.json): closed 2026-07-07
- [Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659.json): closed 2026-07-01
- [Chrome zero-day CVE-2026-11645 (V8 OOB)](https://pwn.watch/i/chrome-zero-day-cve-2026-11645.json): closed 2026-06-30
- [Cisco Unified Communications Manager: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability](https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20230.json): closed 2026-06-25
- [PTC Windchill and FlexPLM: PTC Windchill and FlexPLM Improper Input Validation Vulnerability](https://pwn.watch/i/ptc-windchill-and-flexplm-cve-2026-12569.json): closed 2026-06-25
- [Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability](https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907.json): closed 2026-06-16
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20262.json): closed 2026-06-15
- [Dashlane 2FA brute-force; encrypted vaults for <20 accounts](https://pwn.watch/i/dashlane-2fa-bruteforce-june.json): closed 2026-06-15
- [Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273.json): closed 2026-06-12
- [Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability](https://pwn.watch/i/ivanti-sentry-cve-2026-10520.json): closed 2026-06-11
- [Arista Extensible Operating System: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability](https://pwn.watch/i/arista-extensible-operating-system-cve-2026-7473.json): closed 2026-06-09
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20245.json): closed 2026-06-09
- [BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-42271.json): closed 2026-06-08
- [Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability](https://pwn.watch/i/check-point-security-gateway-cve-2026-50751.json): closed 2026-06-08
- [SolarWinds Serv-U: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability](https://pwn.watch/i/solarwinds-serv-u-cve-2026-28318.json): closed 2026-06-05
- [Android Framework: Android Framework Integer Overflow Vulnerability](https://pwn.watch/i/android-framework-cve-2025-48595.json): closed 2026-06-02
- [Mini Shai-Hulud hits AntV / timeago.js npm ecosystem](https://pwn.watch/i/shai-hulud-antv-npm-may.json): closed 2026-06-01
- [Instructure Canvas Free-for-Teacher breach (ShinyHunters)](https://pwn.watch/i/canvas-instructure-shinyhunters-may.json): closed 2026-05-31
- [OpenAI employee devices hit via TanStack Mini Shai-Hulud wave](https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud.json): closed 2026-05-31
- [Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257.json): closed 2026-05-29
- [Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability](https://pwn.watch/i/nx-nx-console-cve-2026-48027.json): closed 2026-05-27
- [TanStack TanStack: TanStack Unspecified Vulnerability](https://pwn.watch/i/tanstack-tanstack-cve-2026-45321.json): closed 2026-05-27
- [Drupal Core: Drupal Core SQL Injection Vulnerability](https://pwn.watch/i/drupal-core-cve-2026-9082.json): closed 2026-05-22
- [Langflow Langflow: Langflow Origin Validation Error Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2025-34291.json): closed 2026-05-21
- [Microsoft Defender: Microsoft Defender Link Following Vulnerability](https://pwn.watch/i/microsoft-defender-cve-2026-41091.json): closed 2026-05-20
- [Microsoft Microsoft: Microsoft Exchange Server Cross-Site Scripting Vulnerability](https://pwn.watch/i/microsoft-microsoft-cve-2026-42897.json): closed 2026-05-15
- [Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182.json): closed 2026-05-14
- [BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-42208.json): closed 2026-05-08
- [Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973.json): closed 2026-05-07
- [Next.js / React Server Components May 2026 security release](https://pwn.watch/i/nextjs-react-may-2026-security-release.json): closed 2026-05-07
- [Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0300.json): closed 2026-05-06
- [Linux Kernel: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability](https://pwn.watch/i/linux-kernel-cve-2026-31431.json): closed 2026-05-01
- [Anthropic investigates unauthorized access to Claude Mythos Preview via vendor](https://pwn.watch/i/anthropic-claude-mythos-preview-vendor-access.json): closed 2026-04-30
- [Chrome zero-day CVE-2026-5281 (Dawn / WebGPU UAF)](https://pwn.watch/i/chrome-zero-day-cve-2026-5281-dawn.json): closed 2026-04-30
- [FortiClient EMS CVE-2026-35616 exploited (CVSS 9.1)](https://pwn.watch/i/forticlient-ems-cve-2026-35616.json): closed 2026-04-30
- [Ivanti EPMM code injection CVE-2026-1340 exploited](https://pwn.watch/i/ivanti-epmm-cve-2026-1340.json): closed 2026-04-30
- [WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json): closed 2026-04-30
- [Microsoft Windows: Microsoft Windows Protection Mechanism Failure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-32202.json): closed 2026-04-28
- [Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability](https://pwn.watch/i/microsoft-defender-cve-2026-33825.json): closed 2026-04-22
- [Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-20133.json): closed 2026-04-20
- [Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-manger-cve-2026-20122.json): closed 2026-04-20
- [Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability](https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-48700.json): closed 2026-04-20
- [Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability](https://pwn.watch/i/apache-activemq-cve-2026-34197.json): closed 2026-04-16
- [Microsoft SharePoint Server: Microsoft SharePoint Server Improper Input Validation Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201.json): closed 2026-04-14
- [Adobe Acrobat and Reader: Adobe Acrobat and Reader Prototype Pollution Vulnerability](https://pwn.watch/i/adobe-acrobat-and-reader-cve-2026-34621.json): closed 2026-04-13
- [Fortinet FortiClient EMS: Fortinet FortiClient EMS SQL Injection Vulnerability](https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643.json): closed 2026-04-13
- [Microsoft Windows: Microsoft Windows Link Following Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-60710.json): closed 2026-04-13
- [React Server Components DoS CVE-2026-23869 (April Next.js advisory)](https://pwn.watch/i/react-rsc-dos-cve-2026-23869-april.json): closed 2026-04-08
- [Stryker hit by Handala data-wiping attack](https://pwn.watch/i/stryker-handala-wiper-march.json): closed 2026-04-05
- [Chrome zero-days CVE-2026-3909 (Skia) and CVE-2026-3910 (V8)](https://pwn.watch/i/chrome-zero-days-cve-2026-3909-3910.json): closed 2026-03-31
- [LexisNexis breach (FulcrumSec claims React2Shell path)](https://pwn.watch/i/lexisnexis-breach-react2shell-claim.json): closed 2026-03-31
- [TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions](https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain.json): closed 2026-03-31
- [Citrix NetScaler: Citrix NetScaler Out-of-Bounds Read Vulnerability](https://pwn.watch/i/citrix-netscaler-cve-2026-3055.json): closed 2026-03-30
- [F5 BIG-IP: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability](https://pwn.watch/i/f5-big-ip-cve-2025-53521.json): closed 2026-03-27
- [Langflow Langflow: Langflow Code Injection Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2026-33017.json): closed 2026-03-25
- [Apple Multiple Products: Apple Multiple Products Improper Locking Vulnerability](https://pwn.watch/i/apple-multiple-products-cve-2025-43510.json): closed 2026-03-20
- [Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131.json): closed 2026-03-19
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963.json): closed 2026-03-18
- [Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability](https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-66376.json): closed 2026-03-18
- [Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603.json): closed 2026-03-09
- [SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399.json): closed 2026-03-09
- [Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability](https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719.json): closed 2026-03-03
- [Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)](https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive.json): closed 2026-02-28
- [European Commission & Dutch authorities hit via Ivanti EPMM zero-days](https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach.json): closed 2026-02-28
- [UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)](https://pwn.watch/i/singapore-unc3886-telecom-espionage.json): closed 2026-02-28
- [Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127.json): closed 2026-02-25
- [Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/roundcube-webmail-cve-2025-49113.json): closed 2026-02-20
- [Chrome zero-day CVE-2026-2441 (CSS use-after-free)](https://pwn.watch/i/chrome-zero-day-cve-2026-2441.json): closed 2026-02-16
- [BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln](https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731.json): closed 2026-02-13
- [Apple Multiple Products: Apple Multiple Buffer Overflow Vulnerability](https://pwn.watch/i/apple-multiple-products-cve-2026-20700.json): closed 2026-02-12
- [SolarWinds Web Help Desk: SolarWinds Web Help Desk Security Control Bypass Vulnerability](https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40536.json): closed 2026-02-12
- [Microsoft Office: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability](https://pwn.watch/i/microsoft-office-cve-2026-21514.json): closed 2026-02-10
- [Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-21513.json): closed 2026-02-10
- [React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability](https://pwn.watch/i/react-native-community-cli-cve-2025-11953.json): closed 2026-02-05
- [SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/smartertools-smartermail-cve-2026-24423.json): closed 2026-02-05
- [Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability](https://pwn.watch/i/sangoma-freepbx-cve-2025-64328.json): closed 2026-02-03
- [SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551.json): closed 2026-02-03
- [ShinyHunters leak Crunchbase data (~2M records)](https://pwn.watch/i/crunchbase-shinyhunters-jan.json): closed 2026-01-31
- [Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281.json): closed 2026-01-29
- [Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability](https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858.json): closed 2026-01-27
- [Microsoft Office: Microsoft Office Security Feature Bypass Vulnerability](https://pwn.watch/i/microsoft-office-cve-2026-21509.json): closed 2026-01-26
- [SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability](https://pwn.watch/i/smartertools-smartermail-cve-2025-52691.json): closed 2026-01-26
- [Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability](https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2025-68645.json): closed 2026-01-22
- [Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability](https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045.json): closed 2026-01-21
- [Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-20805.json): closed 2026-01-13