{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T12:59:41.857Z",
  "stack": {
    "id": "devtools",
    "label": "Dev tools & CI",
    "kind": "ecosystem",
    "url": "https://pwn.watch/s/devtools",
    "feed": "https://pwn.watch/s/devtools/feed.xml"
  },
  "counts": {
    "incidents": 11,
    "live": 3,
    "notFullyPatched": 1,
    "patched": 10
  },
  "incidents": [
    {
      "slug": "gitlab-cve-2026-110264-regex-rce",
      "title": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce",
      "json": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "GitLab CE/EE (self-managed)",
      "stacks": [
        "devtools"
      ],
      "cveIds": [
        "CVE-2026-110264"
      ],
      "affectedVersions": [
        "All versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1"
      ],
      "fixedVersions": [
        "19.5.1",
        "19.4.3",
        "19.3.6",
        "19.2.9",
        "19.1.9",
        "19.0.10",
        "18.11.13"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T14:02:37+02:00",
      "summary": "GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again."
    },
    {
      "slug": "opencode-mcp-oauth-rce-windows",
      "title": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows",
      "json": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "OpenCode AI coding agent (Anomaly) on Windows and WSL",
      "stacks": [
        "ai",
        "devtools"
      ],
      "cveIds": [],
      "affectedVersions": [
        "OpenCode 1.0.137 through 1.18.32 on Windows and WSL"
      ],
      "fixedVersions": [
        "OpenCode 1.18.33"
      ],
      "startedAt": "2026-10-19",
      "closedAt": null,
      "updatedAt": "2026-10-22T14:02:37+02:00",
      "summary": "A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported."
    },
    {
      "slug": "ghostaction-github-workflows-oct-2026",
      "title": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026",
      "json": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "GitHub repositories / GitHub Actions (compromised maintainer accounts)",
      "stacks": [
        "github-actions",
        "devtools"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Repos where a compromised account pushed security-audit.yml / github_actions_security.yml (Oct 8-12 2026 wave), and repos with the tasks.json + public/fonts/fa-solid-400.woff2 second stage"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-08",
      "closedAt": null,
      "updatedAt": "2026-10-22T12:04:00+02:00",
      "summary": "GhostAction, a campaign first documented by GitGuardian in Sept 2025, came back in 2026. It hit 772 repos in Aug-Sep 2026, then surged on Oct 8-12: about 1,900 compromised GitHub accounts pushed fake 'security audit' workflows to 30,000+ repositories (GitGuardian). The new payload exfiltrates the repo's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around Oct 9. The operator moved on to GitHub-themed phishing (my-github.com) and a VS Code tasks.json + fake .woff2 font stealer found in 94 repos."
    },
    {
      "slug": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "title": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "json": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "GitLab Community Edition and Enterprise Edition",
      "stacks": [
        "devtools"
      ],
      "cveIds": [
        "CVE-2026-85706"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-11",
      "closedAt": "2026-09-11",
      "updatedAt": "2026-09-11",
      "summary": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11."
    },
    {
      "slug": "jfrog-artifactory-cve-2026-42016",
      "title": "JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability",
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016",
      "json": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JFrog Artifactory",
      "stacks": [
        "devtools"
      ],
      "cveIds": [
        "CVE-2026-42016",
        "CVE-2026-42018"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-11",
      "closedAt": "2026-09-11",
      "updatedAt": "2026-09-11",
      "summary": "JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. CISA added CVE-2026-42016, CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on 2026-09-11 based on evidence of active exploitation."
    },
    {
      "slug": "jfrog-artifactory-cve-2026-82329",
      "title": "JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability",
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329",
      "json": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JFrog Artifactory",
      "stacks": [
        "devtools"
      ],
      "cveIds": [
        "CVE-2026-82329"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-02",
      "closedAt": "2026-09-02",
      "updatedAt": "2026-09-02",
      "summary": "JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02."
    },
    {
      "slug": "jfrog-artifactory-cve-2026-66384",
      "title": "JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability",
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-66384",
      "json": "https://pwn.watch/i/jfrog-artifactory-cve-2026-66384.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JFrog Artifactory",
      "stacks": [
        "devtools"
      ],
      "cveIds": [
        "CVE-2026-66384"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-27",
      "closedAt": "2026-08-27",
      "updatedAt": "2026-08-27",
      "summary": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. Added to CISA KEV on 2026-08-27."
    },
    {
      "slug": "gitea-gitea-cve-2026-60004",
      "title": "Gitea Gitea: Gitea Code Injection Vulnerability",
      "url": "https://pwn.watch/i/gitea-gitea-cve-2026-60004",
      "json": "https://pwn.watch/i/gitea-gitea-cve-2026-60004.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Gitea Gitea",
      "stacks": [
        "devtools"
      ],
      "cveIds": [
        "CVE-2026-60004"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-25",
      "closedAt": "2026-08-25",
      "updatedAt": "2026-08-25",
      "summary": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Added to CISA KEV on 2026-08-25."
    },
    {
      "slug": "jetbrains-teamcity-cve-2026-63077",
      "title": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
      "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077",
      "json": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity",
      "stacks": [
        "devtools"
      ],
      "cveIds": [
        "CVE-2026-63077"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-05",
      "closedAt": "2026-08-05",
      "updatedAt": "2026-08-05",
      "summary": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05."
    },
    {
      "slug": "nx-nx-console-cve-2026-48027",
      "title": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability",
      "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027",
      "json": "https://pwn.watch/i/nx-nx-console-cve-2026-48027.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Nx Nx Console",
      "stacks": [
        "node",
        "devtools"
      ],
      "cveIds": [
        "CVE-2026-48027"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-27",
      "closedAt": "2026-05-27",
      "updatedAt": "2026-05-27",
      "summary": "Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. Added to CISA KEV on 2026-05-27."
    },
    {
      "slug": "teampcp-trivy-checkmarx-supply-chain",
      "title": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain",
      "json": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts",
      "stacks": [
        "github-actions",
        "docker",
        "devtools"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Trivy v0.69.4; trivy-action before v0.35.0; setup-trivy before v0.2.6; Checkmarx AST v2.3.28; KICS before v2.1.20 (per vendor/CSA guidance)"
      ],
      "fixedVersions": [
        "trivy-action >= v0.35.0",
        "setup-trivy >= v0.2.6",
        "Checkmarx AST/KICS patched releases per Checkmarx updates"
      ],
      "startedAt": "2026-03-01",
      "closedAt": "2026-03-31",
      "updatedAt": "2026-03-31",
      "summary": "Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026."
    }
  ],
  "changes": [
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne.",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/",
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-19",
      "title": "Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary.",
      "body": null,
      "sourceUrl": "https://x.com/Pillar_sec/status/2112166888985722937",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-16",
      "title": "OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron.",
      "body": null,
      "sourceUrl": "https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-13",
      "title": "GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted.",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-12",
      "title": "Prior critical regex patch released (separate CVE); some operators stopped there.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-11",
      "title": "Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-09",
      "title": "Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered.",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ghostaction-cloud-credentials",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08",
      "title": "Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration.",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/ghostaction-returns",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-09-28",
      "title": "OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "incidentTitle": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-11",
      "title": "CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706"
    },
    {
      "incident": "jfrog-artifactory-cve-2026-42016",
      "incidentTitle": "JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-11",
      "title": "CISA added CVE-2026-42016, CVE-2026-42018 to the KEV catalog (due 2026-09-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016"
    },
    {
      "incident": "jfrog-artifactory-cve-2026-82329",
      "incidentTitle": "JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-02",
      "title": "CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-08-31",
      "title": "2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4.",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-08-29",
      "title": "Pillar Security privately reports the flaw to Anomaly.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "jfrog-artifactory-cve-2026-66384",
      "incidentTitle": "JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-27",
      "title": "CISA added CVE-2026-66384 to the KEV catalog (due 2026-09-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-66384"
    },
    {
      "incident": "gitea-gitea-cve-2026-60004",
      "incidentTitle": "Gitea Gitea: Gitea Code Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-25",
      "title": "CISA added CVE-2026-60004 to the KEV catalog (due 2026-08-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitea-gitea-cve-2026-60004"
    },
    {
      "incident": "jetbrains-teamcity-cve-2026-63077",
      "incidentTitle": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-05",
      "title": "CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077"
    },
    {
      "incident": "nx-nx-console-cve-2026-48027",
      "incidentTitle": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-27",
      "title": "CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Trivy compromise disclosed; Microsoft guidance published.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-09",
      "title": "GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.)",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    }
  ]
}