# Dev tools & CI security incidents · pwn.watch

> Security incidents affecting Self-hosted git, CI/CD, artifact registries and editor extensions.

Page: https://pwn.watch/t/devtools · generated 2026-10-22T17:32:17.031Z

## Status (as of 2026-10-22)
- Incidents: 24 (3 live, 1 live and not fully patched, 23 patched)
- Days without a Dev tools & CI security incident: 0 (1 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-21

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/devtools.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/devtools/feed.xml
- This file: https://pwn.watch/t/devtools/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)](https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce) ([json](https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json)): critical, live, patched, started 2026-10-21, CVE-2026-110264
- [Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)](https://pwn.watch/i/storybook-dev-server-cve-2026-114125) ([json](https://pwn.watch/i/storybook-dev-server-cve-2026-114125.json)): high, closed, patched, started 2026-10-21, CVE-2026-114125
- [OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)](https://pwn.watch/i/opencode-mcp-oauth-rce-windows) ([json](https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json)): critical, live, patched, started 2026-10-19
- [GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos](https://pwn.watch/i/ghostaction-github-workflows-oct-2026) ([json](https://pwn.watch/i/ghostaction-github-workflows-oct-2026.json)): high, live, partial, started 2026-10-08
- [GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability](https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706) ([json](https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706.json)): high, closed, patched, started 2026-09-11, CVE-2026-85706
- [JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability](https://pwn.watch/i/jfrog-artifactory-cve-2026-42016) ([json](https://pwn.watch/i/jfrog-artifactory-cve-2026-42016.json)): high, closed, patched, started 2026-09-11, CVE-2026-42016, CVE-2026-42018
- [JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability](https://pwn.watch/i/jfrog-artifactory-cve-2026-82329) ([json](https://pwn.watch/i/jfrog-artifactory-cve-2026-82329.json)): high, closed, patched, started 2026-09-02, CVE-2026-82329
- [JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability](https://pwn.watch/i/jfrog-artifactory-cve-2026-66384) ([json](https://pwn.watch/i/jfrog-artifactory-cve-2026-66384.json)): high, closed, patched, started 2026-08-27, CVE-2026-66384
- [Gitea Gitea: Gitea Code Injection Vulnerability](https://pwn.watch/i/gitea-gitea-cve-2026-60004) ([json](https://pwn.watch/i/gitea-gitea-cve-2026-60004.json)): high, closed, patched, started 2026-08-25, CVE-2026-60004
- [JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077) ([json](https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json)): high, closed, patched, started 2026-08-05, CVE-2026-63077
- [Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability](https://pwn.watch/i/nx-nx-console-cve-2026-48027) ([json](https://pwn.watch/i/nx-nx-console-cve-2026-48027.json)): high, closed, patched, started 2026-05-27, CVE-2026-48027
- [TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions](https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain) ([json](https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain.json)): critical, closed, patched, started 2026-03-01
- [GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode](https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025) ([json](https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025.json)): high, closed, patched, started 2025-10-17
- [Jenkins: Remote Code Execution Vulnerability](https://pwn.watch/i/jenkins-cve-2017-1000353) ([json](https://pwn.watch/i/jenkins-cve-2017-1000353.json)): critical, closed, patched, started 2025-10-02, CVE-2017-1000353
- [Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen](https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025) ([json](https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json)): high, closed, no-fix-needed, started 2025-10-01
- [Git: Link Following Vulnerability](https://pwn.watch/i/git-cve-2025-48384) ([json](https://pwn.watch/i/git-cve-2025-48384.json)): high, closed, patched, started 2025-08-25, CVE-2025-48384
- [reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability](https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154) ([json](https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154.json)): high, closed, patched, started 2025-03-24, CVE-2025-30154
- [tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs](https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066) ([json](https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066.json)): critical, closed, patched, started 2025-03-14, CVE-2025-30066
- [JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199) ([json](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json)): critical, closed, patched, started 2024-03-04, CVE-2024-27198, CVE-2024-27199
- [Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE](https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897) ([json](https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json)): critical, closed, patched, started 2024-01-24, CVE-2024-23897
- [GitLab Community and Enterprise Editions Improper Access Control](https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028) ([json](https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028.json)): critical, closed, patched, started 2024-01-12, CVE-2023-7028
- [TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793) ([json](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json)): critical, closed, patched, started 2023-09-18, CVE-2023-42793
- [GitHub's RSA SSH host key briefly exposed in a public repo](https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023) ([json](https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023.json)): medium, closed, patched, started 2023-03-24
- [CircleCI breach: rotate every secret](https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023) ([json](https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023.json)): critical, closed, no-fix-needed, started 2023-01-04