# Ransomware security incidents · pwn.watch

> Security incidents tagged Ransomware (vendor, product, platform or attack type).

Page: https://pwn.watch/t/ransomware · generated 2026-10-23T03:01:01.167Z

## Status (as of 2026-10-23)
- Incidents: 117 (0 live, 0 live and not fully patched, 116 patched)
- Days without a Ransomware security incident: 66
- Newest incident started: 2026-08-18

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/ransomware.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/ransomware/feed.xml
- This file: https://pwn.watch/t/ransomware/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability](https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310) ([json](https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310.json)): high, closed, patched, started 2026-08-18, CVE-2026-59310
- [JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077) ([json](https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json)): high, closed, patched, started 2026-08-05, CVE-2026-63077
- [Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316) ([json](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20316.json)): high, closed, patched, started 2026-07-29, CVE-2026-20316
- [SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability](https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409) ([json](https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409.json)): high, closed, patched, started 2026-07-14, CVE-2026-15409, CVE-2026-15410
- [Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659.json)): high, closed, patched, started 2026-07-01, CVE-2026-45659
- [PTC Windchill and FlexPLM: PTC Windchill and FlexPLM Improper Input Validation Vulnerability](https://pwn.watch/i/ptc-windchill-and-flexplm-cve-2026-12569) ([json](https://pwn.watch/i/ptc-windchill-and-flexplm-cve-2026-12569.json)): high, closed, patched, started 2026-06-25, CVE-2026-12569
- [Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273) ([json](https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273.json)): high, closed, patched, started 2026-06-12, CVE-2026-35273
- [Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability](https://pwn.watch/i/check-point-security-gateway-cve-2026-50751) ([json](https://pwn.watch/i/check-point-security-gateway-cve-2026-50751.json)): high, closed, patched, started 2026-06-08, CVE-2026-50751
- [Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257) ([json](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257.json)): high, closed, patched, started 2026-05-29, CVE-2026-0257
- [Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability](https://pwn.watch/i/nx-nx-console-cve-2026-48027) ([json](https://pwn.watch/i/nx-nx-console-cve-2026-48027.json)): high, closed, patched, started 2026-05-27, CVE-2026-48027
- [TanStack TanStack: TanStack Unspecified Vulnerability](https://pwn.watch/i/tanstack-tanstack-cve-2026-45321) ([json](https://pwn.watch/i/tanstack-tanstack-cve-2026-45321.json)): high, closed, patched, started 2026-05-27, CVE-2026-45321
- [WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940) ([json](https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json)): high, closed, patched, started 2026-04-30, CVE-2026-41940
- [Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability](https://pwn.watch/i/microsoft-defender-cve-2026-33825) ([json](https://pwn.watch/i/microsoft-defender-cve-2026-33825.json)): high, closed, patched, started 2026-04-22, CVE-2026-33825
- [Microsoft Windows: Microsoft Windows Link Following Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-60710) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-60710.json)): high, closed, patched, started 2026-04-13, CVE-2025-60710, CVE-2023-36424
- [Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131) ([json](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-cve-2026-20131.json)): high, closed, patched, started 2026-03-19, CVE-2026-20131
- [SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399) ([json](https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399.json)): high, closed, patched, started 2026-03-09, CVE-2025-26399
- [BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln](https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731) ([json](https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731.json)): high, closed, patched, started 2026-02-13, CVE-2026-1731
- [SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/smartertools-smartermail-cve-2026-24423) ([json](https://pwn.watch/i/smartertools-smartermail-cve-2026-24423.json)): high, closed, patched, started 2026-02-05, CVE-2026-24423
- [SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability](https://pwn.watch/i/smartertools-smartermail-cve-2025-52691) ([json](https://pwn.watch/i/smartertools-smartermail-cve-2025-52691.json)): high, closed, patched, started 2026-01-26, CVE-2025-52691, CVE-2026-23760
- [WatchGuard Firebox: Firebox Out of Bounds Write Vulnerability](https://pwn.watch/i/watchguard-firebox-cve-2025-14733) ([json](https://pwn.watch/i/watchguard-firebox-cve-2025-14733.json)): critical, closed, patched, started 2025-12-19, CVE-2025-14733
- [React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js](https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182) ([json](https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json)): critical, closed, patched, started 2025-12-03, CVE-2025-55182
- [Oracle E-Business Suite: E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability](https://pwn.watch/i/oracle-e-business-suite-cve-2025-61884) ([json](https://pwn.watch/i/oracle-e-business-suite-cve-2025-61884.json)): critical, closed, patched, started 2025-10-20, CVE-2025-61884
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)](https://pwn.watch/i/microsoft-windows-cve-2011-3402) ([json](https://pwn.watch/i/microsoft-windows-cve-2011-3402.json)): critical, closed, patched, started 2025-10-06, CVE-2011-3402, CVE-2013-3918, CVE-2021-43226
- [Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035) ([json](https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035.json)): critical, closed, patched, started 2025-09-29, CVE-2025-10035
- [Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)](https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882) ([json](https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json)): critical, closed, patched, started 2025-09-29, CVE-2025-61882
- [Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)](https://pwn.watch/i/asahi-ransomware-qilin-september-2025) ([json](https://pwn.watch/i/asahi-ransomware-qilin-september-2025.json)): high, closed, no-fix-needed, started 2025-09-29
- [Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin](https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025) ([json](https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025.json)): high, closed, no-fix-needed, started 2025-09-19
- [Jaguar Land Rover cyberattack stops car production for five weeks](https://pwn.watch/i/jaguar-land-rover-cyberattack-production-shutdown-2025) ([json](https://pwn.watch/i/jaguar-land-rover-cyberattack-production-shutdown-2025.json)): critical, closed, no-fix-needed, started 2025-08-31
- [RARLAB WinRAR: WinRAR Path Traversal Vulnerability](https://pwn.watch/i/rarlab-winrar-cve-2025-8088) ([json](https://pwn.watch/i/rarlab-winrar-cve-2025-8088.json)): critical, closed, patched, started 2025-08-12, CVE-2025-8088
- [ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770) ([json](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json)): critical, closed, patched, started 2025-07-18, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770
- [Ingram Micro SafePay ransomware takes down ordering systems for a week](https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025) ([json](https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025.json)): high, closed, no-fix-needed, started 2025-07-03
- [Fortinet FortiOS: FortiOS Use of Hard-Coded Credentials Vulnerability](https://pwn.watch/i/fortinet-fortios-cve-2019-6693) ([json](https://pwn.watch/i/fortinet-fortios-cve-2019-6693.json)): critical, closed, patched, started 2025-06-25, CVE-2019-6693
- [CitrixBleed 2: NetScaler memory leak exploited to hijack sessions](https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777) ([json](https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777.json)): critical, closed, patched, started 2025-06-17, CVE-2025-5777
- [SAP NetWeaver: NetWeaver Deserialization Vulnerability](https://pwn.watch/i/sap-netweaver-cve-2025-42999) ([json](https://pwn.watch/i/sap-netweaver-cve-2025-42999.json)): critical, closed, patched, started 2025-05-15, CVE-2025-42999
- [Langflow: Missing Authentication Vulnerability](https://pwn.watch/i/langflow-cve-2025-3248) ([json](https://pwn.watch/i/langflow-cve-2025-3248.json)): critical, closed, patched, started 2025-05-05, CVE-2025-3248
- [SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)](https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324) ([json](https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324.json)): critical, closed, patched, started 2025-04-24, CVE-2025-31324
- [Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days](https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025) ([json](https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025.json)): critical, closed, no-fix-needed, started 2025-04-22
- [Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-29824) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-29824.json)): critical, closed, patched, started 2025-04-08, CVE-2025-29824
- [CrushFTP: Authentication Bypass Vulnerability](https://pwn.watch/i/crushftp-cve-2025-31161) ([json](https://pwn.watch/i/crushftp-cve-2025-31161.json)): critical, closed, patched, started 2025-04-07, CVE-2025-31161
- [Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability](https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457) ([json](https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457.json)): critical, closed, patched, started 2025-04-04, CVE-2025-22457
- [Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability](https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472) ([json](https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472.json)): critical, closed, patched, started 2025-03-18, CVE-2025-24472
- [Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)](https://pwn.watch/i/microsoft-windows-cve-2025-24983) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-24983.json)): critical, closed, patched, started 2025-03-11, CVE-2025-24983, CVE-2025-24984, CVE-2025-24985…
- [VMware ESXi: ESXi Arbitrary Write Vulnerability](https://pwn.watch/i/vmware-esxi-cve-2025-22225) ([json](https://pwn.watch/i/vmware-esxi-cve-2025-22225.json)): critical, closed, patched, started 2025-03-04, CVE-2025-22225
- [Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2018-8639) ([json](https://pwn.watch/i/microsoft-windows-cve-2018-8639.json)): critical, closed, patched, started 2025-03-03, CVE-2018-8639
- [SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability](https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704) ([json](https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704.json)): critical, closed, patched, started 2025-02-18, CVE-2024-53704
- [SimpleHelp: Path Traversal Vulnerability](https://pwn.watch/i/simplehelp-cve-2024-57727) ([json](https://pwn.watch/i/simplehelp-cve-2024-57727.json)): critical, closed, patched, started 2025-02-13, CVE-2024-57727
- [Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerability](https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574) ([json](https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574.json)): critical, closed, unpatched, started 2025-02-06, CVE-2020-29574
- [SonicWall SMA1000 Appliances: SMA1000 Appliances Deserialization Vulnerability](https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2025-23006) ([json](https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2025-23006.json)): critical, closed, patched, started 2025-01-24, CVE-2025-23006
- [Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability](https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591) ([json](https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591.json)): critical, closed, patched, started 2025-01-14, CVE-2024-55591
- [Qlik Sense: Sense HTTP Tunneling Vulnerability](https://pwn.watch/i/qlik-sense-cve-2023-48365) ([json](https://pwn.watch/i/qlik-sense-cve-2023-48365.json)): critical, closed, patched, started 2025-01-13, CVE-2023-48365
- [Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)](https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json)): critical, closed, patched, started 2025-01-08, CVE-2025-0282
- [Mitel MiCollab: 2 exploited vulnerabilities (CVE-2024-41713, CVE-2024-55550)](https://pwn.watch/i/mitel-micollab-cve-2024-41713) ([json](https://pwn.watch/i/mitel-micollab-cve-2024-41713.json)): critical, closed, patched, started 2025-01-07, CVE-2024-41713, CVE-2024-55550
- [Cleo file transfer zero-days exploited by Clop for data theft](https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956) ([json](https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956.json)): critical, closed, patched, started 2024-12-03, CVE-2024-50623, CVE-2024-55956
- [Zyxel Multiple Firewalls Path Traversal](https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667) ([json](https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667.json)): high, closed, patched, started 2024-11-27, CVE-2024-11667
- [Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function](https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461) ([json](https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461.json)): critical, closed, patched, started 2024-11-25, CVE-2023-28461
- [Palo Alto PAN-OS management interface auth bypass + privilege escalation](https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474) ([json](https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json)): critical, closed, patched, started 2024-11-18, CVE-2024-0012, CVE-2024-9474
- [Microsoft November 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039) ([json](https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039.json)): high, closed, patched, started 2024-11-12, CVE-2024-43451, CVE-2024-49039
- [CyberPersons CyberPanel: 2 actively exploited vulnerabilities](https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378) ([json](https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378.json)): critical, closed, patched, started 2024-10-29, CVE-2024-51567, CVE-2024-51378
- [Mozilla Firefox Use-After-Free](https://pwn.watch/i/mozilla-firefox-cve-2024-9680) ([json](https://pwn.watch/i/mozilla-firefox-cve-2024-9680.json)): critical, closed, patched, started 2024-10-09, CVE-2024-9680
- [Microsoft SQL Server Reporting Services Remote Code Execution](https://pwn.watch/i/microsoft-sql-server-cve-2020-0618) ([json](https://pwn.watch/i/microsoft-sql-server-cve-2020-0618.json)): critical, closed, patched, started 2024-09-18, CVE-2020-0618
- [Linux Kernel PIE Stack Buffer Corruption](https://pwn.watch/i/linux-kernel-cve-2017-1000253) ([json](https://pwn.watch/i/linux-kernel-cve-2017-1000253.json)): high, closed, patched, started 2024-09-09, CVE-2017-1000253
- [Veeam Backup and Replication Deserialization](https://pwn.watch/i/veeam-backup-replication-cve-2024-40711) ([json](https://pwn.watch/i/veeam-backup-replication-cve-2024-40711.json)): critical, closed, patched, started 2024-09-07, CVE-2024-40711
- [Progress WhatsUp Gold SQL Injection](https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670) ([json](https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670.json)): critical, closed, patched, started 2024-08-29, CVE-2024-6670
- [SonicWall SonicOS Improper Access Control](https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766) ([json](https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766.json)): critical, closed, patched, started 2024-08-23, CVE-2024-40766
- [Microsoft SharePoint Deserialization](https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094.json)): high, closed, patched, started 2024-07-09, CVE-2024-38094
- [VMware ESXi Authentication Bypass](https://pwn.watch/i/vmware-esxi-cve-2024-37085) ([json](https://pwn.watch/i/vmware-esxi-cve-2024-37085.json)): medium, closed, patched, started 2024-06-25, CVE-2024-37085
- [Microsoft Windows Kernel TOCTOU Race Condition](https://pwn.watch/i/microsoft-windows-cve-2024-30088) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-30088.json)): high, closed, patched, started 2024-06-11, CVE-2024-30088
- [PHP-CGI argument injection on Windows (CVE-2024-4577)](https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577) ([json](https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json)): critical, closed, patched, started 2024-06-06, CVE-2024-4577
- [Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine](https://pwn.watch/i/rejetto-http-file-server-cve-2024-23692) ([json](https://pwn.watch/i/rejetto-http-file-server-cve-2024-23692.json)): critical, closed, patched, started 2024-05-31, CVE-2024-23692
- [Check Point VPN gateway arbitrary file read (CVE-2024-24919) exploited](https://pwn.watch/i/check-point-quantum-gateway-info-disclosure-cve-2024-24919) ([json](https://pwn.watch/i/check-point-quantum-gateway-info-disclosure-cve-2024-24919.json)): high, closed, patched, started 2024-05-28, CVE-2024-24919
- [NextGen Healthcare Mirth Connect Deserialization of Untrusted Data](https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208) ([json](https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208.json)): critical, closed, patched, started 2024-05-20, CVE-2023-43208
- [Microsoft May 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051) ([json](https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051.json)): high, closed, patched, started 2024-05-14, CVE-2024-30040, CVE-2024-30051
- [Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)](https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400) ([json](https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400.json)): critical, closed, patched, started 2024-04-12, CVE-2024-3400
- [Microsoft SharePoint Server Code Injection](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955.json)): high, closed, patched, started 2024-03-26, CVE-2023-24955
- [Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection](https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529) ([json](https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529.json)): critical, closed, patched, started 2024-03-25, CVE-2021-44529
- [Fortinet FortiClient EMS SQL Injection](https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788) ([json](https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788.json)): critical, closed, patched, started 2024-03-12, CVE-2023-48788
- [Microsoft Windows Error Reporting Service Improper Privilege Management](https://pwn.watch/i/microsoft-windows-cve-2024-26169) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-26169.json)): high, closed, patched, started 2024-03-12, CVE-2024-26169
- [JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199) ([json](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json)): critical, closed, patched, started 2024-03-04, CVE-2024-27198, CVE-2024-27199
- [Change Healthcare ransomware attack (ALPHV/BlackCat)](https://pwn.watch/i/change-healthcare-ransomware-attack) ([json](https://pwn.watch/i/change-healthcare-ransomware-attack.json)): critical, closed, no-fix-needed, started 2024-02-21
- [ConnectWise ScreenConnect auth bypass mass-exploited](https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709) ([json](https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709.json)): critical, closed, patched, started 2024-02-19, CVE-2024-1709, CVE-2024-1708
- [Cisco ASA and FTD Information Disclosure](https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259) ([json](https://pwn.watch/i/cisco-adaptive-security-appliance-asa-and-firepowe-cve-2020-3259.json)): high, closed, patched, started 2024-02-15, CVE-2020-3259
- [Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control](https://pwn.watch/i/microsoft-windows-cve-2024-21338) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-21338.json)): high, closed, patched, started 2024-02-13, CVE-2024-21338
- [Microsoft February 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412) ([json](https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412.json)): high, closed, patched, started 2024-02-13, CVE-2024-21351, CVE-2024-21412
- [Fortinet FortiOS Out-of-Bound Write](https://pwn.watch/i/fortinet-fortios-cve-2024-21762) ([json](https://pwn.watch/i/fortinet-fortios-cve-2024-21762.json)): critical, closed, patched, started 2024-02-09, CVE-2024-21762
- [Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root](https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086) ([json](https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086.json)): high, closed, patched, started 2024-01-31, CVE-2024-1086
- [Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE](https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897) ([json](https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json)): critical, closed, patched, started 2024-01-24, CVE-2024-23897
- [Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082.json)): critical, closed, patched, started 2024-01-18, CVE-2023-35082
- [Atlassian Confluence Data Center and Server Template Injection](https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527) ([json](https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json)): critical, closed, patched, started 2024-01-16, CVE-2023-22527
- [Ivanti Connect Secure zero-days chained for mass VPN compromise](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json)): critical, closed, patched, started 2024-01-10, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893
- [Microsoft SharePoint Server Privilege Escalation](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357.json)): critical, closed, patched, started 2024-01-10, CVE-2023-29357
- [Adobe ColdFusion: 2 actively exploited vulnerabilities](https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203) ([json](https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203.json)): critical, closed, patched, started 2024-01-08, CVE-2023-29300, CVE-2023-38203
- [Qlik Sense: 2 exploited vulnerabilities (CVE-2023-41265, CVE-2023-41266)](https://pwn.watch/i/qlik-sense-cve-2023-41265-41266) ([json](https://pwn.watch/i/qlik-sense-cve-2023-41265-41266.json)): critical, closed, patched, started 2023-12-07, CVE-2023-41265, CVE-2023-41266
- [SysAid Server: Path Traversal (CVE-2023-47246)](https://pwn.watch/i/sysaid-server-cve-2023-47246) ([json](https://pwn.watch/i/sysaid-server-cve-2023-47246.json)): critical, closed, patched, started 2023-11-13, CVE-2023-47246
- [Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)](https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518) ([json](https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518.json)): critical, closed, patched, started 2023-10-31, CVE-2023-22518
- [F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)](https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748) ([json](https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748.json)): critical, closed, patched, started 2023-10-31, CVE-2023-46747, CVE-2023-46748
- [Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)](https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604) ([json](https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json)): critical, closed, patched, started 2023-10-27, CVE-2023-46604
- [Citrix Bleed: NetScaler session token leak (CVE-2023-4966)](https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966) ([json](https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966.json)): critical, closed, patched, started 2023-10-10, CVE-2023-4966
- [Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)](https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044) ([json](https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044.json)): high, closed, patched, started 2023-10-05, CVE-2023-40044
- [Cisco Adaptive Security Appliance and Firepower Threat Defense: Unauthorized Access (CVE-2023-20269)](https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269) ([json](https://pwn.watch/i/cisco-adaptive-security-appliance-and-threat-cve-2023-20269.json)): critical, closed, patched, started 2023-09-13, CVE-2023-20269
- [MGM Resorts and Caesars hit by Scattered Spider](https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023) ([json](https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json)): high, closed, no-fix-needed, started 2023-09-07
- [Ivanti Sentry: Authentication Bypass (CVE-2023-38035)](https://pwn.watch/i/ivanti-sentry-cve-2023-38035) ([json](https://pwn.watch/i/ivanti-sentry-cve-2023-38035.json)): critical, closed, patched, started 2023-08-22, CVE-2023-38035
- [Veeam Backup & Replication: Cloud Connect Missing Authentication for Critical Function (CVE-2023-27532)](https://pwn.watch/i/veeam-backup-replication-cve-2023-27532) ([json](https://pwn.watch/i/veeam-backup-replication-cve-2023-27532.json)): high, closed, patched, started 2023-08-22, CVE-2023-27532
- [Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)](https://pwn.watch/i/microsoft-windows-cve-2023-36884) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36884.json)): high, closed, patched, started 2023-07-17, CVE-2023-36884
- [Netwrix Auditor: Insecure Object Deserialization (CVE-2022-31199)](https://pwn.watch/i/netwrix-auditor-cve-2022-31199) ([json](https://pwn.watch/i/netwrix-auditor-cve-2022-31199.json)): critical, closed, patched, started 2023-07-11, CVE-2022-31199
- [MOVEit Transfer zero-day: Cl0p mass data theft](https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023) ([json](https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json)): critical, closed, patched, started 2023-05-27, CVE-2023-34362, CVE-2023-35036, CVE-2023-35708
- [PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)](https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350) ([json](https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350.json)): critical, closed, patched, started 2023-04-21, CVE-2023-27350
- [Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)](https://pwn.watch/i/microsoft-windows-cve-2023-28252) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-28252.json)): high, closed, patched, started 2023-04-11, CVE-2023-28252
- [Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)](https://pwn.watch/i/microsoft-windows-cve-2023-24880) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-24880.json)): medium, closed, patched, started 2023-03-14, CVE-2023-24880
- [ZK Framework AuUploader: Unspecified (CVE-2022-36537)](https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537) ([json](https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537.json)): high, closed, patched, started 2023-02-27, CVE-2022-36537
- [IBM Aspera Faspex: Code Execution (CVE-2022-47986)](https://pwn.watch/i/ibm-aspera-faspex-cve-2022-47986) ([json](https://pwn.watch/i/ibm-aspera-faspex-cve-2022-47986.json)): critical, closed, patched, started 2023-02-21, CVE-2022-47986
- [Mitel MiVoice Connect: 2 exploited vulnerabilities (CVE-2022-40765, CVE-2022-41223)](https://pwn.watch/i/mitel-mivoice-connect-cve-2022-40765-41223) ([json](https://pwn.watch/i/mitel-mivoice-connect-cve-2022-40765-41223.json)): medium, closed, patched, started 2023-02-21, CVE-2022-40765, CVE-2022-41223
- [Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)](https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376.json)): high, closed, patched, started 2023-02-14, CVE-2023-21823, CVE-2023-23376
- [TerraMaster OS: Remote Command Execution (CVE-2022-24990)](https://pwn.watch/i/terramaster-os-cve-2022-24990) ([json](https://pwn.watch/i/terramaster-os-cve-2022-24990.json)): high, closed, patched, started 2023-02-10, CVE-2022-24990
- [Oracle E-Business Suite: Unspecified (CVE-2022-21587)](https://pwn.watch/i/oracle-e-business-suite-cve-2022-21587) ([json](https://pwn.watch/i/oracle-e-business-suite-cve-2022-21587.json)): critical, closed, patched, started 2023-02-02, CVE-2022-21587
- [Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims](https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669) ([json](https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669.json)): high, closed, patched, started 2023-02-01, CVE-2023-0669
- [Zoho ManageEngine: Remote Code Execution (CVE-2022-47966)](https://pwn.watch/i/zoho-manageengine-cve-2022-47966) ([json](https://pwn.watch/i/zoho-manageengine-cve-2022-47966.json)): critical, closed, patched, started 2023-01-23, CVE-2022-47966
- [Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)](https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080) ([json](https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080.json)): high, closed, patched, started 2023-01-10, CVE-2022-41080