{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T19:58:23.236Z", "tag": { "id": "rce", "label": "RCE", "isStack": false, "url": "https://pwn.watch/t/rce", "feed": "https://pwn.watch/t/rce/feed.xml" }, "counts": { "incidents": 189, "live": 11, "notFullyPatched": 4, "patched": 179 }, "incidents": [ { "slug": "gitlab-cve-2026-110264-regex-rce", "title": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)", "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce", "json": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "GitLab CE/EE (self-managed)", "tags": [ "devtools", "gitlab", "rce" ], "cveIds": [ "CVE-2026-110264" ], "affectedVersions": [ "All versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1" ], "fixedVersions": [ "19.5.1", "19.4.3", "19.3.6", "19.2.9", "19.1.9", "19.0.10", "18.11.13" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T21:39:43+02:00", "summary": "GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.", "xPost": null }, { "slug": "linux-kernel-zdi-reports-leaked-to-lkml", "title": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml", "json": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml.json", "status": "live", "severity": "critical", "patchStatus": "unpatched", "product": "Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmet", "tags": [ "linux", "ksmbd", "zdi", "rce" ], "cveIds": [], "affectedVersions": [ "Reports were tested on Linux 7.3-rc1 and 7.3-rc3 (Debian trixie); exact first affected versions not published", "ksmbd RCEs only matter if the in-kernel SMB server (ksmbd) is loaded and serving shares; SMB Direct bug needs an RDMA device and CONFIG_SMB_SERVER_SMBDIRECT" ], "fixedVersions": [ "No fixed mainline or stable kernel yet", "ksmbd race (ZDI-CAN-33774): fix commit 68f410faedaf in the ksmbd maintainer tree (linkinjeon/smb.git), not yet in a release", "SMB Direct underflow (ZDI-CAN-33549): likely fixed in Stefan Metzmacher's for-7.5/smbdirect branch (unconfirmed)" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T21:57:21+02:00", "summary": "On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.", "xPost": null }, { "slug": "nodejs-october-2026-security-releases", "title": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "url": "https://pwn.watch/i/nodejs-october-2026-security-releases", "json": "https://pwn.watch/i/nodejs-october-2026-security-releases.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "Node.js", "tags": [ "node", "emudhra", "tls", "rce", "brotli" ], "cveIds": [ "CVE-2026-111497", "CVE-2026-105482", "CVE-2026-105483", "CVE-2026-106069", "CVE-2026-105481", "CVE-2026-106072", "CVE-2026-106074", "CVE-2026-106070", "CVE-2026-106071", "CVE-2026-106073" ], "affectedVersions": [ "22.x, 24.x, 26.x (EOL lines not patched)" ], "fixedVersions": [ "22.23.4", "24.22.1", "26.12.1" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T21:39:43+02:00", "summary": "On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a Brotli decoder out-of-bounds write (high per Node.js, CVSS 9.2 critical per the Google CNA on NVD, rooted in Google Brotli 1.0.3 to 1.2.0) that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.", "xPost": null }, { "slug": "isc-bind-cve-2026-94300", "title": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)", "url": "https://pwn.watch/i/isc-bind-cve-2026-94300", "json": "https://pwn.watch/i/isc-bind-cve-2026-94300.json", "status": "live", "severity": "high", "patchStatus": "partial", "product": "ISC BIND 9 (named) DNS server", "tags": [ "linux", "bind", "dns", "rce" ], "cveIds": [ "CVE-2026-94300" ], "affectedVersions": [ "BIND 9.11.0 through 9.18.50", "BIND 9.20.0 through 9.20.29", "BIND 9.21.0 through 9.21.26", "BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1" ], "fixedVersions": [ "BIND 9.20.30", "BIND 9.21.27", "BIND Supported Preview Edition 9.20.30-S1", "Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); unstable 1:9.20.30-1" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T21:57:21+02:00", "summary": "ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.", "xPost": null }, { "slug": "storybook-dev-server-cve-2026-114125", "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)", "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125", "json": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Storybook (dev server)", "tags": [ "node", "npm", "devtools", "storybook", "rce" ], "cveIds": [ "CVE-2026-114125" ], "affectedVersions": [ "storybook / @storybook/core / @storybook/core-server >= 8.0.0 < 8.6.19", "storybook >= 9.0.0 < 9.1.21", "storybook >= 10.0.0 < 10.6.2", "storybook >= 11.0.0-alpha.0 < 11.0.0-alpha.6", "@storybook/addon-vitest and @storybook/addon-mcp (matching ranges)" ], "fixedVersions": [ "8.6.19", "9.1.21", "10.6.2", "11.0.0-alpha.6" ], "startedAt": "2026-10-21", "closedAt": "2026-10-22", "updatedAt": "2026-10-22T12:43:45.000Z", "summary": "Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.", "xPost": null }, { "slug": "eg-secure-solutions-siteguard-server-edition-cve-2026-106931", "title": "EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability", "url": "https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931", "json": "https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931.json", "status": "live", "severity": "high", "patchStatus": "patched", "product": "EG Secure Solutions SiteGuard Server Edition", "tags": [ "cisa-kev", "rce", "siteguard" ], "cveIds": [ "CVE-2026-106931" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-10-20", "closedAt": null, "updatedAt": "2026-10-20", "summary": "EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.", "xPost": null }, { "slug": "php2shell-cve-2026-109618-109619", "title": "PHP2Shell: critical unauthenticated RCE in PHP core", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619", "json": "https://pwn.watch/i/php2shell-cve-2026-109618-109619.json", "status": "live", "severity": "critical", "patchStatus": "partial", "product": "PHP", "tags": [ "php", "apache", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-109618", "CVE-2026-109619" ], "affectedVersions": [ "PHP 5.4 through 8.5.11 (all branches serving web requests); EOL 8.1 and earlier unpatched by the PHP project" ], "fixedVersions": [ "8.5.12", "8.4.27", "8.3.36", "8.2.35" ], "startedAt": "2026-10-17", "closedAt": null, "updatedAt": "2026-10-22T21:57:21+02:00", "summary": "Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.", "xPost": null }, { "slug": "plex2shell-cve-2026-96652", "title": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "url": "https://pwn.watch/i/plex2shell-cve-2026-96652", "json": "https://pwn.watch/i/plex2shell-cve-2026-96652.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "Plex Media Server", "tags": [ "plex", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-96652", "CVE-2026-96654", "CVE-2026-96655", "CVE-2026-96656" ], "affectedVersions": [ "Before 1.43.3.10861" ], "fixedVersions": [ "1.43.3.10861+" ], "startedAt": "2026-10-16", "closedAt": null, "updatedAt": "2026-10-22T11:20:00+02:00", "summary": "Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.", "xPost": null }, { "slug": "nextjs-october-2026-rce-security-release", "title": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release", "json": "https://pwn.watch/i/nextjs-october-2026-rce-security-release.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "Next.js (next on npm), sharp / librsvg", "tags": [ "node", "npm", "nextjs", "vercel", "sharp", "rce" ], "cveIds": [ "CVE-2026-96889" ], "affectedVersions": [ "next >= 10.0.0, <= 15.5.27 (Image Optimization SVG RCE, CVE-2026-96889)", "next >= 16.0.0, <= 16.4.0", "sharp < 0.35.5 (bundles vulnerable librsvg)" ], "fixedVersions": [ "next 15.5.28", "next 16.4.1", "sharp 0.35.5 (librsvg 2.63.2)" ], "startedAt": "2026-10-14", "closedAt": null, "updatedAt": "2026-10-22T20:01:57+02:00", "summary": "On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.", "xPost": null }, { "slug": "ahsay-ahsaycbs-cve-2026-105134", "title": "Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability", "url": "https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134", "json": "https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134.json", "status": "live", "severity": "high", "patchStatus": "patched", "product": "Ahsay AhsayCBS", "tags": [ "ahsay", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-105134", "CVE-2026-105133" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-10-14", "closedAt": null, "updatedAt": "2026-10-14", "summary": "Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CISA added CVE-2026-105134, CVE-2026-105133 to the Known Exploited Vulnerabilities catalog on 2026-10-14 based on evidence of active exploitation.", "xPost": null }, { "slug": "palo-alto-networks-pan-os-cve-2026-0322", "title": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability", "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322", "json": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322.json", "status": "live", "severity": "high", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-0322" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-10-14", "closedAt": null, "updatedAt": "2026-10-14", "summary": "Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14.", "xPost": null }, { "slug": "ivanti-connect-secure-cve-2026-104935", "title": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935", "json": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json", "status": "live", "severity": "high", "patchStatus": "partial", "product": "Ivanti Connect Secure (ICS)", "tags": [ "ivanti", "zero-day", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-104935" ], "affectedVersions": [ "25.1.1.1 and prior", "25.1.2.2 and prior", "22.8R2.4 and prior (22.7.x and below unaffected)" ], "fixedVersions": [ "25.1.1.2", "25.1.3.0 / 25.1.3.1", "22.8R2.5" ], "startedAt": "2026-10-01", "closedAt": null, "updatedAt": "2026-10-22T21:57:21+02:00", "summary": "Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2026-65660", "title": "Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-65660" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-25", "closedAt": "2026-09-25", "updatedAt": "2026-09-25", "summary": "Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25.", "xPost": null }, { "slug": "wordpress-core-cve-2026-87902", "title": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability", "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902", "json": "https://pwn.watch/i/wordpress-core-cve-2026-87902.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "WordPress Core", "tags": [ "php", "wordpress", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-87902" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-25", "closedAt": "2026-09-25", "updatedAt": "2026-09-25", "summary": "WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.", "xPost": null }, { "slug": "n-able-n-central-cve-2026-86218", "title": "N-able N-central: N-able N-central Static Code Injection Vulnerability", "url": "https://pwn.watch/i/n-able-n-central-cve-2026-86218", "json": "https://pwn.watch/i/n-able-n-central-cve-2026-86218.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "N-able N-central", "tags": [ "n-able", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-86218" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-08", "closedAt": "2026-09-08", "updatedAt": "2026-09-08", "summary": "N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Added to CISA KEV on 2026-09-08.", "xPost": null }, { "slug": "kestra-kestra-oss-cve-2026-49869", "title": "Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability", "url": "https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869", "json": "https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Kestra Kestra OSS", "tags": [ "kestra", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-49869" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-02", "closedAt": "2026-09-02", "updatedAt": "2026-09-02", "summary": "Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. Added to CISA KEV on 2026-09-02.", "xPost": null }, { "slug": "sangoma-switchvox-cve-2026-9586", "title": "Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability", "url": "https://pwn.watch/i/sangoma-switchvox-cve-2026-9586", "json": "https://pwn.watch/i/sangoma-switchvox-cve-2026-9586.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Sangoma Switchvox", "tags": [ "sangoma", "cisa-kev", "rce", "sql-injection" ], "cveIds": [ "CVE-2026-9586" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-02", "closedAt": "2026-09-02", "updatedAt": "2026-09-02", "summary": "Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Added to CISA KEV on 2026-09-02.", "xPost": null }, { "slug": "gitea-gitea-cve-2026-60004", "title": "Gitea Gitea: Gitea Code Injection Vulnerability", "url": "https://pwn.watch/i/gitea-gitea-cve-2026-60004", "json": "https://pwn.watch/i/gitea-gitea-cve-2026-60004.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Gitea Gitea", "tags": [ "devtools", "gitea", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-60004" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-25", "closedAt": "2026-08-25", "updatedAt": "2026-08-25", "summary": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Added to CISA KEV on 2026-08-25.", "xPost": null }, { "slug": "synacor-zimbra-collaboration-suite-zcs-cve-2026-73570", "title": "Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability", "url": "https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570", "json": "https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Synacor Zimbra Collaboration Suite (ZCS)", "tags": [ "zimbra", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-73570" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-21", "closedAt": "2026-08-21", "updatedAt": "2026-08-21", "summary": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Added to CISA KEV on 2026-08-21.", "xPost": null }, { "slug": "trueconf-server-cve-2026-72530", "title": "TrueConf Server: TrueConf Server Code Injection Vulnerability", "url": "https://pwn.watch/i/trueconf-server-cve-2026-72530", "json": "https://pwn.watch/i/trueconf-server-cve-2026-72530.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TrueConf Server", "tags": [ "trueconf", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-72530", "CVE-2026-72529" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-20", "closedAt": "2026-08-20", "updatedAt": "2026-08-20", "summary": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. CISA added CVE-2026-72530, CVE-2026-72529 to the Known Exploited Vulnerabilities catalog on 2026-08-20 based on evidence of active exploitation.", "xPost": null }, { "slug": "microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824", "title": "Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability", "url": "https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824", "json": "https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Internet Key Exchange (IKE) Service Extensions", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-33824" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-18", "closedAt": "2026-08-18", "updatedAt": "2026-08-18", "summary": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. Added to CISA KEV on 2026-08-18.", "xPost": null }, { "slug": "ray-project-ray-cve-2025-62593", "title": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593", "json": "https://pwn.watch/i/ray-project-ray-cve-2025-62593.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ray-Project Ray", "tags": [ "python", "ai", "ray", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-62593" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-17", "closedAt": "2026-08-17", "updatedAt": "2026-08-17", "summary": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17.", "xPost": null }, { "slug": "progress-loadmaster-cve-2026-8037", "title": "Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability", "url": "https://pwn.watch/i/progress-loadmaster-cve-2026-8037", "json": "https://pwn.watch/i/progress-loadmaster-cve-2026-8037.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Progress LoadMaster", "tags": [ "progress", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-8037" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-07", "closedAt": "2026-08-07", "updatedAt": "2026-08-07", "summary": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Added to CISA KEV on 2026-08-07.", "xPost": null }, { "slug": "jetbrains-teamcity-cve-2026-63077", "title": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077", "json": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "JetBrains TeamCity", "tags": [ "devtools", "jetbrains", "teamcity", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-63077" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-05", "closedAt": "2026-08-05", "updatedAt": "2026-08-05", "summary": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05.", "xPost": null }, { "slug": "ibm-langflow-cve-2026-9198", "title": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198", "json": "https://pwn.watch/i/ibm-langflow-cve-2026-9198.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "IBM Langflow", "tags": [ "python", "ai", "langflow", "ibm", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-9198" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-04", "closedAt": "2026-08-04", "updatedAt": "2026-08-04", "summary": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Added to CISA KEV on 2026-08-04.", "xPost": null }, { "slug": "arista-velocloud-orchestrator-cve-2026-16812", "title": "Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability", "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812", "json": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Arista VeloCloud Orchestrator", "tags": [ "arista", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-16812" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-27", "closedAt": "2026-07-27", "updatedAt": "2026-07-27", "summary": "Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Added to CISA KEV on 2026-07-27.", "xPost": null }, { "slug": "wordpress-core-cve-2026-60137", "title": "WordPress Core: WordPress Core SQL Injection Vulnerability", "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137", "json": "https://pwn.watch/i/wordpress-core-cve-2026-60137.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "WordPress Core", "tags": [ "php", "wordpress", "cisa-kev", "rce", "sql-injection" ], "cveIds": [ "CVE-2026-60137", "CVE-2026-63030" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-21", "closedAt": "2026-07-21", "updatedAt": "2026-07-21", "summary": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation.", "xPost": null }, { "slug": "fortinet-fortisandbox-cve-2026-25089", "title": "Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability", "url": "https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089", "json": "https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Fortinet FortiSandbox", "tags": [ "fortinet", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-25089", "CVE-2026-39808" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-16", "closedAt": "2026-07-16", "updatedAt": "2026-07-16", "summary": "Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. CISA added CVE-2026-25089, CVE-2026-39808 to the Known Exploited Vulnerabilities catalog on 2026-07-16 based on evidence of active exploitation.", "xPost": null }, { "slug": "joomlack-page-builder-cve-2026-56290", "title": "Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability", "url": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290", "json": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Joomlack Page Builder", "tags": [ "php", "cisa-kev", "rce", "joomla" ], "cveIds": [ "CVE-2026-56290" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-07", "closedAt": "2026-07-07", "updatedAt": "2026-07-07", "summary": "Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. Added to CISA KEV on 2026-07-07.", "xPost": null }, { "slug": "ivanti-sentry-cve-2026-10520", "title": "Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability", "url": "https://pwn.watch/i/ivanti-sentry-cve-2026-10520", "json": "https://pwn.watch/i/ivanti-sentry-cve-2026-10520.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ivanti Sentry", "tags": [ "ivanti", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-10520" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-11", "closedAt": "2026-06-11", "updatedAt": "2026-06-11", "summary": "Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. Added to CISA KEV on 2026-06-11.", "xPost": null }, { "slug": "berriai-litellm-cve-2026-42271", "title": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42271.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "tags": [ "python", "ai", "litellm", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-42271", "CVE-2026-48710" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-08", "closedAt": "2026-06-08", "updatedAt": "2026-09-02", "summary": "BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.", "xPost": null }, { "slug": "drupal-core-cve-2026-9082", "title": "Drupal Core: Drupal Core SQL Injection Vulnerability", "url": "https://pwn.watch/i/drupal-core-cve-2026-9082", "json": "https://pwn.watch/i/drupal-core-cve-2026-9082.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Drupal Core", "tags": [ "php", "drupal", "cisa-kev", "rce", "sql-injection" ], "cveIds": [ "CVE-2026-9082" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-22", "closedAt": "2026-05-22", "updatedAt": "2026-05-22", "summary": "Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. Added to CISA KEV on 2026-05-22.", "xPost": null }, { "slug": "ivanti-endpoint-manager-mobile-epmm-cve-2026-6973", "title": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability", "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973", "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM)", "tags": [ "ivanti", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-6973" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-07", "closedAt": "2026-05-07", "updatedAt": "2026-05-07", "summary": "Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. Added to CISA KEV on 2026-05-07.", "xPost": null }, { "slug": "apache-activemq-cve-2026-34197", "title": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability", "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197", "json": "https://pwn.watch/i/apache-activemq-cve-2026-34197.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apache ActiveMQ", "tags": [ "java", "apache", "activemq", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-34197" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-16", "closedAt": "2026-04-16", "updatedAt": "2026-04-16", "summary": "Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16.", "xPost": null }, { "slug": "f5-big-ip-cve-2025-53521", "title": "F5 BIG-IP: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability", "url": "https://pwn.watch/i/f5-big-ip-cve-2025-53521", "json": "https://pwn.watch/i/f5-big-ip-cve-2025-53521.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "F5 BIG-IP", "tags": [ "f5", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-53521" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-27", "closedAt": "2026-03-27", "updatedAt": "2026-03-27", "summary": "F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. Added to CISA KEV on 2026-03-27.", "xPost": null }, { "slug": "langflow-langflow-cve-2026-33017", "title": "Langflow Langflow: Langflow Code Injection Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-33017.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-33017" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-25", "closedAt": "2026-03-25", "updatedAt": "2026-03-25", "summary": "Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25.", "xPost": null }, { "slug": "broadcom-vmware-aria-operations-cve-2026-22719", "title": "Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability", "url": "https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719", "json": "https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Broadcom VMware Aria Operations", "tags": [ "vmware", "broadcom", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-22719" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-03", "closedAt": "2026-03-03", "updatedAt": "2026-03-03", "summary": "Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration. Added to CISA KEV on 2026-03-03.", "xPost": null }, { "slug": "roundcube-webmail-cve-2025-49113", "title": "Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/roundcube-webmail-cve-2025-49113", "json": "https://pwn.watch/i/roundcube-webmail-cve-2025-49113.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Roundcube Webmail", "tags": [ "roundcube", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-49113", "CVE-2025-68461" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-20", "closedAt": "2026-02-20", "updatedAt": "2026-02-20", "summary": "RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. CISA added CVE-2025-49113, CVE-2025-68461 to the Known Exploited Vulnerabilities catalog on 2026-02-20 based on evidence of active exploitation.", "xPost": null }, { "slug": "beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731", "title": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln", "url": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731", "json": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)", "tags": [ "beyondtrust", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-1731" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-13", "closedAt": "2026-02-13", "updatedAt": "2026-02-13", "summary": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. Added to CISA KEV on 2026-02-13.", "xPost": null }, { "slug": "react-native-community-cli-cve-2025-11953", "title": "React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability", "url": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953", "json": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "React Native Community CLI", "tags": [ "node", "windows", "react-native", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-11953" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-05", "closedAt": "2026-02-05", "updatedAt": "2026-02-05", "summary": "React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Added to CISA KEV on 2026-02-05.", "xPost": null }, { "slug": "sangoma-freepbx-cve-2025-64328", "title": "Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability", "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-64328", "json": "https://pwn.watch/i/sangoma-freepbx-cve-2025-64328.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Sangoma FreePBX ", "tags": [ "sangoma", "freepbx", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-64328" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-03", "closedAt": "2026-02-03", "updatedAt": "2026-02-03", "summary": "Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Added to CISA KEV on 2026-02-03.", "xPost": null }, { "slug": "solarwinds-web-help-desk-cve-2025-40551", "title": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551", "json": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SolarWinds Web Help Desk", "tags": [ "solarwinds", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-40551" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-03", "closedAt": "2026-02-03", "updatedAt": "2026-02-03", "summary": "SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. Added to CISA KEV on 2026-02-03.", "xPost": null }, { "slug": "ivanti-epmm-cve-2026-1340", "title": "Ivanti EPMM code injection CVE-2026-1340 exploited", "url": "https://pwn.watch/i/ivanti-epmm-cve-2026-1340", "json": "https://pwn.watch/i/ivanti-epmm-cve-2026-1340.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM)", "tags": [ "ivanti", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-1340" ], "affectedVersions": [ "See Ivanti Jan 29 2026 advisory" ], "fixedVersions": [ "Ivanti patched releases per January 2026 advisory" ], "startedAt": "2026-01-29", "closedAt": "2026-04-30", "updatedAt": "2026-04-30", "summary": "Ivanti Endpoint Manager Mobile (EPMM) CVE-2026-1340 — unauthenticated RCE via code injection — was exploited in limited attacks disclosed late January 2026. CISA later ordered federal agencies to patch within days in April when adding/prioritizing the KEV entry.", "xPost": null }, { "slug": "ivanti-endpoint-manager-mobile-epmm-cve-2026-1281", "title": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability", "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281", "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM)", "tags": [ "ivanti", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-1281" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-01-29", "closedAt": "2026-01-29", "updatedAt": "2026-01-29", "summary": "Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Added to CISA KEV on 2026-01-29.", "xPost": null }, { "slug": "smartertools-smartermail-cve-2025-52691", "title": "SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability", "url": "https://pwn.watch/i/smartertools-smartermail-cve-2025-52691", "json": "https://pwn.watch/i/smartertools-smartermail-cve-2025-52691.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SmarterTools SmarterMail", "tags": [ "smartermail", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-52691", "CVE-2026-23760" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-01-26", "closedAt": "2026-01-26", "updatedAt": "2026-01-26", "summary": "SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. CISA added CVE-2025-52691, CVE-2026-23760 to the Known Exploited Vulnerabilities catalog on 2026-01-26 based on evidence of active exploitation.", "xPost": null }, { "slug": "cisco-unified-communications-manager-cve-2026-20045", "title": "Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability", "url": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045", "json": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco Unified Communications Manager", "tags": [ "cisco", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-20045" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-01-21", "closedAt": "2026-01-21", "updatedAt": "2026-01-21", "summary": "Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Added to CISA KEV on 2026-01-21.", "xPost": null }, { "slug": "digiever-ds-2105-pro-cve-2023-52163", "title": "Digiever DS-2105 Pro: DS-2105 Pro Missing Authorization Vulnerability", "url": "https://pwn.watch/i/digiever-ds-2105-pro-cve-2023-52163", "json": "https://pwn.watch/i/digiever-ds-2105-pro-cve-2023-52163.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Digiever DS-2105 Pro", "tags": [ "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-52163" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-12-22", "closedAt": "2025-12-22", "updatedAt": "2025-12-22", "summary": "Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi. Added to CISA KEV on 2025-12-22.", "xPost": null }, { "slug": "array-networks-arrayos-ag-cve-2025-66644", "title": "Array Networks ArrayOS AG: ArrayOS AG OS Command Injection Vulnerability", "url": "https://pwn.watch/i/array-networks-arrayos-ag-cve-2025-66644", "json": "https://pwn.watch/i/array-networks-arrayos-ag-cve-2025-66644.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Array Networks ArrayOS AG", "tags": [ "array-networks", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-66644" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-12-08", "closedAt": "2025-12-08", "updatedAt": "2025-12-08", "summary": "Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. Added to CISA KEV on 2025-12-08.", "xPost": null }, { "slug": "react2shell-react-server-components-cve-2025-55182", "title": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182", "json": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "React Server Components (react-server-dom-*), Next.js", "tags": [ "node", "react2shell", "react", "nextjs", "vercel", "rce", "zero-day", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-55182" ], "affectedVersions": [ "React 19.0.0, 19.1.0-19.1.1, 19.2.0 (react-server-dom-webpack / -parcel / -turbopack)", "Next.js App Router releases using affected React (see advisory)" ], "fixedVersions": [ "React 19.0.1", "React 19.1.2", "React 19.2.1", "Next.js: patched release lines per the React/Next.js advisory" ], "startedAt": "2025-12-03", "closedAt": "2025-12-12", "updatedAt": "2025-12-12", "summary": "A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.", "xPost": null }, { "slug": "fortinet-fortiweb-cve-2025-58034", "title": "Fortinet FortiWeb: FortiWeb OS Command Injection Vulnerability", "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034", "json": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Fortinet FortiWeb", "tags": [ "fortinet", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-58034" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-11-18", "closedAt": "2025-11-18", "updatedAt": "2025-11-18", "summary": "Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Added to CISA KEV on 2025-11-18.", "xPost": null }, { "slug": "cwp-control-web-panel-cve-2025-48703", "title": "CWP Control Web Panel: Control Web Panel OS Command Injection Vulnerability", "url": "https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703", "json": "https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CWP Control Web Panel", "tags": [ "hosting", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-48703" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-11-04", "closedAt": "2025-11-04", "updatedAt": "2025-11-04", "summary": "CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. Added to CISA KEV on 2025-11-04.", "xPost": null }, { "slug": "xwiki-platform-cve-2025-24893", "title": "XWiki Platform: Platform Eval Injection Vulnerability", "url": "https://pwn.watch/i/xwiki-platform-cve-2025-24893", "json": "https://pwn.watch/i/xwiki-platform-cve-2025-24893.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "XWiki Platform", "tags": [ "java", "xwiki", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-24893" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-30", "closedAt": "2025-10-30", "updatedAt": "2025-10-30", "summary": "XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch. Added to CISA KEV on 2025-10-30.", "xPost": null }, { "slug": "dassault-systemes-delmia-apriso-cve-2025-6204", "title": "Dassault Systèmes DELMIA Apriso: 2 exploited vulnerabilities (CVE-2025-6204, CVE-2025-6205)", "url": "https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-6204", "json": "https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-6204.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Dassault Systèmes DELMIA Apriso", "tags": [ "dassault-systemes", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-6204", "CVE-2025-6205" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-28", "closedAt": "2025-10-28", "updatedAt": "2025-10-28", "summary": "CVE-2025-6204: Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code. CVE-2025-6205: Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application. Added to CISA KEV on 2025-10-28.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-59287", "title": "Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-59287", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-59287.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-59287" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-24", "closedAt": "2025-10-24", "updatedAt": "2025-10-24", "summary": "Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2025-10-24.", "xPost": null }, { "slug": "skysea-client-view-cve-2016-7836", "title": "SKYSEA Client View: Client View Improper Authentication Vulnerability", "url": "https://pwn.watch/i/skysea-client-view-cve-2016-7836", "json": "https://pwn.watch/i/skysea-client-view-cve-2016-7836.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SKYSEA Client View", "tags": [ "cisa-kev", "rce", "auth-bypass" ], "cveIds": [ "CVE-2016-7836" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-14", "closedAt": "2025-10-14", "updatedAt": "2025-10-14", "summary": "SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. Added to CISA KEV on 2025-10-14.", "xPost": null }, { "slug": "microsoft-windows-cve-2011-3402", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402", "json": "https://pwn.watch/i/microsoft-windows-cve-2011-3402.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2011-3402", "CVE-2013-3918", "CVE-2021-43226" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-06", "closedAt": "2025-10-06", "updatedAt": "2025-10-06", "summary": "CVE-2011-3402: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. CVE-2013-3918: Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2021-43226: Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms. Added to CISA KEV on 2025-10-06.", "xPost": null }, { "slug": "mozilla-multiple-products-cve-2010-3765", "title": "Mozilla Multiple Products: Multiple Products Remote Code Execution Vulnerability", "url": "https://pwn.watch/i/mozilla-multiple-products-cve-2010-3765", "json": "https://pwn.watch/i/mozilla-multiple-products-cve-2010-3765.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Mozilla Multiple Products", "tags": [ "cisa-kev", "rce" ], "cveIds": [ "CVE-2010-3765" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-06", "closedAt": "2025-10-06", "updatedAt": "2025-10-06", "summary": "Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption. Added to CISA KEV on 2025-10-06.", "xPost": null }, { "slug": "microsoft-internet-explorer-cve-2010-3962", "title": "Microsoft Internet Explorer: Internet Explorer Uninitialized Memory Corruption Vulnerability", "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962", "json": "https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Internet Explorer", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2010-3962" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-06", "closedAt": "2025-10-06", "updatedAt": "2025-10-06", "summary": "Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-10-06.", "xPost": null }, { "slug": "jenkins-cve-2017-1000353", "title": "Jenkins: Remote Code Execution Vulnerability", "url": "https://pwn.watch/i/jenkins-cve-2017-1000353", "json": "https://pwn.watch/i/jenkins-cve-2017-1000353.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Jenkins", "tags": [ "java", "devtools", "jenkins", "cisa-kev", "rce" ], "cveIds": [ "CVE-2017-1000353" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-02", "closedAt": "2025-10-02", "updatedAt": "2025-10-02", "summary": "Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism. Added to CISA KEV on 2025-10-02.", "xPost": null }, { "slug": "gnu-bash-cve-2014-6278", "title": "GNU Bash: Bash OS Command Injection Vulnerability", "url": "https://pwn.watch/i/gnu-bash-cve-2014-6278", "json": "https://pwn.watch/i/gnu-bash-cve-2014-6278.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "GNU Bash", "tags": [ "linux", "bash", "cisa-kev", "rce" ], "cveIds": [ "CVE-2014-6278" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-02", "closedAt": "2025-10-02", "updatedAt": "2025-10-02", "summary": "GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment. Added to CISA KEV on 2025-10-02.", "xPost": null }, { "slug": "smartbedded-meteobridge-cve-2025-4008", "title": "Smartbedded Meteobridge: Meteobridge Command Injection Vulnerability", "url": "https://pwn.watch/i/smartbedded-meteobridge-cve-2025-4008", "json": "https://pwn.watch/i/smartbedded-meteobridge-cve-2025-4008.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Smartbedded Meteobridge", "tags": [ "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-4008" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-02", "closedAt": "2025-10-02", "updatedAt": "2025-10-02", "summary": "Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices. Added to CISA KEV on 2025-10-02.", "xPost": null }, { "slug": "fortra-goanywhere-mft-cve-2025-10035", "title": "Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035", "json": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortra GoAnywhere MFT", "tags": [ "goanywhere", "fortra", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-10035" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-29", "closedAt": "2025-09-29", "updatedAt": "2025-09-29", "summary": "Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.", "xPost": null }, { "slug": "oracle-ebs-cl0p-extortion-cve-2025-61882", "title": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882", "json": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle E-Business Suite", "tags": [ "oracle", "cl0p", "zero-day", "rce", "data-breach", "extortion", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-61882" ], "affectedVersions": [ "Oracle E-Business Suite 12.2.3 to 12.2.14" ], "fixedVersions": [ "Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)" ], "startedAt": "2025-09-29", "closedAt": "2025-10-20", "updatedAt": "2025-10-20", "summary": "Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.", "xPost": null }, { "slug": "cisco-ios-and-ios-xe-cve-2025-20352", "title": "Cisco IOS and IOS XE: IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability", "url": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352", "json": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco IOS and IOS XE", "tags": [ "cisco", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-20352" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-29", "closedAt": "2025-09-29", "updatedAt": "2025-09-29", "summary": "Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Added to CISA KEV on 2025-09-29.", "xPost": null }, { "slug": "libraesva-email-security-gateway-cve-2025-59689", "title": "Libraesva Email Security Gateway: Email Security Gateway Command Injection Vulnerability", "url": "https://pwn.watch/i/libraesva-email-security-gateway-cve-2025-59689", "json": "https://pwn.watch/i/libraesva-email-security-gateway-cve-2025-59689.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Libraesva Email Security Gateway", "tags": [ "libraesva", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-59689" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-29", "closedAt": "2025-09-29", "updatedAt": "2025-09-29", "summary": "Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment. Added to CISA KEV on 2025-09-29.", "xPost": null }, { "slug": "cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333", "title": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)", "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333", "json": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense", "tags": [ "cisco", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-20333", "CVE-2025-20362" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-25", "closedAt": "2025-09-25", "updatedAt": "2025-09-25", "summary": "CVE-2025-20333: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362. CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. Added to CISA KEV on 2025-09-25.", "xPost": null }, { "slug": "dassault-systemes-delmia-apriso-cve-2025-5086", "title": "Dassault Systèmes DELMIA Apriso: DELMIA Apriso Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-5086", "json": "https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-5086.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Dassault Systèmes DELMIA Apriso", "tags": [ "dassault-systemes", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-5086" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-11", "closedAt": "2025-09-11", "updatedAt": "2025-09-11", "summary": "Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution. Added to CISA KEV on 2025-09-11.", "xPost": null }, { "slug": "sitecore-multiple-products-cve-2025-53690", "title": "Sitecore Multiple Products: Multiple Products Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/sitecore-multiple-products-cve-2025-53690", "json": "https://pwn.watch/i/sitecore-multiple-products-cve-2025-53690.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Sitecore Multiple Products", "tags": [ "sitecore", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-53690" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-04", "closedAt": "2025-09-04", "updatedAt": "2025-09-04", "summary": "Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. Added to CISA KEV on 2025-09-04.", "xPost": null }, { "slug": "tp-link-multiple-routers-cve-2025-9377", "title": "TP-Link Multiple Routers: Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability", "url": "https://pwn.watch/i/tp-link-multiple-routers-cve-2025-9377", "json": "https://pwn.watch/i/tp-link-multiple-routers-cve-2025-9377.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TP-Link Multiple Routers", "tags": [ "tp-link", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-9377" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-09-03", "closedAt": "2025-09-03", "updatedAt": "2025-09-03", "summary": "TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-09-03.", "xPost": null }, { "slug": "sangoma-freepbx-cve-2025-57819", "title": "Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability", "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819", "json": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Sangoma FreePBX", "tags": [ "sangoma", "freepbx", "cisa-kev", "rce", "auth-bypass" ], "cveIds": [ "CVE-2025-57819" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-29", "closedAt": "2025-08-29", "updatedAt": "2025-08-29", "summary": "Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Added to CISA KEV on 2025-08-29.", "xPost": null }, { "slug": "citrix-netscaler-cve-2025-7775", "title": "Citrix NetScaler: NetScaler Memory Overflow Vulnerability", "url": "https://pwn.watch/i/citrix-netscaler-cve-2025-7775", "json": "https://pwn.watch/i/citrix-netscaler-cve-2025-7775.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Citrix NetScaler", "tags": [ "citrix", "netscaler", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-7775" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-26", "closedAt": "2025-08-26", "updatedAt": "2025-08-26", "summary": "Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service. Added to CISA KEV on 2025-08-26.", "xPost": null }, { "slug": "citrix-session-recording-cve-2024-8068", "title": "Citrix Session Recording: 2 exploited vulnerabilities (CVE-2024-8068, CVE-2024-8069)", "url": "https://pwn.watch/i/citrix-session-recording-cve-2024-8068", "json": "https://pwn.watch/i/citrix-session-recording-cve-2024-8068.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Citrix Session Recording", "tags": [ "citrix", "windows", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-8068", "CVE-2024-8069" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-25", "closedAt": "2025-08-25", "updatedAt": "2025-08-25", "summary": "CVE-2024-8068: Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain. CVE-2024-8069: Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server. Added to CISA KEV on 2025-08-25.", "xPost": null }, { "slug": "trend-micro-apex-one-cve-2025-54948", "title": "Trend Micro Apex One: Apex One OS Command Injection Vulnerability", "url": "https://pwn.watch/i/trend-micro-apex-one-cve-2025-54948", "json": "https://pwn.watch/i/trend-micro-apex-one-cve-2025-54948.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Trend Micro Apex One", "tags": [ "trend-micro", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-54948" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-18", "closedAt": "2025-08-18", "updatedAt": "2025-08-18", "summary": "Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. Added to CISA KEV on 2025-08-18.", "xPost": null }, { "slug": "n-able-n-central-cve-2025-8875", "title": "N-able N-Central: 2 exploited vulnerabilities (CVE-2025-8875, CVE-2025-8876)", "url": "https://pwn.watch/i/n-able-n-central-cve-2025-8875", "json": "https://pwn.watch/i/n-able-n-central-cve-2025-8875.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "N-able N-Central", "tags": [ "n-able", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-8875", "CVE-2025-8876" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-13", "closedAt": "2025-08-13", "updatedAt": "2025-08-13", "summary": "CVE-2025-8875: N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution. CVE-2025-8876: N-able N-Central contains a command injection vulnerability via improper sanitization of user input. Added to CISA KEV on 2025-08-13.", "xPost": null }, { "slug": "microsoft-internet-explorer-cve-2013-3893", "title": "Microsoft Internet Explorer: Internet Explorer Resource Management Errors Vulnerability", "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893", "json": "https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Internet Explorer", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2013-3893" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-12", "closedAt": "2025-08-12", "updatedAt": "2025-08-12", "summary": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-08-12.", "xPost": null }, { "slug": "microsoft-office-cve-2007-0671", "title": "Microsoft Office: Office Excel Remote Code Execution Vulnerability", "url": "https://pwn.watch/i/microsoft-office-cve-2007-0671", "json": "https://pwn.watch/i/microsoft-office-cve-2007-0671.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Office", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2007-0671" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-12", "closedAt": "2025-08-12", "updatedAt": "2025-08-12", "summary": "Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system. Added to CISA KEV on 2025-08-12.", "xPost": null }, { "slug": "d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078", "title": "D-Link DCS-2530L and DCS-2670L Devices: 2 exploited vulnerabilities (CVE-2020-25078, CVE-2020-25079)", "url": "https://pwn.watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078", "json": "https://pwn.watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "D-Link DCS-2530L and DCS-2670L Devices", "tags": [ "d-link", "cisa-kev", "rce" ], "cveIds": [ "CVE-2020-25078", "CVE-2020-25079" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-05", "closedAt": "2025-08-05", "updatedAt": "2025-08-05", "summary": "CVE-2020-25078: D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2020-25079: D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-08-05.", "xPost": null }, { "slug": "cisco-identity-services-engine-cve-2025-20281", "title": "Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)", "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281", "json": "https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cisco Identity Services Engine", "tags": [ "cisco", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-20281", "CVE-2025-20337" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-07-28", "closedAt": "2025-07-28", "updatedAt": "2025-07-28", "summary": "CVE-2025-20281: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20337: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. Added to CISA KEV on 2025-07-28.", "xPost": null }, { "slug": "toolshell-sharepoint-cve-2025-53770", "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770", "json": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SharePoint Server (on-premises)", "tags": [ "toolshell", "microsoft", "sharepoint", "zero-day", "rce", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-49704", "CVE-2025-49706", "CVE-2025-53770" ], "affectedVersions": [ "On-premises SharePoint Server (see Microsoft customer guidance for the exact builds)" ], "fixedVersions": [ "See Microsoft customer guidance for CVE-2025-53770" ], "startedAt": "2025-07-18", "closedAt": "2025-07-22", "updatedAt": "2025-07-22", "summary": "Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.", "xPost": null }, { "slug": "phpmailer-cve-2016-10033", "title": "PHPMailer: PHPMailer Command Injection Vulnerability", "url": "https://pwn.watch/i/phpmailer-cve-2016-10033", "json": "https://pwn.watch/i/phpmailer-cve-2016-10033.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "PHPMailer", "tags": [ "php", "phpmailer", "cisa-kev", "rce" ], "cveIds": [ "CVE-2016-10033" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-07-07", "closedAt": "2025-07-07", "updatedAt": "2025-07-07", "summary": "PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. Added to CISA KEV on 2025-07-07.", "xPost": null }, { "slug": "tp-link-multiple-routers-cve-2023-33538", "title": "TP-Link Multiple Routers: Multiple Routers Command Injection Vulnerability", "url": "https://pwn.watch/i/tp-link-multiple-routers-cve-2023-33538", "json": "https://pwn.watch/i/tp-link-multiple-routers-cve-2023-33538.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TP-Link Multiple Routers", "tags": [ "tp-link", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-33538" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-16", "closedAt": "2025-06-16", "updatedAt": "2025-06-16", "summary": "TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-06-16.", "xPost": null }, { "slug": "wazuh-server-cve-2025-24016", "title": "Wazuh Server: Server Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/wazuh-server-cve-2025-24016", "json": "https://pwn.watch/i/wazuh-server-cve-2025-24016.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Wazuh Server", "tags": [ "wazuh", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-24016" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-10", "closedAt": "2025-06-10", "updatedAt": "2025-06-10", "summary": "Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers. Added to CISA KEV on 2025-06-10.", "xPost": null }, { "slug": "craft-cms-cve-2024-56145", "title": "Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)", "url": "https://pwn.watch/i/craft-cms-cve-2024-56145", "json": "https://pwn.watch/i/craft-cms-cve-2024-56145.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Craft CMS", "tags": [ "php", "craft-cms", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-56145", "CVE-2025-35939" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-02", "closedAt": "2025-06-02", "updatedAt": "2025-06-02", "summary": "CVE-2024-56145: Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled. CVE-2025-35939: Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432. Added to CISA KEV on 2025-06-02.", "xPost": null }, { "slug": "asus-rt-ax55-routers-cve-2023-39780", "title": "ASUS RT-AX55 Routers: RT-AX55 Routers OS Command Injection Vulnerability", "url": "https://pwn.watch/i/asus-rt-ax55-routers-cve-2023-39780", "json": "https://pwn.watch/i/asus-rt-ax55-routers-cve-2023-39780.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "ASUS RT-AX55 Routers", "tags": [ "asus", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-39780" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-02", "closedAt": "2025-06-02", "updatedAt": "2025-06-02", "summary": "ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346. Added to CISA KEV on 2025-06-02.", "xPost": null }, { "slug": "connectwise-screenconnect-cve-2025-3935", "title": "ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability", "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935", "json": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "ConnectWise ScreenConnect", "tags": [ "connectwise", "screenconnect", "cisa-kev", "rce", "auth-bypass" ], "cveIds": [ "CVE-2025-3935" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-02", "closedAt": "2025-06-02", "updatedAt": "2025-06-02", "summary": "ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.", "xPost": null }, { "slug": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427", "title": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)", "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427", "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM)", "tags": [ "ivanti", "cisa-kev", "rce", "auth-bypass" ], "cveIds": [ "CVE-2025-4427", "CVE-2025-4428" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-19", "closedAt": "2025-05-19", "updatedAt": "2025-05-19", "summary": "CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036. Added to CISA KEV on 2025-05-19.", "xPost": null }, { "slug": "draytek-vigor-routers-cve-2024-12987", "title": "DrayTek Vigor Routers: Vigor Routers OS Command Injection Vulnerability", "url": "https://pwn.watch/i/draytek-vigor-routers-cve-2024-12987", "json": "https://pwn.watch/i/draytek-vigor-routers-cve-2024-12987.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "DrayTek Vigor Routers", "tags": [ "draytek", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-12987" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-15", "closedAt": "2025-05-15", "updatedAt": "2025-05-15", "summary": "DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface. Added to CISA KEV on 2025-05-15.", "xPost": null }, { "slug": "geovision-multiple-devices-cve-2024-11120", "title": "GeoVision Multiple Devices: 2 exploited vulnerabilities (CVE-2024-11120, CVE-2024-6047)", "url": "https://pwn.watch/i/geovision-multiple-devices-cve-2024-11120", "json": "https://pwn.watch/i/geovision-multiple-devices-cve-2024-11120.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "GeoVision Multiple Devices", "tags": [ "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-11120", "CVE-2024-6047" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-07", "closedAt": "2025-05-07", "updatedAt": "2025-05-07", "summary": "CVE-2024-11120: Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2024-6047: Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-05-07.", "xPost": null }, { "slug": "sonicwall-sma100-appliances-cve-2023-44221", "title": "SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability", "url": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2023-44221", "json": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2023-44221.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SonicWall SMA100 Appliances", "tags": [ "sonicwall", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-44221" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-01", "closedAt": "2025-05-01", "updatedAt": "2025-05-01", "summary": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user. Added to CISA KEV on 2025-05-01.", "xPost": null }, { "slug": "broadcom-brocade-fabric-os-cve-2025-1976", "title": "Broadcom Brocade Fabric OS: Brocade Fabric OS Code Injection Vulnerability", "url": "https://pwn.watch/i/broadcom-brocade-fabric-os-cve-2025-1976", "json": "https://pwn.watch/i/broadcom-brocade-fabric-os-cve-2025-1976.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Broadcom Brocade Fabric OS", "tags": [ "broadcom", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-1976" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-28", "closedAt": "2025-04-28", "updatedAt": "2025-04-28", "summary": "Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges. Added to CISA KEV on 2025-04-28.", "xPost": null }, { "slug": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "title": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324", "json": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SAP NetWeaver Visual Composer", "tags": [ "sap", "netweaver", "zero-day", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-31324" ], "affectedVersions": [ "SAP NetWeaver Visual Composer (VCFRAMEWORK); see SAP Security Note" ], "fixedVersions": [ "See SAP Security Note for CVE-2025-31324" ], "startedAt": "2025-04-24", "closedAt": "2025-04-29", "updatedAt": "2025-05-15", "summary": "A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.", "xPost": null }, { "slug": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "title": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)", "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "json": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Erlang/OTP SSH", "tags": [ "erlang", "ssh", "rce", "auth-bypass", "cisa-kev" ], "cveIds": [ "CVE-2025-32433" ], "affectedVersions": [ "OTP SSH before OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20" ], "fixedVersions": [ "OTP-27.3.3", "OTP-26.2.5.11", "OTP-25.3.2.20" ], "startedAt": "2025-04-16", "closedAt": "2025-06-09", "updatedAt": "2025-06-09", "summary": "The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.", "xPost": null }, { "slug": "sonicwall-sma100-appliances-cve-2021-20035", "title": "SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability", "url": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2021-20035", "json": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2021-20035.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "SonicWall SMA100 Appliances", "tags": [ "sonicwall", "cisa-kev", "rce" ], "cveIds": [ "CVE-2021-20035" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-16", "closedAt": "2025-04-16", "updatedAt": "2025-04-16", "summary": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution. Added to CISA KEV on 2025-04-16.", "xPost": null }, { "slug": "gladinet-centrestack-cve-2025-30406", "title": "Gladinet CentreStack: CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability", "url": "https://pwn.watch/i/gladinet-centrestack-cve-2025-30406", "json": "https://pwn.watch/i/gladinet-centrestack-cve-2025-30406.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Gladinet CentreStack", "tags": [ "gladinet", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-30406" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-08", "closedAt": "2025-04-08", "updatedAt": "2025-04-08", "summary": "Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution. Added to CISA KEV on 2025-04-08.", "xPost": null }, { "slug": "ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457", "title": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability", "url": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457", "json": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways", "tags": [ "ivanti", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-22457" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-04", "closedAt": "2025-04-04", "updatedAt": "2025-04-04", "summary": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. Added to CISA KEV on 2025-04-04.", "xPost": null }, { "slug": "ingressnightmare-ingress-nginx-cve-2025-1974", "title": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)", "url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974", "json": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Kubernetes ingress-nginx controller", "tags": [ "hosting", "kubernetes", "nginx", "ingress-nginx", "rce" ], "cveIds": [ "CVE-2025-1974" ], "affectedVersions": [ "< 1.11.0", "1.11.0-1.11.4", "1.12.0" ], "fixedVersions": [ "1.11.5", "1.12.1" ], "startedAt": "2025-03-24", "closedAt": "2025-03-24", "updatedAt": "2025-03-24", "summary": "Wiz found that the ingress-nginx admission webhook could be made to load attacker config and run code, giving access to all cluster secrets the controller can read. CVSS 9.8. Fixed in controller v1.12.1 and v1.11.5; otherwise disable the validating webhook.", "xPost": null }, { "slug": "edimax-ic-7100-ip-camera-cve-2025-1316", "title": "Edimax IC-7100 IP Camera: IC-7100 IP Camera OS Command Injection Vulnerability", "url": "https://pwn.watch/i/edimax-ic-7100-ip-camera-cve-2025-1316", "json": "https://pwn.watch/i/edimax-ic-7100-ip-camera-cve-2025-1316.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Edimax IC-7100 IP Camera", "tags": [ "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-1316" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-19", "closedAt": "2025-03-19", "updatedAt": "2025-03-19", "summary": "Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-03-19.", "xPost": null }, { "slug": "progress-whatsup-gold-cve-2024-4885", "title": "Progress WhatsUp Gold: WhatsUp Gold Path Traversal Vulnerability", "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-4885", "json": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-4885.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Progress WhatsUp Gold", "tags": [ "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-4885" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-03", "closedAt": "2025-03-03", "updatedAt": "2025-03-03", "summary": "Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution. Added to CISA KEV on 2025-03-03.", "xPost": null }, { "slug": "cisco-small-business-rv-series-routers-cve-2023-20118", "title": "Cisco Small Business RV Series Routers: Small Business RV Series Routers Command Injection Vulnerability", "url": "https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118", "json": "https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Cisco Small Business RV Series Routers", "tags": [ "cisco", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-20118" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-03", "closedAt": "2025-03-03", "updatedAt": "2025-03-03", "summary": "Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data. Added to CISA KEV on 2025-03-03.", "xPost": null }, { "slug": "craft-cms-cve-2025-23209", "title": "Craft CMS: Code Injection Vulnerability", "url": "https://pwn.watch/i/craft-cms-cve-2025-23209", "json": "https://pwn.watch/i/craft-cms-cve-2025-23209.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Craft CMS", "tags": [ "php", "craft-cms", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-23209" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-20", "closedAt": "2025-02-20", "updatedAt": "2025-02-20", "summary": "Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution. Added to CISA KEV on 2025-02-20.", "xPost": null }, { "slug": "zyxel-dsl-cpe-devices-cve-2024-40890", "title": "Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)", "url": "https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890", "json": "https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890.json", "status": "closed", "severity": "high", "patchStatus": "unpatched", "product": "Zyxel DSL CPE Devices", "tags": [ "zyxel", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-40890", "CVE-2024-40891" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "None: CISA says the product is end-of-life; discontinue use" ], "startedAt": "2025-02-11", "closedAt": "2025-02-11", "updatedAt": "2025-02-11", "summary": "CVE-2024-40890: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request. CVE-2024-40891: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. Added to CISA KEV on 2025-02-11.", "xPost": null }, { "slug": "trimble-cityworks-cve-2025-0994", "title": "Trimble Cityworks: Cityworks Deserialization Vulnerability", "url": "https://pwn.watch/i/trimble-cityworks-cve-2025-0994", "json": "https://pwn.watch/i/trimble-cityworks-cve-2025-0994.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Trimble Cityworks", "tags": [ "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-0994" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-07", "closedAt": "2025-02-07", "updatedAt": "2025-02-07", "summary": "Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server. Added to CISA KEV on 2025-02-07.", "xPost": null }, { "slug": "microsoft-office-outlook-cve-2024-21413", "title": "Microsoft Office Outlook: Outlook Improper Input Validation Vulnerability", "url": "https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413", "json": "https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Office Outlook", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-21413" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-06", "closedAt": "2025-02-06", "updatedAt": "2025-02-06", "summary": "Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. Added to CISA KEV on 2025-02-06.", "xPost": null }, { "slug": "sophos-xg-firewall-cve-2020-15069", "title": "Sophos XG Firewall: XG Firewall Buffer Overflow Vulnerability", "url": "https://pwn.watch/i/sophos-xg-firewall-cve-2020-15069", "json": "https://pwn.watch/i/sophos-xg-firewall-cve-2020-15069.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Sophos XG Firewall", "tags": [ "sophos", "cisa-kev", "rce" ], "cveIds": [ "CVE-2020-15069" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-06", "closedAt": "2025-02-06", "updatedAt": "2025-02-06", "summary": "Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the \"HTTP/S bookmark\" feature. Added to CISA KEV on 2025-02-06.", "xPost": null }, { "slug": "paessler-prtg-network-monitor-cve-2018-19410", "title": "Paessler PRTG Network Monitor: 2 exploited vulnerabilities (CVE-2018-19410, CVE-2018-9276)", "url": "https://pwn.watch/i/paessler-prtg-network-monitor-cve-2018-19410", "json": "https://pwn.watch/i/paessler-prtg-network-monitor-cve-2018-19410.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Paessler PRTG Network Monitor", "tags": [ "prtg", "cisa-kev", "rce" ], "cveIds": [ "CVE-2018-19410", "CVE-2018-9276" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-04", "closedAt": "2025-02-04", "updatedAt": "2025-02-04", "summary": "CVE-2018-19410: Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator). CVE-2018-9276: Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console. Added to CISA KEV on 2025-02-04.", "xPost": null }, { "slug": "microsoft-net-framework-cve-2024-29059", "title": "Microsoft .NET Framework: .NET Framework Information Disclosure Vulnerability", "url": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059", "json": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft .NET Framework", "tags": [ "dotnet", "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-29059" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-04", "closedAt": "2025-02-04", "updatedAt": "2025-02-04", "summary": "Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution. Added to CISA KEV on 2025-02-04.", "xPost": null }, { "slug": "aviatrix-controllers-cve-2024-50603", "title": "Aviatrix Controllers: Controllers OS Command Injection Vulnerability", "url": "https://pwn.watch/i/aviatrix-controllers-cve-2024-50603", "json": "https://pwn.watch/i/aviatrix-controllers-cve-2024-50603.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Aviatrix Controllers", "tags": [ "aviatrix", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-50603" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-16", "closedAt": "2025-01-16", "updatedAt": "2025-01-16", "summary": "Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test. Added to CISA KEV on 2025-01-16.", "xPost": null }, { "slug": "beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686", "title": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS): Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability", "url": "https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686", "json": "https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)", "tags": [ "beyondtrust", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-12686" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-13", "closedAt": "2025-01-13", "updatedAt": "2025-01-13", "summary": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user. Added to CISA KEV on 2025-01-13.", "xPost": null }, { "slug": "ivanti-connect-secure-zero-day-cve-2025-0282", "title": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282", "json": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure, Policy Secure, ZTA Gateways", "tags": [ "ivanti", "vpn", "zero-day", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-0282" ], "affectedVersions": [ "Connect Secure 22.7R2 through 22.7R2.4 (Policy Secure / ZTA: see Ivanti advisory)" ], "fixedVersions": [ "Connect Secure 22.7R2.5" ], "startedAt": "2025-01-08", "closedAt": "2025-01-08", "updatedAt": "2025-01-08", "summary": "An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.", "xPost": null }, { "slug": "acclaim-systems-usaherds-cve-2021-44207", "title": "Acclaim Systems USAHERDS Use of Hard-Coded Credentials", "url": "https://pwn.watch/i/acclaim-systems-usaherds-cve-2021-44207", "json": "https://pwn.watch/i/acclaim-systems-usaherds-cve-2021-44207.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Acclaim Systems USAHERDS", "tags": [ "acclaim-systems", "cisa-kev", "rce" ], "cveIds": [ "CVE-2021-44207" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-12-23", "closedAt": "2024-12-23", "updatedAt": "2024-12-23", "summary": "Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel. Added to the CISA KEV catalog on 2024-12-23. CVE-2021-44207 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "nuuo-nvrmini-devices-cve-2018-14933", "title": "NUUO NVRmini Devices OS Command Injection", "url": "https://pwn.watch/i/nuuo-nvrmini-devices-cve-2018-14933", "json": "https://pwn.watch/i/nuuo-nvrmini-devices-cve-2018-14933.json", "status": "closed", "severity": "critical", "patchStatus": "unpatched", "product": "NUUO NVRmini Devices", "tags": [ "nuuo", "nvr", "cisa-kev", "rce" ], "cveIds": [ "CVE-2018-14933" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "No fix: CISA says the product is end-of-life and should be retired" ], "startedAt": "2024-12-18", "closedAt": "2024-12-18", "updatedAt": "2024-12-18", "summary": "NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. Added to the CISA KEV catalog on 2024-12-18. CVE-2018-14933 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "reolink-rlc-410w-ip-camera-cve-2021-40407", "title": "Reolink RLC-410W IP Camera OS Command Injection", "url": "https://pwn.watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407", "json": "https://pwn.watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407.json", "status": "closed", "severity": "critical", "patchStatus": "partial", "product": "Reolink RLC-410W IP Camera", "tags": [ "reolink", "ip-camera", "cisa-kev", "rce" ], "cveIds": [ "CVE-2021-40407" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory; CISA notes some models may be end-of-life" ], "startedAt": "2024-12-18", "closedAt": "2024-12-18", "updatedAt": "2024-12-18", "summary": "Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality. Added to the CISA KEV catalog on 2024-12-18. CVE-2021-40407 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "reolink-multiple-ip-cameras-cve-2019-11001", "title": "Reolink Multiple IP Cameras OS Command Injection", "url": "https://pwn.watch/i/reolink-multiple-ip-cameras-cve-2019-11001", "json": "https://pwn.watch/i/reolink-multiple-ip-cameras-cve-2019-11001.json", "status": "closed", "severity": "high", "patchStatus": "partial", "product": "Reolink Multiple IP Cameras", "tags": [ "reolink", "ip-camera", "cisa-kev", "rce" ], "cveIds": [ "CVE-2019-11001" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory; CISA notes some models may be end-of-life" ], "startedAt": "2024-12-18", "closedAt": "2024-12-18", "updatedAt": "2024-12-18", "summary": "Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the \"TestEmail\" functionality to inject and run OS commands as root. Added to the CISA KEV catalog on 2024-12-18. CVE-2019-11001 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "title": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "json": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)", "tags": [ "beyondtrust", "remote-support", "espionage", "data-breach", "cisa-kev", "rce", "nation-state" ], "cveIds": [ "CVE-2024-12356" ], "affectedVersions": [ "Remote Support and Privileged Remote Access 24.3.1 and earlier (BeyondTrust)" ], "fixedVersions": [ "Patches BT24-10-ONPREM1 / BT24-10-ONPREM2 (BeyondTrust); cloud instances patched 2024-12-16" ], "startedAt": "2024-12-05", "closedAt": "2024-12-19", "updatedAt": "2024-12-30", "summary": "Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.", "xPost": null }, { "slug": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "title": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "json": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "zero-day", "auth-bypass", "firewall", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-0012", "CVE-2024-9474" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-18", "closedAt": "2024-11-18", "updatedAt": "2024-11-18", "summary": "CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "nostromo-nhttpd-cve-2019-16278", "title": "Nostromo nhttpd Directory Traversal", "url": "https://pwn.watch/i/nostromo-nhttpd-cve-2019-16278", "json": "https://pwn.watch/i/nostromo-nhttpd-cve-2019-16278.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Nostromo nhttpd", "tags": [ "nostromo", "cisa-kev", "rce" ], "cveIds": [ "CVE-2019-16278" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-07", "closedAt": "2024-11-07", "updatedAt": "2024-11-07", "summary": "Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution. Added to the CISA KEV catalog on 2024-11-07. CVE-2019-16278 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-zero-days-october-2024-43572-43573", "title": "Microsoft October 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573", "json": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day", "rce" ], "cveIds": [ "CVE-2024-43572", "CVE-2024-43573" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-08", "closedAt": "2024-10-08", "updatedAt": "2024-10-08", "summary": "CVE-2024-43572: Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution. CVE-2024-43573: Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. Added to the CISA KEV catalog on 2024-10-08.", "xPost": null }, { "slug": "d-link-dir-820-router-cve-2023-25280", "title": "D-Link DIR-820 Router OS Command Injection", "url": "https://pwn.watch/i/d-link-dir-820-router-cve-2023-25280", "json": "https://pwn.watch/i/d-link-dir-820-router-cve-2023-25280.json", "status": "closed", "severity": "critical", "patchStatus": "unpatched", "product": "D-Link DIR-820 Router", "tags": [ "d-link", "router", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-25280" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "No fix: CISA says the product is end-of-life and should be retired" ], "startedAt": "2024-09-30", "closedAt": "2024-09-30", "updatedAt": "2024-09-30", "summary": "D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. Added to the CISA KEV catalog on 2024-09-30. CVE-2023-25280 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "draytek-multiple-vigor-routers-cve-2020-15415", "title": "DrayTek Multiple Vigor Routers OS Command Injection", "url": "https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415", "json": "https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "DrayTek Multiple Vigor Routers", "tags": [ "draytek", "router", "cisa-kev", "rce" ], "cveIds": [ "CVE-2020-15415" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-30", "closedAt": "2024-09-30", "updatedAt": "2024-09-30", "summary": "DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. Added to the CISA KEV catalog on 2024-09-30. CVE-2020-15415 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "sap-commerce-cloud-cve-2019-0344", "title": "SAP Commerce Cloud Deserialization of Untrusted Data", "url": "https://pwn.watch/i/sap-commerce-cloud-cve-2019-0344", "json": "https://pwn.watch/i/sap-commerce-cloud-cve-2019-0344.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SAP Commerce Cloud", "tags": [ "sap", "sap-commerce", "cisa-kev", "rce" ], "cveIds": [ "CVE-2019-0344" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-30", "closedAt": "2024-09-30", "updatedAt": "2024-09-30", "summary": "SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection. Added to the CISA KEV catalog on 2024-09-30. CVE-2019-0344 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-sql-server-cve-2020-0618", "title": "Microsoft SQL Server Reporting Services Remote Code Execution", "url": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618", "json": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SQL Server", "tags": [ "microsoft", "sql-server", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2020-0618" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-18", "closedAt": "2024-09-18", "updatedAt": "2024-09-18", "summary": "Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account. Added to the CISA KEV catalog on 2024-09-18. CISA lists known use in ransomware campaigns. CVE-2020-0618 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "oracle-adf-faces-cve-2022-21445", "title": "Oracle ADF Faces Deserialization of Untrusted Data", "url": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445", "json": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle ADF Faces", "tags": [ "java", "oracle", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-21445" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-18", "closedAt": "2024-09-18", "updatedAt": "2024-09-18", "summary": "Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2022-21445 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "oracle-weblogic-server-cve-2020-14644", "title": "Oracle WebLogic Server Remote Code Execution", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644", "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle WebLogic Server", "tags": [ "java", "oracle", "weblogic", "cisa-kev", "rce" ], "cveIds": [ "CVE-2020-14644" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-18", "closedAt": "2024-09-18", "updatedAt": "2024-09-18", "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2020-14644 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957", "title": "PTZOptics PT30X-SDI/NDI Cameras: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957", "json": "https://pwn.watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "PTZOptics PT30X-SDI/NDI Cameras", "tags": [ "ptzoptics", "ip-camera", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-8956", "CVE-2024-8957" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-17", "closedAt": "2024-11-04", "updatedAt": "2024-11-04", "summary": "CVE-2024-8956: PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root. CVE-2024-8957: PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script. Added to the CISA KEV catalog on 2024-11-04.", "xPost": null }, { "slug": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "title": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "json": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Cloud Services Appliance / Cloud Services Appliance (CSA)", "tags": [ "ivanti", "ivanti-csa", "zero-day", "sql-injection", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-8190", "CVE-2024-8963", "CVE-2024-9379", "CVE-2024-9380" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-10", "closedAt": "2024-10-09", "updatedAt": "2024-10-11", "summary": "Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.", "xPost": null }, { "slug": "veeam-backup-replication-cve-2024-40711", "title": "Veeam Backup and Replication Deserialization", "url": "https://pwn.watch/i/veeam-backup-replication-cve-2024-40711", "json": "https://pwn.watch/i/veeam-backup-replication-cve-2024-40711.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Veeam Backup & Replication", "tags": [ "veeam", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-40711" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-07", "closedAt": "2024-10-17", "updatedAt": "2024-10-17", "summary": "Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution. Added to the CISA KEV catalog on 2024-10-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-exchange-server-cve-2021-31196", "title": "Microsoft Exchange Server Information Disclosure", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196", "json": "https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Exchange Server", "tags": [ "microsoft", "exchange", "cisa-kev", "rce" ], "cveIds": [ "CVE-2021-31196" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-21", "closedAt": "2024-08-21", "updatedAt": "2024-08-21", "summary": "Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-08-21. CVE-2021-31196 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "solarwinds-web-help-desk-cve-2024-28986", "title": "SolarWinds Web Help Desk Deserialization of Untrusted Data", "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986", "json": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SolarWinds Web Help Desk", "tags": [ "solarwinds", "web-help-desk", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-28986" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-13", "closedAt": "2024-08-15", "updatedAt": "2024-08-15", "summary": "SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-15.", "xPost": null }, { "slug": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "title": "Microsoft August 2024: 6 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more", "json": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Project, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day", "rce" ], "cveIds": [ "CVE-2024-38106", "CVE-2024-38107", "CVE-2024-38178", "CVE-2024-38189", "CVE-2024-38193", "CVE-2024-38213" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-13", "closedAt": "2024-08-13", "updatedAt": "2024-08-13", "summary": "CVE-2024-38106: Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. CVE-2024-38107: Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CVE-2024-38178: Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CVE-2024-38189: Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. CVE-2024-38193: Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CVE-2024-38213: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. Added to the CISA KEV catalog on 2024-08-13.", "xPost": null }, { "slug": "apache-ofbiz-cve-2024-38856", "title": "Apache OFBiz Incorrect Authorization", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856", "json": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apache OFBiz", "tags": [ "java", "apache", "ofbiz", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-38856" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-05", "closedAt": "2024-08-27", "updatedAt": "2024-08-27", "summary": "Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker. Added to the CISA KEV catalog on 2024-08-27.", "xPost": null }, { "slug": "microsoft-windows-cve-2018-0824", "title": "Microsoft COM for Windows Deserialization of Untrusted Data", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-0824", "json": "https://pwn.watch/i/microsoft-windows-cve-2018-0824.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "rce" ], "cveIds": [ "CVE-2018-0824" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-05", "closedAt": "2024-08-05", "updatedAt": "2024-08-05", "summary": "Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script. Added to the CISA KEV catalog on 2024-08-05. CVE-2018-0824 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "title": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465", "json": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks Expedition", "tags": [ "palo-alto", "expedition", "cisa-kev", "pan-os", "rce", "sql-injection", "auth-bypass" ], "cveIds": [ "CVE-2024-5910", "CVE-2024-9463", "CVE-2024-9465" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-10", "closedAt": "2024-11-14", "updatedAt": "2024-11-14", "summary": "CVE-2024-5910: Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. CVE-2024-9463: Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. CVE-2024-9465: Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. Added to the CISA KEV catalog on 2024-11-07, 2024-11-14.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2024-38094", "title": "Microsoft SharePoint Deserialization", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-38094" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-09", "closedAt": "2024-10-22", "updatedAt": "2024-10-22", "summary": "Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-10-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "osgeo-geoserver-cve-2024-36401", "title": "OSGeo GeoServer GeoTools Eval Injection", "url": "https://pwn.watch/i/osgeo-geoserver-cve-2024-36401", "json": "https://pwn.watch/i/osgeo-geoserver-cve-2024-36401.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "OSGeo GeoServer", "tags": [ "java", "osgeo", "geoserver", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-36401" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-01", "closedAt": "2024-07-15", "updatedAt": "2024-07-15", "summary": "OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Added to the CISA KEV catalog on 2024-07-15.", "xPost": null }, { "slug": "openssh-regresshion-cve-2024-6387", "title": "regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)", "url": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387", "json": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "OpenSSH sshd (glibc-based Linux)", "tags": [ "linux", "openssh", "rce" ], "cveIds": [ "CVE-2024-6387" ], "affectedVersions": [ "8.5p1 up to (not including) 9.8p1", "Versions before 4.4p1 unless patched for CVE-2006-5051 and CVE-2008-4109 (Qualys)" ], "fixedVersions": [ "9.8p1" ], "startedAt": "2024-07-01", "closedAt": "2024-07-01", "updatedAt": "2024-07-01", "summary": "Qualys found a signal handler race condition in OpenSSH's sshd on glibc-based Linux that can give an unauthenticated attacker remote code execution as root. It is a regression of CVE-2006-5051 that came back in OpenSSH 8.5p1 (October 2020). Exploitation is difficult, but Qualys counted over 14 million potentially vulnerable internet-exposed servers. Fixed in OpenSSH 9.8p1.", "xPost": null }, { "slug": "cisco-nx-os-cve-2024-20399", "title": "Cisco NX-OS Command Injection", "url": "https://pwn.watch/i/cisco-nx-os-cve-2024-20399", "json": "https://pwn.watch/i/cisco-nx-os-cve-2024-20399.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Cisco NX-OS", "tags": [ "cisco", "nx-os", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-20399" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-01", "closedAt": "2024-07-02", "updatedAt": "2024-07-02", "summary": "Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. Added to the CISA KEV catalog on 2024-07-02.", "xPost": null }, { "slug": "osgeo-jai-ext-cve-2022-24816", "title": "OSGeo GeoServer JAI-EXT Code Injection", "url": "https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816", "json": "https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "OSGeo JAI-EXT", "tags": [ "java", "osgeo", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-24816" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-26", "closedAt": "2024-06-26", "updatedAt": "2024-06-26", "summary": "OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-24816 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "adobe-commerce-and-magento-open-source-cve-2024-34102", "title": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)", "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102", "json": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Adobe Commerce and Magento Open Source", "tags": [ "php", "adobe", "magento", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-34102" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-13", "closedAt": "2024-07-17", "updatedAt": "2024-07-17", "summary": "Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-07-17.", "xPost": null }, { "slug": "android-kernel-cve-2024-36971", "title": "Android Kernel Remote Code Execution", "url": "https://pwn.watch/i/android-kernel-cve-2024-36971", "json": "https://pwn.watch/i/android-kernel-cve-2024-36971.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Android Kernel", "tags": [ "android", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-36971" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-10", "closedAt": "2024-08-07", "updatedAt": "2024-08-07", "summary": "Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS. Added to the CISA KEV catalog on 2024-08-07.", "xPost": null }, { "slug": "php-cgi-argument-injection-cve-2024-4577", "title": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577", "json": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "PHP Group PHP", "tags": [ "php", "windows", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-4577" ], "affectedVersions": [ "PHP < 8.3.8, < 8.2.20, < 8.1.29 (GitHub advisory); exploitable on Windows in CGI mode" ], "fixedVersions": [ "8.3.8", "8.2.20", "8.1.29" ], "startedAt": "2024-06-06", "closedAt": "2024-06-12", "updatedAt": "2024-06-12", "summary": "A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "oracle-weblogic-server-cve-2017-3506", "title": "Oracle WebLogic Server OS Command Injection", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506", "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Oracle WebLogic Server", "tags": [ "java", "oracle", "weblogic", "cisa-kev", "rce" ], "cveIds": [ "CVE-2017-3506" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-03", "closedAt": "2024-06-03", "updatedAt": "2024-06-03", "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Added to the CISA KEV catalog on 2024-06-03. CVE-2017-3506 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "nextgen-healthcare-mirth-connect-cve-2023-43208", "title": "NextGen Healthcare Mirth Connect Deserialization of Untrusted Data", "url": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208", "json": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "NextGen Healthcare Mirth Connect", "tags": [ "java", "nextgen-healthcare", "mirth-connect", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-43208" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-20", "closedAt": "2024-05-20", "updatedAt": "2024-05-20", "summary": "NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request. Added to the CISA KEV catalog on 2024-05-20. CISA lists known use in ransomware campaigns. CVE-2023-43208 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "apache-ofbiz-cve-2024-32113", "title": "Apache OFBiz Path Traversal", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113", "json": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache OFBiz", "tags": [ "java", "apache", "ofbiz", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-32113" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-08", "closedAt": "2024-08-07", "updatedAt": "2024-08-07", "summary": "Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-07.", "xPost": null }, { "slug": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "title": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "json": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "zero-day", "rce", "vpn", "firewall", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-3400" ], "affectedVersions": [ "PAN-OS 10.2, 11.0 and 11.1 with GlobalProtect (exact hotfix ranges in the Palo Alto advisory)" ], "fixedVersions": [ "Hotfix releases per the Palo Alto advisory, e.g. 10.2.9-h1, 11.0.4-h1, 11.1.2-h3" ], "startedAt": "2024-04-12", "closedAt": "2024-04-12", "updatedAt": "2024-04-12", "summary": "A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "d-link-multiple-nas-devices-cve-2024-3272-3273", "title": "D-Link Multiple NAS Devices: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/d-link-multiple-nas-devices-cve-2024-3272-3273", "json": "https://pwn.watch/i/d-link-multiple-nas-devices-cve-2024-3272-3273.json", "status": "closed", "severity": "critical", "patchStatus": "unpatched", "product": "D-Link Multiple NAS Devices", "tags": [ "d-link", "nas", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-3272", "CVE-2024-3273" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "No fix: CISA says the product is end-of-life and should be retired" ], "startedAt": "2024-04-04", "closedAt": "2024-04-11", "updatedAt": "2024-04-11", "summary": "CVE-2024-3272: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution. CVE-2024-3273: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. Added to the CISA KEV catalog on 2024-04-11.", "xPost": null }, { "slug": "xz-utils-backdoor-cve-2024-3094", "title": "xz-utils backdoor (CVE-2024-3094)", "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094", "json": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "XZ Utils (liblzma)", "tags": [ "linux", "xz-utils", "openssh", "supply-chain", "backdoor", "rce" ], "cveIds": [ "CVE-2024-3094" ], "affectedVersions": [ "5.6.0", "5.6.1" ], "fixedVersions": [ "Downgrade to an uncompromised version such as 5.4.6 Stable (CISA)", "5.6.2 clean release (2024-05-29, tukaani.org)" ], "startedAt": "2024-03-29", "closedAt": "2024-05-29", "updatedAt": "2024-05-29", "summary": "A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2023-24955", "title": "Microsoft SharePoint Server Code Injection", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-24955" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-26", "closedAt": "2024-03-26", "updatedAt": "2024-03-26", "summary": "Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely. Added to the CISA KEV catalog on 2024-03-26. CISA lists known use in ransomware campaigns. CVE-2023-24955 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529", "title": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection", "url": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529", "json": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA)", "tags": [ "ivanti", "ivanti-epm", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2021-44529" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-25", "closedAt": "2024-03-25", "updatedAt": "2024-03-25", "summary": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody). Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2021-44529 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "nice-linear-emerge-e3-series-cve-2019-7256", "title": "Nice Linear eMerge E3-Series OS Command Injection", "url": "https://pwn.watch/i/nice-linear-emerge-e3-series-cve-2019-7256", "json": "https://pwn.watch/i/nice-linear-emerge-e3-series-cve-2019-7256.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Nice Linear eMerge E3-Series", "tags": [ "nice", "cisa-kev", "rce" ], "cveIds": [ "CVE-2019-7256" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-25", "closedAt": "2024-03-25", "updatedAt": "2024-03-25", "summary": "Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution. Added to the CISA KEV catalog on 2024-03-25. CVE-2019-7256 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "sunhillo-sureline-cve-2021-36380", "title": "Sunhillo SureLine OS Command Injection", "url": "https://pwn.watch/i/sunhillo-sureline-cve-2021-36380", "json": "https://pwn.watch/i/sunhillo-sureline-cve-2021-36380.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Sunhillo SureLine", "tags": [ "sunhillo", "cisa-kev", "rce" ], "cveIds": [ "CVE-2021-36380" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-05", "closedAt": "2024-03-05", "updatedAt": "2024-03-05", "summary": "Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi. Added to the CISA KEV catalog on 2024-03-05. CVE-2021-36380 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "progress-kemp-loadmaster-cve-2024-1212", "title": "Progress Kemp LoadMaster OS Command Injection", "url": "https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212", "json": "https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Progress Kemp LoadMaster", "tags": [ "progress", "kemp-loadmaster", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-1212" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-21", "closedAt": "2024-11-18", "updatedAt": "2024-11-18", "summary": "Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Added to the CISA KEV catalog on 2024-11-18.", "xPost": null }, { "slug": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "title": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897", "json": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Jenkins Command Line Interface (CLI)", "tags": [ "devtools", "java", "jenkins", "ci-cd", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-23897" ], "affectedVersions": [ "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier (Jenkins advisory)" ], "fixedVersions": [ "Jenkins 2.442", "LTS 2.426.3", "LTS 2.440.1" ], "startedAt": "2024-01-24", "closedAt": "2024-08-19", "updatedAt": "2024-08-19", "summary": "Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "vmware-vcenter-server-cve-2023-34048", "title": "VMware vCenter Server Out-of-Bounds Write", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2023-34048", "json": "https://pwn.watch/i/vmware-vcenter-server-cve-2023-34048.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "VMware vCenter Server", "tags": [ "vmware", "vcenter", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-34048" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-22", "closedAt": "2024-01-22", "updatedAt": "2024-01-22", "summary": "VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. Added to the CISA KEV catalog on 2024-01-22. CVE-2023-34048 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549", "title": "Citrix NetScaler ADC and NetScaler Gateway: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549", "json": "https://pwn.watch/i/citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Citrix NetScaler ADC and NetScaler Gateway", "tags": [ "citrix", "netscaler", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-6548", "CVE-2023-6549" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-17", "closedAt": "2024-01-17", "updatedAt": "2024-01-17", "summary": "CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP. CVE-2023-6549: Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Added to the CISA KEV catalog on 2024-01-17. CVE-2023-6548, CVE-2023-6549 were assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "atlassian-confluence-data-center-and-server-cve-2023-22527", "title": "Atlassian Confluence Data Center and Server Template Injection", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527", "json": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-22527" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-16", "closedAt": "2024-01-24", "updatedAt": "2024-01-24", "summary": "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. Added to the CISA KEV catalog on 2024-01-24. CISA lists known use in ransomware campaigns. CVE-2023-22527 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "title": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "json": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons", "tags": [ "ivanti", "ivanti-connect-secure", "vpn", "zero-day", "auth-bypass", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2023-46805", "CVE-2024-21887", "CVE-2024-21893" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-10", "closedAt": "2024-01-31", "updatedAt": "2024-01-31", "summary": "Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "d-link-dsl-2750b-devices-cve-2016-20017", "title": "D-Link DSL-2750B Devices Command Injection", "url": "https://pwn.watch/i/d-link-dsl-2750b-devices-cve-2016-20017", "json": "https://pwn.watch/i/d-link-dsl-2750b-devices-cve-2016-20017.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "D-Link DSL-2750B Devices", "tags": [ "d-link", "cisa-kev", "rce" ], "cveIds": [ "CVE-2016-20017" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-08", "closedAt": "2024-01-08", "updatedAt": "2024-01-08", "summary": "D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter. Added to the CISA KEV catalog on 2024-01-08. CVE-2016-20017 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "spreadsheet-parseexcel-cve-2023-7101", "title": "Spreadsheet::ParseExcel Remote Code Execution", "url": "https://pwn.watch/i/spreadsheet-parseexcel-cve-2023-7101", "json": "https://pwn.watch/i/spreadsheet-parseexcel-cve-2023-7101.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Spreadsheet::ParseExcel", "tags": [ "perl", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-7101" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-02", "closedAt": "2024-01-02", "updatedAt": "2024-01-02", "summary": "Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic. Added to the CISA KEV catalog on 2024-01-02. CVE-2023-7101 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "fxc-ae1021-ae1021pe-cve-2023-49897", "title": "FXC AE1021, AE1021PE: OS Command Injection (CVE-2023-49897)", "url": "https://pwn.watch/i/fxc-ae1021-ae1021pe-cve-2023-49897", "json": "https://pwn.watch/i/fxc-ae1021-ae1021pe-cve-2023-49897.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "FXC AE1021, AE1021PE", "tags": [ "fxc", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-49897" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-12-21", "closedAt": "2023-12-21", "updatedAt": "2023-12-21", "summary": "FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network. Added to CISA KEV on 2023-12-21.", "xPost": null }, { "slug": "qnap-viostor-nvr-cve-2023-47565", "title": "QNAP VioStor NVR: OS Command Injection (CVE-2023-47565)", "url": "https://pwn.watch/i/qnap-viostor-nvr-cve-2023-47565", "json": "https://pwn.watch/i/qnap-viostor-nvr-cve-2023-47565.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "QNAP VioStor NVR", "tags": [ "qnap", "cisa-kev", "rce", "iot" ], "cveIds": [ "CVE-2023-47565" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-12-21", "closedAt": "2023-12-21", "updatedAt": "2023-12-21", "summary": "QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network. Added to CISA KEV on 2023-12-21.", "xPost": null }, { "slug": "sophos-web-appliance-cve-2023-1671", "title": "Sophos Web Appliance: Command Injection (CVE-2023-1671)", "url": "https://pwn.watch/i/sophos-web-appliance-cve-2023-1671", "json": "https://pwn.watch/i/sophos-web-appliance-cve-2023-1671.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Sophos Web Appliance", "tags": [ "sophos", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-1671" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-11-16", "closedAt": "2023-11-16", "updatedAt": "2023-11-16", "summary": "Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. Added to CISA KEV on 2023-11-16.", "xPost": null }, { "slug": "apache-activemq-openwire-rce-cve-2023-46604", "title": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604", "json": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Apache ActiveMQ (Java OpenWire brokers and clients)", "tags": [ "java", "apache", "activemq", "rce", "deserialization", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-46604" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "5.15.16", "5.16.7", "5.17.6", "5.18.3" ], "startedAt": "2023-10-27", "closedAt": "2023-11-02", "updatedAt": "2023-11-02", "summary": "A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.", "xPost": null }, { "slug": "trend-micro-apex-one-and-worry-free-business-cve-2023-41179", "title": "Trend Micro Apex One and Worry-Free Business Security: Remote Code Execution (CVE-2023-41179)", "url": "https://pwn.watch/i/trend-micro-apex-one-and-worry-free-business-cve-2023-41179", "json": "https://pwn.watch/i/trend-micro-apex-one-and-worry-free-business-cve-2023-41179.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Trend Micro Apex One and Worry-Free Business Security", "tags": [ "trend-micro", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-41179" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-09-21", "closedAt": "2023-09-21", "updatedAt": "2023-09-21", "summary": "Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability. Added to CISA KEV on 2023-09-21.", "xPost": null }, { "slug": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "title": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198", "json": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cisco IOS XE Software (web UI)", "tags": [ "cisco", "ios-xe", "zero-day", "auth-bypass", "rce", "cisa-kev" ], "cveIds": [ "CVE-2023-20198", "CVE-2023-20273" ], "affectedVersions": [ "IOS XE with the HTTP/HTTPS server (web UI) enabled; see vendor advisory" ], "fixedVersions": [ "17.9.4a", "17.6.6a", "17.3.8a", "16.12.10a (Catalyst 3650/3850 only)" ], "startedAt": "2023-09-18", "closedAt": "2023-10-23", "updatedAt": "2023-10-23", "summary": "Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.", "xPost": null }, { "slug": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "title": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793", "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "JetBrains TeamCity On-Premises", "tags": [ "devtools", "jetbrains", "teamcity", "ci-cd", "auth-bypass", "rce", "north-korea", "apt29", "cisa-kev" ], "cveIds": [ "CVE-2023-42793" ], "affectedVersions": [ "Before 2023.05.4 (NVD)" ], "fixedVersions": [ "2023.05.4" ], "startedAt": "2023-09-18", "closedAt": "2023-12-13", "updatedAt": "2023-12-13", "summary": "An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.", "xPost": null }, { "slug": "winrar-zero-day-cve-2023-38831", "title": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831", "json": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "RARLAB WinRAR", "tags": [ "winrar", "rarlab", "windows", "zero-day", "rce", "cisa-kev" ], "cveIds": [ "CVE-2023-38831" ], "affectedVersions": [ "Before 6.23 (NVD)" ], "fixedVersions": [ "6.23" ], "startedAt": "2023-08-02", "closedAt": "2023-10-18", "updatedAt": "2023-10-18", "summary": "WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.", "xPost": null }, { "slug": "citrix-netscaler-rce-cve-2023-3519", "title": "NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)", "url": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519", "json": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Citrix NetScaler ADC and NetScaler Gateway", "tags": [ "citrix", "netscaler", "zero-day", "rce", "webshell", "cisa-kev" ], "cveIds": [ "CVE-2023-3519" ], "affectedVersions": [ "NetScaler ADC and Gateway configured as a Gateway or AAA virtual server; exact builds: see vendor advisory" ], "fixedVersions": [ "13.1-49.13", "13.0-91.13", "FIPS/NDcPP builds: see vendor advisory" ], "startedAt": "2023-07-18", "closedAt": "2023-07-20", "updatedAt": "2023-07-20", "summary": "An unauthenticated code injection in NetScaler ADC and Gateway was exploited as a zero-day to plant webshells, including on a US critical infrastructure organisation in June 2023. Citrix patched it on July 18, 2023.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-36884", "title": "Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36884", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36884.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-36884" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-17", "closedAt": "2023-07-17", "updatedAt": "2023-07-17", "summary": "Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. Added to CISA KEV on 2023-07-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "solarview-compact-cve-2022-29303", "title": "SolarView Compact: Command Injection (CVE-2022-29303)", "url": "https://pwn.watch/i/solarview-compact-cve-2022-29303", "json": "https://pwn.watch/i/solarview-compact-cve-2022-29303.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SolarView Compact", "tags": [ "solarview", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-29303" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-13", "closedAt": "2023-07-13", "updatedAt": "2023-07-13", "summary": "SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server. Added to CISA KEV on 2023-07-13.", "xPost": null }, { "slug": "zyxel-multiple-network-attached-storage-nas-cve-2023-27992", "title": "Zyxel Multiple Network-Attached Storage (NAS) Devices: Command Injection (CVE-2023-27992)", "url": "https://pwn.watch/i/zyxel-multiple-network-attached-storage-nas-cve-2023-27992", "json": "https://pwn.watch/i/zyxel-multiple-network-attached-storage-nas-cve-2023-27992.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Zyxel Multiple Network-Attached Storage (NAS) Devices", "tags": [ "zyxel", "cisa-kev", "rce", "iot" ], "cveIds": [ "CVE-2023-27992" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-06-23", "closedAt": "2023-06-23", "updatedAt": "2023-06-23", "summary": "Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request. Added to CISA KEV on 2023-06-23.", "xPost": null }, { "slug": "vmware-aria-operations-for-networks-cve-2023-20887", "title": "VMware Aria Operations for Networks: Command Injection (CVE-2023-20887)", "url": "https://pwn.watch/i/vmware-aria-operations-for-networks-cve-2023-20887", "json": "https://pwn.watch/i/vmware-aria-operations-for-networks-cve-2023-20887.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "VMware Aria Operations for Networks", "tags": [ "vmware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-20887" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-06-22", "closedAt": "2023-06-22", "updatedAt": "2023-06-22", "summary": "VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution. Added to CISA KEV on 2023-06-22.", "xPost": null }, { "slug": "fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997", "title": "FortiOS SSL-VPN pre-auth heap overflow (XORtigate, CVE-2023-27997)", "url": "https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997", "json": "https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiOS and FortiProxy SSL-VPN", "tags": [ "fortinet", "fortios", "ssl-vpn", "rce", "volt-typhoon", "cisa-kev" ], "cveIds": [ "CVE-2023-27997" ], "affectedVersions": [ "FortiOS 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below (NVD)", "FortiProxy 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, 1.2 and 1.1 all versions (NVD)" ], "fixedVersions": [ "See vendor advisory FG-IR-23-097" ], "startedAt": "2023-06-12", "closedAt": "2023-06-13", "updatedAt": "2023-06-13", "summary": "A heap overflow in the FortiOS and FortiProxy SSL-VPN allowed pre-authentication remote code execution. Fortinet said it may have been exploited in a limited number of cases, and published it alongside its analysis of the Volt Typhoon campaign.", "xPost": null }, { "slug": "zyxel-multiple-firewalls-cve-2023-33009-33010", "title": "Zyxel Multiple Firewalls: 2 exploited vulnerabilities (CVE-2023-33009, CVE-2023-33010)", "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010", "json": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Zyxel Multiple Firewalls", "tags": [ "zyxel", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-33009", "CVE-2023-33010" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-06-05", "closedAt": "2023-06-05", "updatedAt": "2023-06-05", "summary": "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. Added to CISA KEV on 2023-06-05.", "xPost": null }, { "slug": "zyxel-multiple-firewalls-cve-2023-28771", "title": "Zyxel Multiple Firewalls: OS Command Injection (CVE-2023-28771)", "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-28771", "json": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-28771.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Zyxel Multiple Firewalls", "tags": [ "zyxel", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-28771" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-05-31", "closedAt": "2023-05-31", "updatedAt": "2023-05-31", "summary": "Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device. Added to CISA KEV on 2023-05-31.", "xPost": null }, { "slug": "barracuda-esg-zero-day-cve-2023-2868", "title": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868", "json": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Barracuda Email Security Gateway (appliance)", "tags": [ "barracuda", "email-security", "zero-day", "rce", "china", "cisa-kev" ], "cveIds": [ "CVE-2023-2868" ], "affectedVersions": [ "5.1.3.001 to 9.2.0.006 (appliance form factor only) (NVD)" ], "fixedVersions": [ "See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)" ], "startedAt": "2023-05-18", "closedAt": "2023-06-15", "updatedAt": "2023-06-15", "summary": "A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.", "xPost": null }, { "slug": "ruckus-wireless-multiple-products-cve-2023-25717", "title": "Ruckus Wireless Multiple Products: CSRF and RCE (CVE-2023-25717)", "url": "https://pwn.watch/i/ruckus-wireless-multiple-products-cve-2023-25717", "json": "https://pwn.watch/i/ruckus-wireless-multiple-products-cve-2023-25717.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ruckus Wireless Multiple Products", "tags": [ "ruckus-wireless", "cisa-kev", "rce", "iot" ], "cveIds": [ "CVE-2023-25717" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-05-12", "closedAt": "2023-05-12", "updatedAt": "2023-05-12", "summary": "Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs. Added to CISA KEV on 2023-05-12.", "xPost": null }, { "slug": "tp-link-archer-ax21-cve-2023-1389", "title": "TP-Link Archer AX21: AX-21 Command Injection (CVE-2023-1389)", "url": "https://pwn.watch/i/tp-link-archer-ax21-cve-2023-1389", "json": "https://pwn.watch/i/tp-link-archer-ax21-cve-2023-1389.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TP-Link Archer AX21", "tags": [ "tp-link", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-1389" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-05-01", "closedAt": "2023-05-01", "updatedAt": "2023-05-01", "summary": "TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution. Added to CISA KEV on 2023-05-01.", "xPost": null }, { "slug": "papercut-mf-ng-auth-bypass-cve-2023-27350", "title": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350", "json": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "PaperCut MF and PaperCut NG", "tags": [ "papercut", "auth-bypass", "rce", "cl0p", "lockbit", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-27350" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "20.1.7", "21.2.11", "22.0.9" ], "startedAt": "2023-04-21", "closedAt": "2023-05-11", "updatedAt": "2023-05-11", "summary": "An improper access control bug in PaperCut NG/MF print management let unauthenticated attackers run code as SYSTEM. Fixes had shipped in March 2023, but unpatched servers were exploited from April. Microsoft linked it to Cl0p (Lace Tempest) and LockBit, and the Bl00dy gang hit schools with it.", "xPost": null }, { "slug": "fortra-cobalt-strike-cve-2022-39197-42948", "title": "Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)", "url": "https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948", "json": "https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortra Cobalt Strike", "tags": [ "fortra", "cisa-kev", "rce", "xss" ], "cveIds": [ "CVE-2022-39197", "CVE-2022-42948" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-30", "closedAt": "2023-03-30", "updatedAt": "2023-03-30", "summary": "Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. Added to CISA KEV on 2023-03-30.", "xPost": null }, { "slug": "adobe-coldfusion-cve-2023-26360", "title": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)", "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360", "json": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Adobe ColdFusion", "tags": [ "adobe", "coldfusion", "cisa-kev", "rce", "deserialization" ], "cveIds": [ "CVE-2023-26360" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-15", "closedAt": "2023-03-15", "updatedAt": "2023-03-15", "summary": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2023-03-15.", "xPost": null }, { "slug": "teclib-glpi-cve-2022-35914", "title": "Teclib GLPI: Remote Code Execution (CVE-2022-35914)", "url": "https://pwn.watch/i/teclib-glpi-cve-2022-35914", "json": "https://pwn.watch/i/teclib-glpi-cve-2022-35914.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Teclib GLPI", "tags": [ "teclib", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-35914" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-07", "closedAt": "2023-03-07", "updatedAt": "2023-03-07", "summary": "Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed. Added to CISA KEV on 2023-03-07.", "xPost": null }, { "slug": "apache-spark-cve-2022-33891", "title": "Apache Spark: Command Injection (CVE-2022-33891)", "url": "https://pwn.watch/i/apache-spark-cve-2022-33891", "json": "https://pwn.watch/i/apache-spark-cve-2022-33891.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apache Spark", "tags": [ "java", "apache", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-33891" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-07", "closedAt": "2023-03-07", "updatedAt": "2023-03-07", "summary": "Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. Added to CISA KEV on 2023-03-07.", "xPost": null }, { "slug": "zoho-manageengine-cve-2022-28810", "title": "Zoho ManageEngine: ADSelfService Plus Remote Code Execution (CVE-2022-28810)", "url": "https://pwn.watch/i/zoho-manageengine-cve-2022-28810", "json": "https://pwn.watch/i/zoho-manageengine-cve-2022-28810.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Zoho ManageEngine", "tags": [ "zoho", "cisa-kev", "rce", "manageengine" ], "cveIds": [ "CVE-2022-28810" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-07", "closedAt": "2023-03-07", "updatedAt": "2023-03-07", "summary": "Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset. Added to CISA KEV on 2023-03-07.", "xPost": null }, { "slug": "cacti-cve-2022-46169", "title": "Cacti: Command Injection (CVE-2022-46169)", "url": "https://pwn.watch/i/cacti-cve-2022-46169", "json": "https://pwn.watch/i/cacti-cve-2022-46169.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cacti", "tags": [ "cacti", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-46169" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-16", "closedAt": "2023-02-16", "updatedAt": "2023-02-16", "summary": "Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code. Added to CISA KEV on 2023-02-16.", "xPost": null }, { "slug": "sugarcrm-multiple-products-cve-2023-22952", "title": "SugarCRM Multiple Products: Remote Code Execution (CVE-2023-22952)", "url": "https://pwn.watch/i/sugarcrm-multiple-products-cve-2023-22952", "json": "https://pwn.watch/i/sugarcrm-multiple-products-cve-2023-22952.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "SugarCRM Multiple Products", "tags": [ "sugarcrm", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-22952" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-02", "closedAt": "2023-02-02", "updatedAt": "2023-02-02", "summary": "Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates. Added to CISA KEV on 2023-02-02.", "xPost": null }, { "slug": "goanywhere-mft-cl0p-cve-2023-0669", "title": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669", "json": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Fortra GoAnywhere MFT", "tags": [ "fortra", "goanywhere", "cl0p", "zero-day", "rce", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-0669" ], "affectedVersions": [ "Before 7.1.2 (NVD)" ], "fixedVersions": [ "7.1.2" ], "startedAt": "2023-02-01", "closedAt": "2023-02-10", "updatedAt": "2023-02-10", "summary": "A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.", "xPost": null }, { "slug": "zoho-manageengine-cve-2022-47966", "title": "Zoho ManageEngine: Remote Code Execution (CVE-2022-47966)", "url": "https://pwn.watch/i/zoho-manageengine-cve-2022-47966", "json": "https://pwn.watch/i/zoho-manageengine-cve-2022-47966.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Zoho ManageEngine", "tags": [ "zoho", "ransomware", "cisa-kev", "rce", "manageengine" ], "cveIds": [ "CVE-2022-47966" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-23", "closedAt": "2023-01-23", "updatedAt": "2023-01-23", "summary": "Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario. Added to CISA KEV on 2023-01-23. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "cwp-control-web-panel-cve-2022-44877", "title": "CWP Control Web Panel: OS Command Injection (CVE-2022-44877)", "url": "https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877", "json": "https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CWP Control Web Panel", "tags": [ "hosting", "cwp", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-44877" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-17", "closedAt": "2023-01-17", "updatedAt": "2023-01-17", "summary": "CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter. Added to CISA KEV on 2023-01-17.", "xPost": null }, { "slug": "microsoft-exchange-server-cve-2022-41080", "title": "Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080", "json": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Exchange Server", "tags": [ "microsoft", "ransomware", "cisa-kev", "rce", "privilege-escalation" ], "cveIds": [ "CVE-2022-41080" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-10", "closedAt": "2023-01-10", "updatedAt": "2023-01-10", "summary": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. Added to CISA KEV on 2023-01-10. CISA lists known use in ransomware campaigns.", "xPost": null } ], "posts": [ { "authorName": "UNRAID", "handle": "UnraidOfficial", "avatarUrl": "https://pbs.twimg.com/profile_images/1597710753821167616/B82XwTJP_bigger.png", "text": "There are two Unraid releases today, both with PHP 8.4.27, which patches critical (CVSS 9.2) PHP RCEs CVE-2026-109618 & CVE-2026-109619. 7.3.4 (stable): recommended for all users. 7.4.0-rc.2: test servers only.", "date": "2026-10-22T18:05:09.000Z", "url": "https://x.com/UnraidOfficial/status/2113330833008513139", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "CFEngine", "handle": "cfengine", "avatarUrl": "https://pbs.twimg.com/profile_images/1372576585023377411/ZsifG3ft_bigger.jpg", "text": "CFEngine 3.24.6 and 3.27.3 have been released to address the recent PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619), popularly dubbed PHP2Shell. Read more:\n\nhttps://t.co/pNOF1MWTZV", "date": "2026-10-22T17:23:55.000Z", "url": "https://x.com/cfengine/status/2113320458363793491", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "Ron Masas", "handle": "RonMasas", "avatarUrl": "https://pbs.twimg.com/profile_images/2013355514650882048/ZAmTwrHJ_bigger.jpg", "text": "Liked PHP2Shell? You’re gonna love Node2Shell.\n\nWe reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!", "date": "2026-10-22T17:06:07.000Z", "url": "https://x.com/RonMasas/status/2113315979405258810", "media": [], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "CrowdSec", "handle": "Crowd_Security", "avatarUrl": "https://pbs.twimg.com/profile_images/1323565720098263041/1l9LNG8w_bigger.jpg", "text": "Can't patch every box today? The CrowdSec WAF has free, tentative virtual patches for both CVEs:\n\ncscli appsec-rules install crowdsecurity/vpatch-CVE-2026-109618\ncscli appsec-rules install crowdsecurity/vpatch-CVE-2026-109619\n\nA stopgap, not a fix: still update PHP.", "date": "2026-10-22T15:53:55.000Z", "url": "https://x.com/Crowd_Security/status/2113297809902354714", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "Zed Attack Proxy", "handle": "zaproxy", "avatarUrl": "https://pbs.twimg.com/profile_images/935515807949434880/T8RuttbQ_bigger.jpg", "text": "Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP\nPHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.\nhttps://t.co/9G4DtEhMM6\n#php2shell", "date": "2026-10-22T15:43:23.000Z", "url": "https://x.com/zaproxy/status/2113295172385861906", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "George Kurtz", "handle": "George_Kurtz", "avatarUrl": "https://pbs.twimg.com/profile_images/626477904650637312/81MQqLz9_bigger.jpg", "text": "#PHP2Shell is a big one. Here are my takeaways.\n\n1. These flaws reach back more than a decade. PHP’s maintainers identified one underlying problem in 2024, but its full impact wasn’t clear until AI-assisted research demonstrated its exploitability. What seems impractical to exploit today could easily be exploitable tomorrow as models advance.\n\n2. Much of the web runs on PHP, and a lot of it is on versions that are out of support. Some get a source backport you must build yourself. Some get nothing. Attackers aren't hunting the servers you just patched. They're hunting the ones you forgot you own. There is going to be a very long tail on remediating these vulnerabilities, and we will see many downstream breaches over the coming months.\n\n3. The patching window has completely collapsed. While we’ve exponentially found more vulnerabilities and exponentially created more patches, we’ve hit the sound barrier on operationally rolling them out. Even more concerning is the increase in exploitation occurring before or on the day of disclosure. When a flaw gets exploited, almost 90% of the time it’s hit on or before the day it’s disclosed. As defenders, you need to be looking at your watch, not a calendar!\n\n4. Coordinated disclosure in open source is really hard. It runs on trust, not contracts. There were many people in the loop, and for good reason. Lots of great people doing incredible work. However, I expect leaked disclosures will be the norm, not the exception, as we move forward in the Agent-state era.\n\nThe @a16z chart below says it all.", "date": "2026-10-22T14:51:29.000Z", "url": "https://x.com/George_Kurtz/status/2113282095342592366", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVPfySNXsAAKkIg.jpg" } ], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "Appwrite", "handle": "appwrite", "avatarUrl": "https://pbs.twimg.com/profile_images/2039591646095093760/w0wOnRMo_bigger.jpg", "text": "An update on PHP2Shell and the eMudhra certificate compromise.\n\nWe've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region.\n \nHere's what we've checked and what self-hosted users should do. 🧵", "date": "2026-10-22T12:46:16.000Z", "url": "https://x.com/appwrite/status/2113250583998316980", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "YorkDev", "handle": "YoDevp", "avatarUrl": "https://pbs.twimg.com/profile_images/2108041001340112897/pVqNB6Ej_bigger.jpg", "text": "🚨 Si usas Storybook, actualiza antes de volver a correr el dev server: publicaron una vulnerabilidad crítica (CVSS v4 9.4), CVE-2026-114125.\n\nAfecta a Storybook 8, 9, 10 y 11 alpha.\nCorregidas: 8.6.19, 9.1.21, 10.6.2 y 11.0.0-alpha.6.\n\nQué puede hacer un atacante 👇 https://t.co/fPN9ReSVRH", "date": "2026-10-22T12:43:45.000Z", "url": "https://x.com/YoDevp/status/2113249953879593338", "media": [], "incident": "storybook-dev-server-cve-2026-114125" }, { "authorName": "情報の灯台", "handle": "joho_no_todai", "avatarUrl": "https://pbs.twimg.com/profile_images/2112591874821398528/vSKACoJ9_bigger.jpg", "text": "Linuxカーネルの未修正脆弱性が、再現コードつきで公開メーリングリストに流れた。\nhttps://t.co/VzG4TT7bJz\n\n送ったのはTrend Micro傘下のZDI。\n\n宛先にはsecurity@kernel.orgが指定されていたが、Ccに公開リスト（linux-kernel等）が含まれていた。\n\nCVSS 9.0が2件。\n\nいずれもカーネル内蔵SMBサーバーksmbdの問題で、RDMAデバイスとSMB Directを使う構成が影響を受ける。\n\nLinuxカーネルのナンバー2、Greg Kroah-Hartman氏はパッチなしで公開リストに送られたことを問題視し、報告プロセスの修正を求めている。\n\nZDIの正式なアドバイザリ公開は2027年2月予定。\n技術詳細はすでに読める。", "date": "2026-10-22T12:31:20.000Z", "url": "https://x.com/joho_no_todai/status/2113246828997329182", "media": [], "incident": "linux-kernel-zdi-reports-leaked-to-lkml" }, { "authorName": "dip497", "handle": "Griflet497", "avatarUrl": "https://pbs.twimg.com/profile_images/2038899595338756096/VMloeCi4_bigger.jpg", "text": "Trend Micro's ZDI posted unpatched Linux kernel bugs to the public mailing list by mistake.\n\n- ksmbd race: RCE, CVSS 9.0\n- SMB Direct underflow: RCE, CVSS 9.0\n- skb_zerocopy: local privilege escalation\n\nNo mainline fix yet. Anyone actually running ksmbd in production? https://t.co/OAxNNSvdtG", "date": "2026-10-22T12:11:03.000Z", "url": "https://x.com/Griflet497/status/2113241724026040718", "media": [], "incident": "linux-kernel-zdi-reports-leaked-to-lkml" }, { "authorName": "Abhay अभय", "handle": "abyzz", "avatarUrl": "https://pbs.twimg.com/profile_images/2077228355368484867/d6V_ACTZ_bigger.jpg", "text": "BIND 9 DNS: replaying GSS-TSIG signed UDP messages can corrupt memory in named. Worst case: remote code execution. CVSS 8.1, no workaround. No known exploits yet.\n\nUpgrade to 9.20.30 / 9.21.27. On 9.18? Check with ISC.\nhttps://t.co/s2ChkYWdYG", "date": "2026-10-22T11:04:54.000Z", "url": "https://x.com/abyzz/status/2113225077248741652", "media": [], "incident": "isc-bind-cve-2026-94300" }, { "authorName": "ピクシブ株式会社 pixiv Inc.", "handle": "pixiv_corp", "avatarUrl": "https://pbs.twimg.com/profile_images/1046601582714867713/ExVB0Dlo_bigger.jpg", "text": "【#pixiv_inside】\nPHP 8.5.12の緊急リリースに\npixivはどう対応したか\nhttps://t.co/zYpXH9HWOy\n\nPHPにて緊急セキュリティリリースが予告され\npixivも対応しました。\n\nセキュリティアップデート公開から\npixivメンテナンス明けまで約30分の対応を\nビルド・デプロイ基盤も踏まえながら説明します✍️", "date": "2026-10-22T10:41:42.000Z", "url": "https://x.com/pixiv_corp/status/2113219235975762423", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "Werner Vogels", "handle": "Werner", "avatarUrl": "https://pbs.twimg.com/profile_images/563188960394891264/z3-Rh11q_bigger.jpeg", "text": "Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) https://t.co/TW2zDAFV6K", "date": "2026-10-22T10:36:28.000Z", "url": "https://x.com/Werner/status/2113217918742000089", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "Phoronix", "handle": "phoronix", "avatarUrl": "https://pbs.twimg.com/profile_images/937312281662279682/bqi_9AN2_bigger.jpg", "text": "Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List\n\nAs high as CVSS 9.0. Whoops.\n\nhttps://t.co/opCRSE80Vq", "date": "2026-10-22T10:07:35.000Z", "url": "https://x.com/phoronix/status/2113210651371819361", "media": [], "incident": "linux-kernel-zdi-reports-leaked-to-lkml" }, { "authorName": "Tim Notes", "handle": "timwork_notes", "avatarUrl": "https://pbs.twimg.com/profile_images/2107197400041340928/TMXhl773_bigger.jpg", "text": "localhost isn't a security boundary, it's a port any tab can knock on... storybook dev servers v8 through 11 alpha, new mcp addon included, let a malicious website change files in your project while running. critical, GHSA-f2ph-cmg5-wxc8. upgrade before the next run", "date": "2026-10-22T09:30:20.000Z", "url": "https://x.com/timwork_notes/status/2113201277933109352", "media": [], "incident": "storybook-dev-server-cve-2026-114125" }, { "authorName": "Hensen Juang", "handle": "basedjensen", "avatarUrl": "https://pbs.twimg.com/profile_images/2101681466476544000/S_hcWgNC_bigger.jpg", "text": "Bruh... DNS infa is fucked. Update your bind boys https://t.co/Gbll8AK5g2 https://t.co/BParNla6y9", "date": "2026-10-22T08:39:08.000Z", "url": "https://x.com/basedjensen/status/2113188391722627207", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVONoxnaYAAc7W-.jpg" } ], "incident": "isc-bind-cve-2026-94300" }, { "authorName": "日本レジストリサービス（JPRS）", "handle": "JPRS_official", "avatarUrl": "https://pbs.twimg.com/profile_images/1335820126499663872/xX3MDdt__bigger.jpg", "text": "（緊急）BIND 9.xの脆弱性（DNSサービスの停止・リモートコード実行）について（CVE-2026-94300） - バージョンアップを強く推奨 -\nhttps://t.co/1GT8uIFYT0", "date": "2026-10-22T06:41:12.000Z", "url": "https://x.com/JPRS_official/status/2113158713569882272", "media": [], "incident": "isc-bind-cve-2026-94300" }, { "authorName": "ɐʞsǝs", "handle": "akses_0x00", "avatarUrl": "https://pbs.twimg.com/profile_images/2067286904039702533/Q4ky91Ed_bigger.jpg", "text": "is it time to turn the internet off yet \nhttps://t.co/RLrPu79z8g", "date": "2026-10-22T04:18:08.000Z", "url": "https://x.com/akses_0x00/status/2113122707789553888", "media": [], "incident": "isc-bind-cve-2026-94300" }, { "authorName": "Kenji", "handle": "inagakikenji", "avatarUrl": "https://pbs.twimg.com/profile_images/1055736419061100545/e1Tz89g__bigger.jpg", "text": "米GitLabは10月21日（現地時間）、開発プラットフォーム「GitLab」に深刻（Critical）な脆弱性（CVE-2026-110264）が見つかったと発表し、修正版を公開した。CVSSスコアは最大の「10.0」。特定の条件下で、認証されていないユーザーがGitLabサーバ上で任意のコードを実行できる可能性がある… https://t.co/9RBiQlMg8N", "date": "2026-10-22T03:44:09.000Z", "url": "https://x.com/inagakikenji/status/2113114155519758377", "media": [], "incident": "gitlab-cve-2026-110264-regex-rce" }, { "authorName": "Matthew Prince 🌥", "handle": "eastdakota", "avatarUrl": "https://pbs.twimg.com/profile_images/2332322635/zhx7hflmmcxdaj0tk9f8_bigger.jpeg", "text": "Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.", "date": "2026-10-22T01:25:51.000Z", "url": "https://x.com/eastdakota/status/2113079352682570051", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "flowers.engg", "handle": "flowersengg", "avatarUrl": "https://pbs.twimg.com/profile_images/2067629049481195520/xxkejAlq_bigger.jpg", "text": "patched self-managed GitLab on 12 Oct? patch again.\n\nthat release fixed a CVSS 10 regex RCE at 19.4.2. yesterday's CVE-2026-110264 is another CVSS 10 in the regex compiler, and 19.4.2 is still in range.\n\nfixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13", "date": "2026-10-21T23:57:03.000Z", "url": "https://x.com/flowersengg/status/2113057007309885672", "media": [], "incident": "gitlab-cve-2026-110264-regex-rce" }, { "authorName": "Node.js", "handle": "nodejs", "avatarUrl": "https://pbs.twimg.com/profile_images/2087612853830258688/JUl27p1E_bigger.jpg", "text": "🔐 Node.js security updates are now available!\n\nNew releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.\n\nReview the details and update your systems to stay secure.\n\n🔗 https://t.co/W4kfzx5lxz\n\n#NodeJS #Security", "date": "2026-10-21T22:39:27.000Z", "url": "https://x.com/nodejs/status/2113037478286221570", "media": [], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "Iván Pérez", "handle": "IvanPerezF_", "avatarUrl": "https://pbs.twimg.com/profile_images/2100615087392215040/4ad0g2S8_bigger.jpg", "text": "Si parcheaste tu GitLab hace 9 días y te quedaste tranquilo, tengo malas noticias: vuelves a estar expuesto.\n\nGitLab ha corregido hoy el CVE-2026-110264, puntuado con un 10 sobre 10 en CVSS. Permite ejecutar código en el servidor sin iniciar sesión.\n\nAfecta a todas las versiones", "date": "2026-10-21T20:26:51.000Z", "url": "https://x.com/IvanPerezF_/status/2113004107149512943", "media": [], "incident": "gitlab-cve-2026-110264-regex-rce" }, { "authorName": "Mark Gadala-Maria", "handle": "markgadala", "avatarUrl": "https://pbs.twimg.com/profile_images/1904279027013001216/STf4Q5To_bigger.jpg", "text": "🚨 BREAKING: Node.js just dropped its OWN security bombshell.\n\n4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.\n\n→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated https://t.co/k3Vb8WK1eC", "date": "2026-10-21T17:11:48.000Z", "url": "https://x.com/markgadala/status/2112955022082207978", "media": [], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "Daily CyberSecurity", "handle": "Daily_CyberSec", "avatarUrl": "https://pbs.twimg.com/profile_images/2067063139271905280/morJwm3H_bigger.jpg", "text": "The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.\n\n#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity\nhttps://t.co/2Rmy6FPWq0", "date": "2026-10-21T15:49:04.000Z", "url": "https://x.com/Daily_CyberSec/status/2112934202412826673", "media": [], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "Matthew Prince 🌥", "handle": "eastdakota", "avatarUrl": "https://pbs.twimg.com/profile_images/2332322635/zhx7hflmmcxdaj0tk9f8_bigger.jpeg", "text": "Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.\n\ntl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.", "date": "2026-10-21T15:44:45.000Z", "url": "https://x.com/eastdakota/status/2112933115215905229", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "Cloudflare", "handle": "Cloudflare", "avatarUrl": "https://pbs.twimg.com/profile_images/2110452337764413440/6WKZL9q3_bigger.jpg", "text": "Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://t.co/OQG4x6x858", "date": "2026-10-21T14:16:59.000Z", "url": "https://x.com/Cloudflare/status/2112911026437935381", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "5h3ll", "handle": "social5h3ll", "avatarUrl": "https://pbs.twimg.com/profile_images/2098744719451037699/D5xMv_cH_bigger.jpg", "text": "Breaking 🚨 - Node.js October 2026 Security Releases – High severity fixes available now! \n\nSecurity updates are out for the supported Node.js lines: 26.x, 24.x, and 22.x.\n\nHighest severity is HIGH. Key issues include:\n• TLS non-canonical IP address handling (CVE-2026-106069 / https://t.co/npxfOdxGdg", "date": "2026-10-21T12:03:43.000Z", "url": "https://x.com/social5h3ll/status/2112877488456044609", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVJy39RW8AApYfx.jpg" } ], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "Huntress", "handle": "HuntressLabs", "avatarUrl": "https://pbs.twimg.com/profile_images/2078261992297807872/_K7T5OWR_bigger.jpg", "text": "Huntress is aware of reports circulating regarding two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in several versions of PHP (versions 5, 6, 7, and 8). 🧵", "date": "2026-10-20T23:19:46.000Z", "url": "https://x.com/HuntressLabs/status/2112685233275318290", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "Eric Taylor", "handle": "bcs_erictaylor", "avatarUrl": "https://pbs.twimg.com/profile_images/1667335479958577153/qsT-tCdx_bigger.jpg", "text": "PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)\n\nInformation about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm https://t.co/PKEZK7yYVe", "date": "2026-10-20T22:48:50.000Z", "url": "https://x.com/bcs_erictaylor/status/2112677451520164300", "media": [ { "type": "video", "url": "https://pbs.twimg.com/amplify_video_thumb/2112677297119494144/img/YEWSU7iLnuASqo71.jpg" } ], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "Florian Roth ⚡️", "handle": "cyb3rops", "avatarUrl": "https://pbs.twimg.com/profile_images/2112872660900126720/DRb9x1-S_bigger.jpg", "text": "more info \n\nby PHP\nhttps://t.co/HwLQHSn1IE\n\nCVE-2026-109618 \nCVE-2026-109619", "date": "2026-10-20T20:09:51.000Z", "url": "https://x.com/cyb3rops/status/2112637442939359386", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "H4x0r.DZ", "handle": "h4x0r_dz", "avatarUrl": "https://pbs.twimg.com/profile_images/2095309566607335424/CEEo9AX7_bigger.jpg", "text": "if this affects the default installation of PHP \nWe are fucked up \n\nCVE-2026-109618\nCVE-2026-109619 \nPHP RCEs with a CVSS score of 10.0 ☠️\n\nhttps://t.co/kr47MzTvIj https://t.co/NDq0mppHoT", "date": "2026-10-20T19:02:09.000Z", "url": "https://x.com/h4x0r_dz/status/2112620404309184734", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVGJDyOXIAA3bgf.jpg" } ], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "watchTowr", "handle": "watchtowrcyber", "avatarUrl": "https://pbs.twimg.com/profile_images/1943602243380576256/ka4fHHmU_bigger.jpg", "text": "yes, we mean CVE-2026-109618 and CVE-2026-109619", "date": "2026-10-20T18:35:38.000Z", "url": "https://x.com/watchtowrcyber/status/2112613730848809170", "media": [], "incident": "php2shell-cve-2026-109618-109619" }, { "authorName": "!Manan", "handle": "0xManan", "avatarUrl": "https://pbs.twimg.com/profile_images/2020588315171500032/jbdIlDMp_bigger.jpg", "text": "welcome.cgi → root.\n\nIvanti Connect Secure CVE-2026-104935. Zero-day. ITW. KEV.\n\nUTA0576 chain (Volexity):\n• public welcome.cgi + X-DSCGI-PATH → hit protected wu.cgi unauth\n• zip-upload race → execute the Perl before delete\n• dsinvoked + in-memory lib patch → root\n• ICT", "date": "2026-10-19T09:10:30.000Z", "url": "https://x.com/0xManan/status/2112109121621373036", "media": [], "incident": "ivanti-connect-secure-cve-2026-104935" }, { "authorName": "Dark Web Intelligence", "handle": "DailyDarkWeb", "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg", "text": "🚨 PLEX2SHELL: PUBLIC EXPLOIT CHAIN TARGETS UNPATCHED PLEX MEDIA SERVERS\n\nA researcher published a full write-up and proof-of-concept on Oct 16, 2026 for \"Plex2Shell\", a chain of four Plex Media Server flaws that can end in remote code execution on servers older than https://t.co/yH1Ph3BY8g", "date": "2026-10-18T22:22:00.000Z", "url": "https://x.com/DailyDarkWeb/status/2111945921852592206", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HU8jnq9a0AAr4W3.jpg" } ], "incident": "plex2shell-cve-2026-96652" }, { "authorName": "Jλckλι", "handle": "J4ck3LSyN", "avatarUrl": "https://pbs.twimg.com/profile_images/1392971712979881985/HIiu6LJ0_bigger.jpg", "text": "plex2shell-wz coming soon to a plex server near you... \n\n> XOR/ChaCha20 encrypted C2 config\n> Libc-linked loader\n> High-entropy PRNG video tail\n> Randomized geometry & codec names\n> In-memory execution (memfd) \n\n#CyberSecurity #infosec https://t.co/yTf6NODtWZ", "date": "2026-10-18T20:34:33.000Z", "url": "https://x.com/J4ck3LSyN/status/2111918880134414734", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HU8K0ZwacAAA-b5.png" } ], "incident": "plex2shell-cve-2026-96652" }, { "authorName": "Phantom Radar🐦‍⬛", "handle": "phantmradar", "avatarUrl": "https://pbs.twimg.com/profile_images/2104572729332482048/fG2NAZcl_bigger.jpg", "text": "Plex2Shell is being exploited. A researcher's honeypot running old Plex Media Server got hit Oct 17, a day after the write-up went public. Payloads: XMRig and a proxy tool that routes traffic through your home IP. Unauth RCE, fixed in 1.43.3 in Sept. Update. #Plex #ThreatIntel https://t.co/6HiaJCcBFq", "date": "2026-10-18T16:23:58.000Z", "url": "https://x.com/phantmradar/status/2111855821122650341", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HU7RoeKW8AApv78.png" } ], "incident": "plex2shell-cve-2026-96652" }, { "authorName": "The Hacker News", "handle": "TheHackersNews", "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg", "text": "‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS.\n\nRCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889).\n\n🔗 Read - https://t.co/ndnN46ysGv", "date": "2026-10-15T12:35:50.000Z", "url": "https://x.com/TheHackersNews/status/2110711243942330566", "media": [], "incident": "nextjs-october-2026-rce-security-release" }, { "authorName": "ThreatWire", "handle": "ThreatWire_", "avatarUrl": "https://pbs.twimg.com/profile_images/2074748840775688192/LvaBIlOK_bigger.jpg", "text": "🚨 CRITICAL: CVE-2026-96889 — Next.js Image Optimization RCE via SVG (librsvg/sharp)\n\nScore 9.5 (CVSS 4.0, Next.js advisory). Unauthenticated. Glibc Linux.\nAffects Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0.\nFixed in 15.5.28 and 16.4.1. Check npm ls sharp → 0.35.5+.\nNot in CISA", "date": "2026-10-15T05:37:11.000Z", "url": "https://x.com/ThreatWire_/status/2110605887907713139", "media": [], "incident": "nextjs-october-2026-rce-security-release" }, { "authorName": "Dark Web Intelligence", "handle": "DailyDarkWeb", "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg", "text": "🚨 IVANTI CONNECT SECURE ZERO-DAY CHAIN EXPLOITED TO STEAL CREDENTIALS (CVE-2026-104935)\n\nIvanti disclosed a new Connect Secure (ICS) VPN flaw on Oct 13, 2026 and says it is aware of limited exploitation in the wild. CISA added it to the KEV catalog the same day. Volexity https://t.co/o24PhxS5jy", "date": "2026-10-13T18:01:14.000Z", "url": "https://x.com/DailyDarkWeb/status/2110068357949247657", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HUh3_CObIAAt9bY.jpg" } ], "incident": "ivanti-connect-secure-cve-2026-104935" }, { "authorName": "Daily CyberSecurity", "handle": "Daily_CyberSec", "avatarUrl": "https://pbs.twimg.com/profile_images/2067063139271905280/morJwm3H_bigger.jpg", "text": "UTA0576 chained an Ivanti Connect Secure zero-day, CVE-2026-104935, with a root exploit to steal AD credentials. Patch now and check memory.\n\n#Ivanti #ZeroDay #CVE2026104935 #UTA0576 #Volexity #VPN #ActiveDirectory #Cybersecurity\nhttps://t.co/Yb0bCtOh60", "date": "2026-10-13T16:19:58.000Z", "url": "https://x.com/Daily_CyberSec/status/2110042871994651025", "media": [], "incident": "ivanti-connect-secure-cve-2026-104935" } ], "changes": [ { "incident": "gitlab-cve-2026-110264-regex-rce", "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne.", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/", "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce" }, { "incident": "gitlab-cve-2026-110264-regex-rce", "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "GitLab updated its advisory with two threat detections (\"Onigmo native worker crash\" and \"Org mode render error burst\") to help self-managed customers spot exploitation attempts; GitLab.com and Dedicated remain patched.", "body": null, "sourceUrl": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/", "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-22", "title": "Greg Kroah-Hartman replies to the reports: \"For some reason you sent this to public lists, and did not include a patch\" and \"Please fix your submission process...\"", "body": null, "sourceUrl": "https://lore.kernel.org/dri-devel/2026102254-protector-seventy-6454@gregkh/", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-22", "title": "Eric Dumazet says a patch for the skb_zerocopy bug, reported by someone else a week earlier, will be available soon.", "body": null, "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830CECF5D0871064C59BA0280662@BYAPR01MB3830.prod.exchangelabs.com/", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-22", "title": "Phoronix reports the leak. ksmbd maintainer Namjae Jeon says the ksmbd race is already fixed in his tree.", "body": null, "sourceUrl": "https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "nodejs-october-2026-security-releases", "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "NVD record for CVE-2026-111497 updated: the Google CNA scores it CVSS 9.2 (critical) and places the root bug in Google Brotli 1.0.3 through 1.2.0 (c/dec/decode.c), so other software bundling Brotli needs updating too.", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "url": "https://pwn.watch/i/nodejs-october-2026-security-releases" }, { "incident": "nodejs-october-2026-security-releases", "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "Researcher Ron Masas says his team reproduced CVE-2026-111497 as a pre-auth RCE on a vulnerable Node.js runtime, with app.use(express.json()) enough to expose a server through a single Brotli request.", "body": null, "sourceUrl": "https://x.com/RonMasas/status/2113315979405258810", "url": "https://pwn.watch/i/nodejs-october-2026-security-releases" }, { "incident": "isc-bind-cve-2026-94300", "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable.", "body": null, "sourceUrl": "https://security-tracker.debian.org/tracker/CVE-2026-94300", "url": "https://pwn.watch/i/isc-bind-cve-2026-94300" }, { "incident": "isc-bind-cve-2026-94300", "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Japan's registry JPRS issues an urgent alert telling BIND operators to upgrade.", "body": null, "sourceUrl": "https://x.com/JPRS_official/status/2113158713569882272", "url": "https://pwn.watch/i/isc-bind-cve-2026-94300" }, { "incident": "storybook-dev-server-cve-2026-114125", "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-10-22", "title": "Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile.", "body": null, "sourceUrl": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8", "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established.", "body": null, "sourceUrl": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky.", "body": null, "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "AWS CISO CJ Moses: PHP2Shell is now being broadly exploited in the wild, with first attempts on Oct 17 and varied payloads suggesting multiple actors. VirusTotal tracks 5.1M+ exposed PHP hosts (about 3.8M with an open port).", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "UK tech minister Baroness Lloyd tells the House of Lords that 32 UK government services are unavailable and four partly unavailable, largely as precautions while patches are applied; no confirmed compromise of central government systems. The NCSC sent 50,000 warnings.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Citrix: NetScaler is affected because its management portal runs on PHP (NSIP GUI, management-enabled SNIPs, Cluster IP GUI) on all supported versions; the fix is pending. Restrict GUI/API management access to trusted networks now. NetScaler Console and SVM are not affected.", "body": null, "sourceUrl": "https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts.", "body": null, "sourceUrl": "https://www.heise.de/en/news/php2shell-Updates-roll-out-as-websites-go-offline-and-attacks-begin-11496464.html", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes.", "body": null, "sourceUrl": "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands.", "body": null, "sourceUrl": "https://www.forum-nas.fr/threads/vuln%C3%A9rabilit%C3%A9s-dans-php-php2shell-affectant-plusieurs-produits-qnap.27227/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "OX Security: of 2.2M+ publicly exposed PHP instances it tracked, only 14,151 visible on Shodan were patched 24 hours after disclosure (99.3% still unpatched, by its measurement).", "body": null, "sourceUrl": "https://www.ox.security/blog/php2shell-24-hours-in-99-3-of-measurable-php-instances-are-still-unpatched/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation.", "body": null, "sourceUrl": "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17.", "body": null, "sourceUrl": "https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21.", "body": null, "sourceUrl": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "UK: 32 government services are offline and four partly down as a precaution (the OBR among them; DVLA, police and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet also reported disruption). The minister says there is no confirmed compromise of UK public-sector systems.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Japan: after PM Sanae Takaichi urged site owners on X to patch or suspend services, MUFG halted some online-banking transactions, Mizuho and Daiwa Securities ran emergency maintenance, and regional banks (Shizuoka, Aomori Michinoku, Yamanashi Chuo, San-in Godo) paused apps or services. Parts of the Health and Finance Ministry sites and Sapporo city's site went offline. The Japan Bankers Association says the interbank settlement network is unaffected, and no unauthorized access is confirmed.", "body": null, "sourceUrl": "https://www.japantimes.co.jp/business/2026/10/22/tech/japan-php-vulnerabilities/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "nextjs-october-2026-rce-security-release", "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions.", "body": null, "sourceUrl": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release" }, { "incident": "gitlab-cve-2026-110264-regex-rce", "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-21", "title": "ZDI sends ZDI-CAN-33549, 33774, 33367, 34068 and 34076 to security@kernel.org with public lists (linux-kernel, linux-cifs, netdev, dri-devel) in Cc.", "body": null, "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-21", "title": "Stefan Metzmacher asks the reporter to test his for-7.5/smbdirect branch, saying the SMB Direct bug is probably already fixed there.", "body": null, "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "nodejs-october-2026-security-releases", "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Node.js published the Wednesday security releases and advisory.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nodejs-october-2026-security-releases" }, { "incident": "nodejs-october-2026-security-releases", "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nodejs-october-2026-security-releases" }, { "incident": "isc-bind-cve-2026-94300", "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "ISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently.", "body": null, "sourceUrl": "https://kb.isc.org/docs/cve-2026-94300", "url": "https://pwn.watch/i/isc-bind-cve-2026-94300" }, { "incident": "storybook-dev-server-cve-2026-114125", "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-10-21", "title": "Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again.", "body": null, "sourceUrl": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8", "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation.", "body": null, "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases.", "body": null, "sourceUrl": "https://www.php.net/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Cloudflare deploys free default WAF rules (request + response signals) for all customers.", "body": null, "sourceUrl": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21/22", "title": "PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known.", "body": null, "sourceUrl": "https://www.investing.com/news/stock-market-news/factboxwebsites-taken-offline-over-php-risks-4963631", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix.", "body": null, "sourceUrl": "https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "CISA KEV warning; patch-by Oct 23 for federal agencies.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "eg-secure-solutions-siteguard-server-edition-cve-2026-106931", "incidentTitle": "EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-20", "title": "CISA added CVE-2026-106931 to the KEV catalog (due 2026-10-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-20", "title": "CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655).", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure.", "body": null, "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "php2shell-cve-2026-109618-109619", "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-17", "title": "Honeypot exploitation (XMRig + proxy) observed.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-16", "title": "Public write-up.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "isc-bind-cve-2026-94300", "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-14", "title": "ISC sends early notification of the flaw to its customers.", "body": null, "sourceUrl": "https://kb.isc.org/docs/cve-2026-94300", "url": "https://pwn.watch/i/isc-bind-cve-2026-94300" }, { "incident": "nextjs-october-2026-rce-security-release", "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features.", "body": null, "sourceUrl": "https://nextjs.org/blog/nextjs-security-update-october-14-2026", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release" }, { "incident": "nextjs-october-2026-rce-security-release", "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution.", "body": null, "sourceUrl": "https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release" }, { "incident": "ahsay-ahsaycbs-cve-2026-105134", "incidentTitle": "Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "CISA added CVE-2026-105134, CVE-2026-105133 to the KEV catalog (due 2026-10-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134" }, { "incident": "palo-alto-networks-pan-os-cve-2026-0322", "incidentTitle": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "CISA added CVE-2026-0322 to the KEV catalog (due 2026-10-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-13", "title": "Ivanti discloses and patches CVE-2026-104935; Volexity publishes.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-13/16", "title": "CISA KEV listing; federal patching deadline reported as Oct 16.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "gitlab-cve-2026-110264-regex-rce", "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-12", "title": "Prior critical regex patch released (separate CVE); some operators stopped there.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce" }, { "incident": "storybook-dev-server-cve-2026-114125", "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-10-12", "title": "Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour).", "body": null, "sourceUrl": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2", "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-03", "title": "Volexity sees UTA0576 chaining for unauth root.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-03", "title": "Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root.", "body": null, "sourceUrl": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-01", "title": "Defused reports first signs of exploitation.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "linux-kernel-zdi-reports-leaked-to-lkml", "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-09-30", "title": "Namjae Jeon commits a ksmbd fix for the negotiation race (\"ksmbd: wait for negotiation before receiving another PDU\") after a separate report.", "body": null, "sourceUrl": "https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git/commit/?id=68f410faedaf6ee74d81e574733c50ebcc1bd8ed", "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml" }, { "incident": "storybook-dev-server-cve-2026-114125", "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-30", "title": "Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server.", "body": null, "sourceUrl": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8", "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125" }, { "incident": "nextjs-october-2026-rce-security-release", "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-09-27", "title": "sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg).", "body": null, "sourceUrl": "https://github.com/advisories/GHSA-wq5f-xc86-pv6w", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release" }, { "incident": "microsoft-sharepoint-cve-2026-65660", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-25", "title": "CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660" }, { "incident": "wordpress-core-cve-2026-87902", "incidentTitle": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-25", "title": "CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902" }, { "incident": "n-able-n-central-cve-2026-86218", "incidentTitle": "N-able N-central: N-able N-central Static Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-08", "title": "CISA added CVE-2026-86218 to the KEV catalog (due 2026-09-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/n-able-n-central-cve-2026-86218" }, { "incident": "kestra-kestra-oss-cve-2026-49869", "incidentTitle": "Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-49869 to the KEV catalog (due 2026-09-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869" }, { "incident": "sangoma-switchvox-cve-2026-9586", "incidentTitle": "Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-9586 to the KEV catalog (due 2026-09-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sangoma-switchvox-cve-2026-9586" }, { "incident": "gitea-gitea-cve-2026-60004", "incidentTitle": "Gitea Gitea: Gitea Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-25", "title": "CISA added CVE-2026-60004 to the KEV catalog (due 2026-08-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gitea-gitea-cve-2026-60004" }, { "incident": "synacor-zimbra-collaboration-suite-zcs-cve-2026-73570", "incidentTitle": "Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-21", "title": "CISA added CVE-2026-73570 to the KEV catalog (due 2026-08-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570" }, { "incident": "trueconf-server-cve-2026-72530", "incidentTitle": "TrueConf Server: TrueConf Server Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-20", "title": "CISA added CVE-2026-72530, CVE-2026-72529 to the KEV catalog (due 2026-09-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/trueconf-server-cve-2026-72530" }, { "incident": "microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824", "incidentTitle": "Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-33824 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824" }, { "incident": "ray-project-ray-cve-2025-62593", "incidentTitle": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-17", "title": "CISA added CVE-2025-62593 to the KEV catalog (due 2026-08-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593" }, { "incident": "progress-loadmaster-cve-2026-8037", "incidentTitle": "Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-07", "title": "CISA added CVE-2026-8037 to the KEV catalog (due 2026-08-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/progress-loadmaster-cve-2026-8037" }, { "incident": "jetbrains-teamcity-cve-2026-63077", "incidentTitle": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-05", "title": "CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-08-04", "title": "Plex ships 1.43.3.10861.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "ibm-langflow-cve-2026-9198", "incidentTitle": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-04", "title": "CISA added CVE-2026-9198 to the KEV catalog (due 2026-08-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198" }, { "incident": "plex2shell-cve-2026-96652", "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-07-27", "title": "Zach Main reports issues to Plex.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/plex2shell-cve-2026-96652" }, { "incident": "arista-velocloud-orchestrator-cve-2026-16812", "incidentTitle": "Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-27", "title": "CISA added CVE-2026-16812 to the KEV catalog (due 2026-07-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812" }, { "incident": "wordpress-core-cve-2026-60137", "incidentTitle": "WordPress Core: WordPress Core SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-21", "title": "CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137" }, { "incident": "fortinet-fortisandbox-cve-2026-25089", "incidentTitle": "Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-16", "title": "CISA added CVE-2026-25089, CVE-2026-39808 to the KEV catalog (due 2026-07-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089" }, { "incident": "joomlack-page-builder-cve-2026-56290", "incidentTitle": "Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-07", "title": "CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290" }, { "incident": "ivanti-sentry-cve-2026-10520", "incidentTitle": "Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-11", "title": "CISA added CVE-2026-10520 to the KEV catalog (due 2026-06-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-sentry-cve-2026-10520" }, { "incident": "berriai-litellm-cve-2026-42271", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-08", "title": "CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271" }, { "incident": "drupal-core-cve-2026-9082", "incidentTitle": "Drupal Core: Drupal Core SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-22", "title": "CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/drupal-core-cve-2026-9082" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2026-6973", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-07", "title": "CISA added CVE-2026-6973 to the KEV catalog (due 2026-05-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973" }, { "incident": "apache-activemq-cve-2026-34197", "incidentTitle": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-16", "title": "CISA added CVE-2026-34197 to the KEV catalog (due 2026-04-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197" }, { "incident": "f5-big-ip-cve-2025-53521", "incidentTitle": "F5 BIG-IP: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-27", "title": "CISA added CVE-2025-53521 to the KEV catalog (due 2026-03-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/f5-big-ip-cve-2025-53521" }, { "incident": "langflow-langflow-cve-2026-33017", "incidentTitle": "Langflow Langflow: Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-25", "title": "CISA added CVE-2026-33017 to the KEV catalog (due 2026-04-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017" }, { "incident": "broadcom-vmware-aria-operations-cve-2026-22719", "incidentTitle": "Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-03", "title": "CISA added CVE-2026-22719 to the KEV catalog (due 2026-03-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719" }, { "incident": "roundcube-webmail-cve-2025-49113", "incidentTitle": "Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-20", "title": "CISA added CVE-2025-49113, CVE-2025-68461 to the KEV catalog (due 2026-03-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/roundcube-webmail-cve-2025-49113" }, { "incident": "beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731", "incidentTitle": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-13", "title": "CISA added CVE-2026-1731 to the KEV catalog (due 2026-02-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731" }, { "incident": "react-native-community-cli-cve-2025-11953", "incidentTitle": "React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-05", "title": "CISA added CVE-2025-11953 to the KEV catalog (due 2026-02-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953" }, { "incident": "sangoma-freepbx-cve-2025-64328", "incidentTitle": "Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-03", "title": "CISA added CVE-2025-64328 to the KEV catalog (due 2026-02-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-64328" }, { "incident": "solarwinds-web-help-desk-cve-2025-40551", "incidentTitle": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-03", "title": "CISA added CVE-2025-40551 to the KEV catalog (due 2026-02-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2026-1281", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-29", "title": "CISA added CVE-2026-1281 to the KEV catalog (due 2026-02-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281" }, { "incident": "smartertools-smartermail-cve-2025-52691", "incidentTitle": "SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-26", "title": "CISA added CVE-2025-52691, CVE-2026-23760 to the KEV catalog (due 2026-02-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/smartertools-smartermail-cve-2025-52691" }, { "incident": "cisco-unified-communications-manager-cve-2026-20045", "incidentTitle": "Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-21", "title": "CISA added CVE-2026-20045 to the KEV catalog (due 2026-02-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045" }, { "incident": "digiever-ds-2105-pro-cve-2023-52163", "incidentTitle": "Digiever DS-2105 Pro: DS-2105 Pro Missing Authorization Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-12-22", "title": "CISA added CVE-2023-52163 to the KEV catalog (due 2026-01-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/digiever-ds-2105-pro-cve-2023-52163" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-12", "title": "Unit 42 updates its threat brief on ongoing exploitation", "body": null, "sourceUrl": "https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "array-networks-arrayos-ag-cve-2025-66644", "incidentTitle": "Array Networks ArrayOS AG: ArrayOS AG OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-12-08", "title": "CISA added CVE-2025-66644 to the KEV catalog (due 2025-12-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/array-networks-arrayos-ag-cve-2025-66644" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-05", "title": "CISA adds CVE-2025-55182 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-03", "title": "React discloses a critical vulnerability in React Server Components and ships fixes", "body": null, "sourceUrl": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-03", "title": "AWS sees China-nexus groups exploiting it within hours", "body": "Including Earth Lamia and Jackpot Panda.", "sourceUrl": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "fortinet-fortiweb-cve-2025-58034", "incidentTitle": "Fortinet FortiWeb: FortiWeb OS Command Injection Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-11-18", "title": "CISA added CVE-2025-58034 to the KEV catalog (due 2025-11-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034" }, { "incident": "cwp-control-web-panel-cve-2025-48703", "incidentTitle": "CWP Control Web Panel: Control Web Panel OS Command Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-04", "title": "CISA added CVE-2025-48703 to the KEV catalog (due 2025-11-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703" }, { "incident": "xwiki-platform-cve-2025-24893", "incidentTitle": "XWiki Platform: Platform Eval Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-30", "title": "CISA added CVE-2025-24893 to the KEV catalog (due 2025-11-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/xwiki-platform-cve-2025-24893" }, { "incident": "dassault-systemes-delmia-apriso-cve-2025-6204", "incidentTitle": "Dassault Systèmes DELMIA Apriso: 2 exploited vulnerabilities (CVE-2025-6204, CVE-2025-6205)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-28", "title": "CISA added CVE-2025-6204 to the KEV catalog (due 2025-11-18).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-6204" }, { "incident": "dassault-systemes-delmia-apriso-cve-2025-6204", "incidentTitle": "Dassault Systèmes DELMIA Apriso: 2 exploited vulnerabilities (CVE-2025-6204, CVE-2025-6205)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-28", "title": "CISA added CVE-2025-6205 to the KEV catalog (due 2025-11-18).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-6204" }, { "incident": "microsoft-windows-cve-2025-59287", "incidentTitle": "Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-24", "title": "CISA added CVE-2025-59287 to the KEV catalog (due 2025-11-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-59287" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "skysea-client-view-cve-2016-7836", "incidentTitle": "SKYSEA Client View: Client View Improper Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-14", "title": "CISA added CVE-2016-7836 to the KEV catalog (due 2025-11-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/skysea-client-view-cve-2016-7836" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2011-3402 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2013-3918 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2021-43226 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "mozilla-multiple-products-cve-2010-3765", "incidentTitle": "Mozilla Multiple Products: Multiple Products Remote Code Execution Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2010-3765 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mozilla-multiple-products-cve-2010-3765" }, { "incident": "microsoft-internet-explorer-cve-2010-3962", "incidentTitle": "Microsoft Internet Explorer: Internet Explorer Uninitialized Memory Corruption Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2010-3962 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA adds CVE-2025-61882 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-04", "title": "Oracle publishes a Security Alert for CVE-2025-61882", "body": null, "sourceUrl": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "jenkins-cve-2017-1000353", "incidentTitle": "Jenkins: Remote Code Execution Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-02", "title": "CISA added CVE-2017-1000353 to the KEV catalog (due 2025-10-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jenkins-cve-2017-1000353" }, { "incident": "gnu-bash-cve-2014-6278", "incidentTitle": "GNU Bash: Bash OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-02", "title": "CISA added CVE-2014-6278 to the KEV catalog (due 2025-10-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gnu-bash-cve-2014-6278" }, { "incident": "smartbedded-meteobridge-cve-2025-4008", "incidentTitle": "Smartbedded Meteobridge: Meteobridge Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-02", "title": "CISA added CVE-2025-4008 to the KEV catalog (due 2025-10-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/smartbedded-meteobridge-cve-2025-4008" }, { "incident": "fortra-goanywhere-mft-cve-2025-10035", "incidentTitle": "Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-29", "title": "CISA added CVE-2025-10035 to the KEV catalog (due 2025-10-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-29", "title": "Cl0p-branded extortion emails start arriving at executives", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "cisco-ios-and-ios-xe-cve-2025-20352", "incidentTitle": "Cisco IOS and IOS XE: IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-09-29", "title": "CISA added CVE-2025-20352 to the KEV catalog (due 2025-10-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352" }, { "incident": "libraesva-email-security-gateway-cve-2025-59689", "incidentTitle": "Libraesva Email Security Gateway: Email Security Gateway Command Injection Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-09-29", "title": "CISA added CVE-2025-59689 to the KEV catalog (due 2025-10-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/libraesva-email-security-gateway-cve-2025-59689" }, { "incident": "cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333", "incidentTitle": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-25", "title": "CISA added CVE-2025-20333 to the KEV catalog (due 2025-09-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333" }, { "incident": "cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333", "incidentTitle": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-25", "title": "CISA added CVE-2025-20362 to the KEV catalog (due 2025-09-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333" }, { "incident": "dassault-systemes-delmia-apriso-cve-2025-5086", "incidentTitle": "Dassault Systèmes DELMIA Apriso: DELMIA Apriso Deserialization of Untrusted Data Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-11", "title": "CISA added CVE-2025-5086 to the KEV catalog (due 2025-10-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-5086" }, { "incident": "sitecore-multiple-products-cve-2025-53690", "incidentTitle": "Sitecore Multiple Products: Multiple Products Deserialization of Untrusted Data Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-04", "title": "CISA added CVE-2025-53690 to the KEV catalog (due 2025-09-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sitecore-multiple-products-cve-2025-53690" }, { "incident": "tp-link-multiple-routers-cve-2025-9377", "incidentTitle": "TP-Link Multiple Routers: Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-09-03", "title": "CISA added CVE-2025-9377 to the KEV catalog (due 2025-09-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tp-link-multiple-routers-cve-2025-9377" }, { "incident": "sangoma-freepbx-cve-2025-57819", "incidentTitle": "Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-29", "title": "CISA added CVE-2025-57819 to the KEV catalog (due 2025-09-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sangoma-freepbx-cve-2025-57819" }, { "incident": "citrix-netscaler-cve-2025-7775", "incidentTitle": "Citrix NetScaler: NetScaler Memory Overflow Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-26", "title": "CISA added CVE-2025-7775 to the KEV catalog (due 2025-08-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-netscaler-cve-2025-7775" }, { "incident": "citrix-session-recording-cve-2024-8068", "incidentTitle": "Citrix Session Recording: 2 exploited vulnerabilities (CVE-2024-8068, CVE-2024-8069)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-08-25", "title": "CISA added CVE-2024-8068 to the KEV catalog (due 2025-09-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-session-recording-cve-2024-8068" }, { "incident": "citrix-session-recording-cve-2024-8068", "incidentTitle": "Citrix Session Recording: 2 exploited vulnerabilities (CVE-2024-8068, CVE-2024-8069)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-08-25", "title": "CISA added CVE-2024-8069 to the KEV catalog (due 2025-09-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-session-recording-cve-2024-8068" }, { "incident": "trend-micro-apex-one-cve-2025-54948", "incidentTitle": "Trend Micro Apex One: Apex One OS Command Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-18", "title": "CISA added CVE-2025-54948 to the KEV catalog (due 2025-09-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/trend-micro-apex-one-cve-2025-54948" }, { "incident": "n-able-n-central-cve-2025-8875", "incidentTitle": "N-able N-Central: 2 exploited vulnerabilities (CVE-2025-8875, CVE-2025-8876)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-13", "title": "CISA added CVE-2025-8875 to the KEV catalog (due 2025-08-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/n-able-n-central-cve-2025-8875" }, { "incident": "n-able-n-central-cve-2025-8875", "incidentTitle": "N-able N-Central: 2 exploited vulnerabilities (CVE-2025-8875, CVE-2025-8876)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-13", "title": "CISA added CVE-2025-8876 to the KEV catalog (due 2025-08-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/n-able-n-central-cve-2025-8875" }, { "incident": "microsoft-internet-explorer-cve-2013-3893", "incidentTitle": "Microsoft Internet Explorer: Internet Explorer Resource Management Errors Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-08-12", "title": "CISA added CVE-2013-3893 to the KEV catalog (due 2025-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893" }, { "incident": "microsoft-office-cve-2007-0671", "incidentTitle": "Microsoft Office: Office Excel Remote Code Execution Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-08-12", "title": "CISA added CVE-2007-0671 to the KEV catalog (due 2025-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-cve-2007-0671" }, { "incident": "d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078", "incidentTitle": "D-Link DCS-2530L and DCS-2670L Devices: 2 exploited vulnerabilities (CVE-2020-25078, CVE-2020-25079)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-08-05", "title": "CISA added CVE-2020-25078 to the KEV catalog (due 2025-08-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078" }, { "incident": "d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078", "incidentTitle": "D-Link DCS-2530L and DCS-2670L Devices: 2 exploited vulnerabilities (CVE-2020-25078, CVE-2020-25079)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-08-05", "title": "CISA added CVE-2020-25079 to the KEV catalog (due 2025-08-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078" }, { "incident": "cisco-identity-services-engine-cve-2025-20281", "incidentTitle": "Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-28", "title": "CISA added CVE-2025-20281 to the KEV catalog (due 2025-08-18).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281" }, { "incident": "cisco-identity-services-engine-cve-2025-20281", "incidentTitle": "Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-28", "title": "CISA added CVE-2025-20337 to the KEV catalog (due 2025-08-18).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603", "body": "Storm-2603 deployed Warlock ransomware.", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-20", "title": "CISA adds CVE-2025-53770 to KEV and publishes guidance", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-19", "title": "Microsoft publishes customer guidance for CVE-2025-53770", "body": "Apply updates, enable AMSI Full Mode, deploy Defender/EDR, rotate ASP.NET machine keys and restart IIS.", "sourceUrl": "https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-18", "title": "Eye Security observes large-scale exploitation of on-prem SharePoint servers", "body": "Later clarified as the original ToolShell chain (CVE-2025-49706 + CVE-2025-49704).", "sourceUrl": "https://research.eye.security/sharepoint-under-siege/", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "phpmailer-cve-2016-10033", "incidentTitle": "PHPMailer: PHPMailer Command Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-07", "title": "CISA added CVE-2016-10033 to the KEV catalog (due 2025-07-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/phpmailer-cve-2016-10033" }, { "incident": "tp-link-multiple-routers-cve-2023-33538", "incidentTitle": "TP-Link Multiple Routers: Multiple Routers Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-06-16", "title": "CISA added CVE-2023-33538 to the KEV catalog (due 2025-07-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tp-link-multiple-routers-cve-2023-33538" }, { "incident": "wazuh-server-cve-2025-24016", "incidentTitle": "Wazuh Server: Server Deserialization of Untrusted Data Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-10", "title": "CISA added CVE-2025-24016 to the KEV catalog (due 2025-07-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/wazuh-server-cve-2025-24016" }, { "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-09", "title": "CISA adds CVE-2025-32433 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433" }, { "incident": "craft-cms-cve-2024-56145", "incidentTitle": "Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-02", "title": "CISA added CVE-2024-56145 to the KEV catalog (due 2025-06-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/craft-cms-cve-2024-56145" }, { "incident": "craft-cms-cve-2024-56145", "incidentTitle": "Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-02", "title": "CISA added CVE-2025-35939 to the KEV catalog (due 2025-06-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/craft-cms-cve-2024-56145" }, { "incident": "asus-rt-ax55-routers-cve-2023-39780", "incidentTitle": "ASUS RT-AX55 Routers: RT-AX55 Routers OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-06-02", "title": "CISA added CVE-2023-39780 to the KEV catalog (due 2025-06-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/asus-rt-ax55-routers-cve-2023-39780" }, { "incident": "connectwise-screenconnect-cve-2025-3935", "incidentTitle": "ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-06-02", "title": "CISA added CVE-2025-3935 to the KEV catalog (due 2025-06-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-19", "title": "CISA added CVE-2025-4427 to the KEV catalog (due 2025-06-09).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427" }, { "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427", "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-19", "title": "CISA added CVE-2025-4428 to the KEV catalog (due 2025-06-09).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427" }, { "incident": "draytek-vigor-routers-cve-2024-12987", "incidentTitle": "DrayTek Vigor Routers: Vigor Routers OS Command Injection Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-05-15", "title": "CISA added CVE-2024-12987 to the KEV catalog (due 2025-06-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/draytek-vigor-routers-cve-2024-12987" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-15", "title": "CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "geovision-multiple-devices-cve-2024-11120", "incidentTitle": "GeoVision Multiple Devices: 2 exploited vulnerabilities (CVE-2024-11120, CVE-2024-6047)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-07", "title": "CISA added CVE-2024-11120 to the KEV catalog (due 2025-05-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/geovision-multiple-devices-cve-2024-11120" }, { "incident": "geovision-multiple-devices-cve-2024-11120", "incidentTitle": "GeoVision Multiple Devices: 2 exploited vulnerabilities (CVE-2024-11120, CVE-2024-6047)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-07", "title": "CISA added CVE-2024-6047 to the KEV catalog (due 2025-05-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/geovision-multiple-devices-cve-2024-11120" }, { "incident": "sonicwall-sma100-appliances-cve-2023-44221", "incidentTitle": "SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-01", "title": "CISA added CVE-2023-44221 to the KEV catalog (due 2025-05-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2023-44221" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-29", "title": "CISA adds CVE-2025-31324 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "broadcom-brocade-fabric-os-cve-2025-1976", "incidentTitle": "Broadcom Brocade Fabric OS: Brocade Fabric OS Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-04-28", "title": "CISA added CVE-2025-1976 to the KEV catalog (due 2025-05-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/broadcom-brocade-fabric-os-cve-2025-1976" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-24", "title": "SAP releases an emergency fix; ReliaQuest publishes its findings", "body": null, "sourceUrl": "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/", "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-18", "title": "Discussion and PoC references on oss-security", "body": null, "sourceUrl": "https://openwall.com/lists/oss-security/2025/04/18/2", "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433" }, { "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433", "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-16", "title": "Erlang/OTP publishes advisory GHSA-37cp-fgq5-7wc2 and patched releases", "body": null, "sourceUrl": "https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2", "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433" }, { "incident": "sonicwall-sma100-appliances-cve-2021-20035", "incidentTitle": "SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-04-16", "title": "CISA added CVE-2021-20035 to the KEV catalog (due 2025-05-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2021-20035" }, { "incident": "gladinet-centrestack-cve-2025-30406", "incidentTitle": "Gladinet CentreStack: CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-08", "title": "CISA added CVE-2025-30406 to the KEV catalog (due 2025-04-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/gladinet-centrestack-cve-2025-30406" }, { "incident": "ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457", "incidentTitle": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-04", "title": "CISA added CVE-2025-22457 to the KEV catalog (due 2025-04-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457" }, { "incident": "ingressnightmare-ingress-nginx-cve-2025-1974", "incidentTitle": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-24", "title": "Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare", "body": null, "sourceUrl": "https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/", "url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974" }, { "incident": "edimax-ic-7100-ip-camera-cve-2025-1316", "incidentTitle": "Edimax IC-7100 IP Camera: IC-7100 IP Camera OS Command Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-19", "title": "CISA added CVE-2025-1316 to the KEV catalog (due 2025-04-09).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/edimax-ic-7100-ip-camera-cve-2025-1316" }, { "incident": "progress-whatsup-gold-cve-2024-4885", "incidentTitle": "Progress WhatsUp Gold: WhatsUp Gold Path Traversal Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-03", "title": "CISA added CVE-2024-4885 to the KEV catalog (due 2025-03-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-4885" }, { "incident": "cisco-small-business-rv-series-routers-cve-2023-20118", "incidentTitle": "Cisco Small Business RV Series Routers: Small Business RV Series Routers Command Injection Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-03-03", "title": "CISA added CVE-2023-20118 to the KEV catalog (due 2025-03-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118" }, { "incident": "craft-cms-cve-2025-23209", "incidentTitle": "Craft CMS: Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-20", "title": "CISA added CVE-2025-23209 to the KEV catalog (due 2025-03-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/craft-cms-cve-2025-23209" }, { "incident": "zyxel-dsl-cpe-devices-cve-2024-40890", "incidentTitle": "Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)", "severity": "high", "status": "closed", "patchStatus": "unpatched", "date": "2025-02-11", "title": "CISA added CVE-2024-40890 to the KEV catalog (due 2025-03-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890" }, { "incident": "zyxel-dsl-cpe-devices-cve-2024-40890", "incidentTitle": "Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)", "severity": "high", "status": "closed", "patchStatus": "unpatched", "date": "2025-02-11", "title": "CISA added CVE-2024-40891 to the KEV catalog (due 2025-03-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890" }, { "incident": "trimble-cityworks-cve-2025-0994", "incidentTitle": "Trimble Cityworks: Cityworks Deserialization Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-07", "title": "CISA added CVE-2025-0994 to the KEV catalog (due 2025-02-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/trimble-cityworks-cve-2025-0994" }, { "incident": "microsoft-office-outlook-cve-2024-21413", "incidentTitle": "Microsoft Office Outlook: Outlook Improper Input Validation Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-06", "title": "CISA added CVE-2024-21413 to the KEV catalog (due 2025-02-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413" }, { "incident": "sophos-xg-firewall-cve-2020-15069", "incidentTitle": "Sophos XG Firewall: XG Firewall Buffer Overflow Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-06", "title": "CISA added CVE-2020-15069 to the KEV catalog (due 2025-02-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sophos-xg-firewall-cve-2020-15069" }, { "incident": "paessler-prtg-network-monitor-cve-2018-19410", "incidentTitle": "Paessler PRTG Network Monitor: 2 exploited vulnerabilities (CVE-2018-19410, CVE-2018-9276)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-04", "title": "CISA added CVE-2018-19410 to the KEV catalog (due 2025-02-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/paessler-prtg-network-monitor-cve-2018-19410" }, { "incident": "paessler-prtg-network-monitor-cve-2018-19410", "incidentTitle": "Paessler PRTG Network Monitor: 2 exploited vulnerabilities (CVE-2018-19410, CVE-2018-9276)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-04", "title": "CISA added CVE-2018-9276 to the KEV catalog (due 2025-02-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/paessler-prtg-network-monitor-cve-2018-19410" }, { "incident": "microsoft-net-framework-cve-2024-29059", "incidentTitle": "Microsoft .NET Framework: .NET Framework Information Disclosure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-04", "title": "CISA added CVE-2024-29059 to the KEV catalog (due 2025-02-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059" }, { "incident": "aviatrix-controllers-cve-2024-50603", "incidentTitle": "Aviatrix Controllers: Controllers OS Command Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-16", "title": "CISA added CVE-2024-50603 to the KEV catalog (due 2025-02-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/aviatrix-controllers-cve-2024-50603" }, { "incident": "beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686", "incidentTitle": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS): Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-01-13", "title": "CISA added CVE-2024-12686 to the KEV catalog (due 2025-02-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/ivanti-warns-of-new-connect-secure-flaw-used-in-zero-day-attacks/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions", "body": null, "sourceUrl": "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-30", "title": "Treasury tells Congress of a 'major incident' attributed to a China state-sponsored APT", "body": null, "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "acclaim-systems-usaherds-cve-2021-44207", "incidentTitle": "Acclaim Systems USAHERDS Use of Hard-Coded Credentials", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-23", "title": "CISA added CVE-2021-44207 to the KEV catalog (federal deadline 2025-01-13)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/acclaim-systems-usaherds-cve-2021-44207" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-19", "title": "CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "nuuo-nvrmini-devices-cve-2018-14933", "incidentTitle": "NUUO NVRmini Devices OS Command Injection", "severity": "critical", "status": "closed", "patchStatus": "unpatched", "date": "2024-12-18", "title": "CISA added CVE-2018-14933 to the KEV catalog (federal deadline 2025-01-08)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/nuuo-nvrmini-devices-cve-2018-14933" }, { "incident": "reolink-rlc-410w-ip-camera-cve-2021-40407", "incidentTitle": "Reolink RLC-410W IP Camera OS Command Injection", "severity": "critical", "status": "closed", "patchStatus": "partial", "date": "2024-12-18", "title": "CISA added CVE-2021-40407 to the KEV catalog (federal deadline 2025-01-08)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407" }, { "incident": "reolink-multiple-ip-cameras-cve-2019-11001", "incidentTitle": "Reolink Multiple IP Cameras OS Command Injection", "severity": "high", "status": "closed", "patchStatus": "partial", "date": "2024-12-18", "title": "CISA added CVE-2019-11001 to the KEV catalog (federal deadline 2025-01-08)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/reolink-multiple-ip-cameras-cve-2019-11001" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-17", "title": "CVE-2024-12356 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-16", "title": "BeyondTrust advisory BT24-10; cloud instances patched", "body": null, "sourceUrl": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-08", "title": "BeyondTrust notifies the US Treasury", "body": null, "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-05", "title": "BeyondTrust identifies a compromised Remote Support SaaS infrastructure API key", "body": null, "sourceUrl": "https://www.beyondtrust.com/remote-support-saas-service-security-investigation", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CVE-2024-0012 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-0012", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CVE-2024-9474 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-0012 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-9474 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "progress-kemp-loadmaster-cve-2024-1212", "incidentTitle": "Progress Kemp LoadMaster OS Command Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-1212 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-14", "title": "CISA added CVE-2024-9463 to the KEV catalog (federal deadline 2024-12-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-14", "title": "CISA added CVE-2024-9465 to the KEV catalog (federal deadline 2024-12-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "nostromo-nhttpd-cve-2019-16278", "incidentTitle": "Nostromo nhttpd Directory Traversal", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-07", "title": "CISA added CVE-2019-16278 to the KEV catalog (federal deadline 2024-11-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/nostromo-nhttpd-cve-2019-16278" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-07", "title": "CISA added CVE-2024-5910 to the KEV catalog (federal deadline 2024-11-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957", "incidentTitle": "PTZOptics PT30X-SDI/NDI Cameras: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-04", "title": "CISA added CVE-2024-8956 to the KEV catalog (federal deadline 2024-11-25)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957" }, { "incident": "ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957", "incidentTitle": "PTZOptics PT30X-SDI/NDI Cameras: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-04", "title": "CISA added CVE-2024-8957 to the KEV catalog (federal deadline 2024-11-25)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957" }, { "incident": "microsoft-sharepoint-cve-2024-38094", "incidentTitle": "Microsoft SharePoint Deserialization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-22", "title": "CISA added CVE-2024-38094 to the KEV catalog (federal deadline 2024-11-12)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094" }, { "incident": "veeam-backup-replication-cve-2024-40711", "incidentTitle": "Veeam Backup and Replication Deserialization", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-17", "title": "CISA added CVE-2024-40711 to the KEV catalog (federal deadline 2024-11-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/veeam-backup-replication-cve-2024-40711" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-11", "title": "FortiGuard Labs details the zero-day chain used against Ivanti CSA", "body": null, "sourceUrl": "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CISA added CVE-2024-9379 to the KEV catalog (federal deadline 2024-10-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CISA added CVE-2024-9380 to the KEV catalog (federal deadline 2024-10-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CVE-2024-9463 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9463", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CVE-2024-9465 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9465", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-43572 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43572", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-43573 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43573", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CISA added CVE-2024-43572 to the KEV catalog (federal deadline 2024-10-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CISA added CVE-2024-43573 to the KEV catalog (federal deadline 2024-10-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-9379 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9379", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-9380 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9380", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "d-link-dir-820-router-cve-2023-25280", "incidentTitle": "D-Link DIR-820 Router OS Command Injection", "severity": "critical", "status": "closed", "patchStatus": "unpatched", "date": "2024-09-30", "title": "CISA added CVE-2023-25280 to the KEV catalog (federal deadline 2024-10-21)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/d-link-dir-820-router-cve-2023-25280" }, { "incident": "draytek-multiple-vigor-routers-cve-2020-15415", "incidentTitle": "DrayTek Multiple Vigor Routers OS Command Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-30", "title": "CISA added CVE-2020-15415 to the KEV catalog (federal deadline 2024-10-21)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415" }, { "incident": "sap-commerce-cloud-cve-2019-0344", "incidentTitle": "SAP Commerce Cloud Deserialization of Untrusted Data", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-30", "title": "CISA added CVE-2019-0344 to the KEV catalog (federal deadline 2024-10-21)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/sap-commerce-cloud-cve-2019-0344" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-19", "title": "CVE-2024-8963 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8963", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-19", "title": "CISA added CVE-2024-8963 to the KEV catalog (federal deadline 2024-10-10)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "microsoft-sql-server-cve-2020-0618", "incidentTitle": "Microsoft SQL Server Reporting Services Remote Code Execution", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-18", "title": "CISA added CVE-2020-0618 to the KEV catalog (federal deadline 2024-10-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618" }, { "incident": "oracle-adf-faces-cve-2022-21445", "incidentTitle": "Oracle ADF Faces Deserialization of Untrusted Data", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-18", "title": "CISA added CVE-2022-21445 to the KEV catalog (federal deadline 2024-10-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445" }, { "incident": "oracle-weblogic-server-cve-2020-14644", "incidentTitle": "Oracle WebLogic Server Remote Code Execution", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-18", "title": "CISA added CVE-2020-14644 to the KEV catalog (federal deadline 2024-10-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644" }, { "incident": "ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957", "incidentTitle": "PTZOptics PT30X-SDI/NDI Cameras: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-17", "title": "CVE-2024-8956 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8956", "url": "https://pwn.watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957" }, { "incident": "ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957", "incidentTitle": "PTZOptics PT30X-SDI/NDI Cameras: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-17", "title": "CVE-2024-8957 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8957", "url": "https://pwn.watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-13", "title": "CISA added CVE-2024-8190 to the KEV catalog (federal deadline 2024-10-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-8190 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8190", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "Ivanti publishes the advisory for CVE-2024-8190", "body": null, "sourceUrl": "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "veeam-backup-replication-cve-2024-40711", "incidentTitle": "Veeam Backup and Replication Deserialization", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-07", "title": "CVE-2024-40711 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-40711", "url": "https://pwn.watch/i/veeam-backup-replication-cve-2024-40711" }, { "incident": "apache-ofbiz-cve-2024-38856", "incidentTitle": "Apache OFBiz Incorrect Authorization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-27", "title": "CISA added CVE-2024-38856 to the KEV catalog (federal deadline 2024-09-17)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856" }, { "incident": "microsoft-exchange-server-cve-2021-31196", "incidentTitle": "Microsoft Exchange Server Information Disclosure", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-21", "title": "CISA added CVE-2021-31196 to the KEV catalog (federal deadline 2024-09-11)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-19", "title": "CISA added CVE-2024-23897 to the KEV catalog (federal deadline 2024-09-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "solarwinds-web-help-desk-cve-2024-28986", "incidentTitle": "SolarWinds Web Help Desk Deserialization of Untrusted Data", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-15", "title": "CISA added CVE-2024-28986 to the KEV catalog (federal deadline 2024-09-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986" }, { "incident": "solarwinds-web-help-desk-cve-2024-28986", "incidentTitle": "SolarWinds Web Help Desk Deserialization of Untrusted Data", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-28986 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-28986", "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38106 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38106", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38107 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38107", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38178 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38178", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38189 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38189", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38193 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38193", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38213 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38213", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38106 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38107 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38178 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38189 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38193 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38213 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "android-kernel-cve-2024-36971", "incidentTitle": "Android Kernel Remote Code Execution", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-07", "title": "CISA added CVE-2024-36971 to the KEV catalog (federal deadline 2024-08-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/android-kernel-cve-2024-36971" }, { "incident": "apache-ofbiz-cve-2024-32113", "incidentTitle": "Apache OFBiz Path Traversal", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-07", "title": "CISA added CVE-2024-32113 to the KEV catalog (federal deadline 2024-08-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113" }, { "incident": "apache-ofbiz-cve-2024-38856", "incidentTitle": "Apache OFBiz Incorrect Authorization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-05", "title": "CVE-2024-38856 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38856", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856" }, { "incident": "microsoft-windows-cve-2018-0824", "incidentTitle": "Microsoft COM for Windows Deserialization of Untrusted Data", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-05", "title": "CISA added CVE-2018-0824 to the KEV catalog (federal deadline 2024-08-26)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-0824" }, { "incident": "adobe-commerce-and-magento-open-source-cve-2024-34102", "incidentTitle": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-17", "title": "CISA added CVE-2024-34102 to the KEV catalog (federal deadline 2024-08-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102" }, { "incident": "osgeo-geoserver-cve-2024-36401", "incidentTitle": "OSGeo GeoServer GeoTools Eval Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-15", "title": "CISA added CVE-2024-36401 to the KEV catalog (federal deadline 2024-08-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/osgeo-geoserver-cve-2024-36401" }, { "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465", "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-10", "title": "CVE-2024-5910 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-5910", "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465" }, { "incident": "microsoft-sharepoint-cve-2024-38094", "incidentTitle": "Microsoft SharePoint Deserialization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38094 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38094", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094" }, { "incident": "cisco-nx-os-cve-2024-20399", "incidentTitle": "Cisco NX-OS Command Injection", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-07-02", "title": "CISA added CVE-2024-20399 to the KEV catalog (federal deadline 2024-07-23)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cisco-nx-os-cve-2024-20399" }, { "incident": "osgeo-geoserver-cve-2024-36401", "incidentTitle": "OSGeo GeoServer GeoTools Eval Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-01", "title": "CVE-2024-36401 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-36401", "url": "https://pwn.watch/i/osgeo-geoserver-cve-2024-36401" }, { "incident": "openssh-regresshion-cve-2024-6387", "incidentTitle": "regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-01", "title": "Qualys discloses regreSSHion; OpenSSH 9.8p1 released with the fix", "body": null, "sourceUrl": "https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server", "url": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387" }, { "incident": "cisco-nx-os-cve-2024-20399", "incidentTitle": "Cisco NX-OS Command Injection", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-07-01", "title": "CVE-2024-20399 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20399", "url": "https://pwn.watch/i/cisco-nx-os-cve-2024-20399" }, { "incident": "osgeo-jai-ext-cve-2022-24816", "incidentTitle": "OSGeo GeoServer JAI-EXT Code Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-26", "title": "CISA added CVE-2022-24816 to the KEV catalog (federal deadline 2024-07-17)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816" }, { "incident": "adobe-commerce-and-magento-open-source-cve-2024-34102", "incidentTitle": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-13", "title": "CVE-2024-34102 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-34102", "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-12", "title": "CISA added CVE-2024-4577 to the KEV catalog (federal deadline 2024-07-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "android-kernel-cve-2024-36971", "incidentTitle": "Android Kernel Remote Code Execution", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-10", "title": "CVE-2024-36971 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-36971", "url": "https://pwn.watch/i/android-kernel-cve-2024-36971" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-09", "title": "CVE-2024-4577 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-06", "title": "DEVCORE discloses CVE-2024-4577; fixed PHP releases available", "body": null, "sourceUrl": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "oracle-weblogic-server-cve-2017-3506", "incidentTitle": "Oracle WebLogic Server OS Command Injection", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-03", "title": "CISA added CVE-2017-3506 to the KEV catalog (federal deadline 2024-06-24)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506" }, { "incident": "xz-utils-backdoor-cve-2024-3094", "incidentTitle": "xz-utils backdoor (CVE-2024-3094)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-29", "title": "Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases", "body": null, "sourceUrl": "https://tukaani.org/xz-backdoor/", "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094" }, { "incident": "nextgen-healthcare-mirth-connect-cve-2023-43208", "incidentTitle": "NextGen Healthcare Mirth Connect Deserialization of Untrusted Data", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-20", "title": "CISA added CVE-2023-43208 to the KEV catalog (federal deadline 2024-06-10)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208" }, { "incident": "apache-ofbiz-cve-2024-32113", "incidentTitle": "Apache OFBiz Path Traversal", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-05-08", "title": "CVE-2024-32113 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-32113", "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "CVE-2024-3400 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "CISA added CVE-2024-3400 to the KEV catalog (federal deadline 2024-04-19)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "Palo Alto publishes the advisory; Volexity and Unit 42 publish exploitation details", "body": null, "sourceUrl": "https://security.paloaltonetworks.com/CVE-2024-3400", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "d-link-multiple-nas-devices-cve-2024-3272-3273", "incidentTitle": "D-Link Multiple NAS Devices: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "unpatched", "date": "2024-04-11", "title": "CISA added CVE-2024-3272 to the KEV catalog (federal deadline 2024-05-02)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/d-link-multiple-nas-devices-cve-2024-3272-3273" }, { "incident": "d-link-multiple-nas-devices-cve-2024-3272-3273", "incidentTitle": "D-Link Multiple NAS Devices: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "unpatched", "date": "2024-04-11", "title": "CISA added CVE-2024-3273 to the KEV catalog (federal deadline 2024-05-02)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/d-link-multiple-nas-devices-cve-2024-3272-3273" }, { "incident": "xz-utils-backdoor-cve-2024-3094", "incidentTitle": "xz-utils backdoor (CVE-2024-3094)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-09", "title": "XZ Git repositories available on GitHub again", "body": null, "sourceUrl": "https://tukaani.org/xz-backdoor/", "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094" }, { "incident": "d-link-multiple-nas-devices-cve-2024-3272-3273", "incidentTitle": "D-Link Multiple NAS Devices: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "unpatched", "date": "2024-04-04", "title": "CVE-2024-3272 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3272", "url": "https://pwn.watch/i/d-link-multiple-nas-devices-cve-2024-3272-3273" }, { "incident": "d-link-multiple-nas-devices-cve-2024-3272-3273", "incidentTitle": "D-Link Multiple NAS Devices: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "unpatched", "date": "2024-04-04", "title": "CVE-2024-3273 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3273", "url": "https://pwn.watch/i/d-link-multiple-nas-devices-cve-2024-3272-3273" }, { "incident": "xz-utils-backdoor-cve-2024-3094", "incidentTitle": "xz-utils backdoor (CVE-2024-3094)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-30", "title": "xz@tukaani.org stops forwarding to Jia Tan", "body": null, "sourceUrl": "https://tukaani.org/xz-backdoor/", "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094" }, { "incident": "xz-utils-backdoor-cve-2024-3094", "incidentTitle": "xz-utils backdoor (CVE-2024-3094)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-29", "title": "Andres Freund discloses the backdoor on oss-security", "body": null, "sourceUrl": "https://www.openwall.com/lists/oss-security/2024/03/29/4", "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094" }, { "incident": "xz-utils-backdoor-cve-2024-3094", "incidentTitle": "xz-utils backdoor (CVE-2024-3094)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-29", "title": "CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094", "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094" }, { "incident": "xz-utils-backdoor-cve-2024-3094", "incidentTitle": "xz-utils backdoor (CVE-2024-3094)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-29", "title": "Red Hat urgent security alert for Fedora 41 and Rawhide users", "body": null, "sourceUrl": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users", "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094" }, { "incident": "microsoft-sharepoint-server-cve-2023-24955", "incidentTitle": "Microsoft SharePoint Server Code Injection", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-26", "title": "CISA added CVE-2023-24955 to the KEV catalog (federal deadline 2024-04-16)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955" }, { "incident": "ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529", "incidentTitle": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-25", "title": "CISA added CVE-2021-44529 to the KEV catalog (federal deadline 2024-04-15)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529" }, { "incident": "nice-linear-emerge-e3-series-cve-2019-7256", "incidentTitle": "Nice Linear eMerge E3-Series OS Command Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-25", "title": "CISA added CVE-2019-7256 to the KEV catalog (federal deadline 2024-04-15)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/nice-linear-emerge-e3-series-cve-2019-7256" }, { "incident": "sunhillo-sureline-cve-2021-36380", "incidentTitle": "Sunhillo SureLine OS Command Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-03-05", "title": "CISA added CVE-2021-36380 to the KEV catalog (federal deadline 2024-03-26)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/sunhillo-sureline-cve-2021-36380" }, { "incident": "progress-kemp-loadmaster-cve-2024-1212", "incidentTitle": "Progress Kemp LoadMaster OS Command Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-21", "title": "CVE-2024-1212 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1212", "url": "https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CVE-2024-21893 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21893", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "CVE-2024-23897 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23897", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897", "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "Jenkins security advisory and fixed releases", "body": null, "sourceUrl": "https://www.jenkins.io/security/advisory/2024-01-24/", "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897" }, { "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527", "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-24", "title": "CISA added CVE-2023-22527 to the KEV catalog (federal deadline 2024-02-14)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527" }, { "incident": "vmware-vcenter-server-cve-2023-34048", "incidentTitle": "VMware vCenter Server Out-of-Bounds Write", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-22", "title": "CISA added CVE-2023-34048 to the KEV catalog (federal deadline 2024-02-12)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2023-34048" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-19", "title": "CISA issues Emergency Directive 24-01 for Ivanti Connect Secure and Policy Secure", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549", "incidentTitle": "Citrix NetScaler ADC and NetScaler Gateway: 2 actively exploited vulnerabilities", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-01-17", "title": "CVE-2023-6548 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-6548", "url": "https://pwn.watch/i/citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549" }, { "incident": "citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549", "incidentTitle": "Citrix NetScaler ADC and NetScaler Gateway: 2 actively exploited vulnerabilities", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-01-17", "title": "CVE-2023-6549 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-6549", "url": "https://pwn.watch/i/citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549" }, { "incident": "citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549", "incidentTitle": "Citrix NetScaler ADC and NetScaler Gateway: 2 actively exploited vulnerabilities", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-01-17", "title": "CISA added CVE-2023-6548 to the KEV catalog (federal deadline 2024-01-24)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549" }, { "incident": "citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549", "incidentTitle": "Citrix NetScaler ADC and NetScaler Gateway: 2 actively exploited vulnerabilities", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-01-17", "title": "CISA added CVE-2023-6549 to the KEV catalog (federal deadline 2024-02-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549" }, { "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527", "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-16", "title": "CVE-2023-22527 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-22527", "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-12", "title": "CVE-2023-46805 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-46805", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-12", "title": "CVE-2024-21887 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21887", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2023-46805 to the KEV catalog (federal deadline 2024-01-22)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2024-21887 to the KEV catalog (federal deadline 2024-01-22)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "Volexity discloses active exploitation of two Ivanti Connect Secure zero-days", "body": null, "sourceUrl": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "d-link-dsl-2750b-devices-cve-2016-20017", "incidentTitle": "D-Link DSL-2750B Devices Command Injection", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-08", "title": "CISA added CVE-2016-20017 to the KEV catalog (federal deadline 2024-01-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/d-link-dsl-2750b-devices-cve-2016-20017" }, { "incident": "spreadsheet-parseexcel-cve-2023-7101", "incidentTitle": "Spreadsheet::ParseExcel Remote Code Execution", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-01-02", "title": "CISA added CVE-2023-7101 to the KEV catalog (federal deadline 2024-01-23)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/spreadsheet-parseexcel-cve-2023-7101" }, { "incident": "fxc-ae1021-ae1021pe-cve-2023-49897", "incidentTitle": "FXC AE1021, AE1021PE: OS Command Injection (CVE-2023-49897)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-12-21", "title": "CISA added CVE-2023-49897 to the KEV catalog (due 2024-01-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fxc-ae1021-ae1021pe-cve-2023-49897" }, { "incident": "qnap-viostor-nvr-cve-2023-47565", "incidentTitle": "QNAP VioStor NVR: OS Command Injection (CVE-2023-47565)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-12-21", "title": "CISA added CVE-2023-47565 to the KEV catalog (due 2024-01-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/qnap-viostor-nvr-cve-2023-47565" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-12-13", "title": "CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A)", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793" }, { "incident": "sophos-web-appliance-cve-2023-1671", "incidentTitle": "Sophos Web Appliance: Command Injection (CVE-2023-1671)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-16", "title": "CISA added CVE-2023-1671 to the KEV catalog (due 2023-12-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sophos-web-appliance-cve-2023-1671" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-02", "title": "CISA adds CVE-2023-46604 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-01", "title": "Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware", "body": null, "sourceUrl": "https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "apache-activemq-openwire-rce-cve-2023-46604", "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-27", "title": "Apache publishes the CVE-2023-46604 announcement; fixed releases already out", "body": null, "sourceUrl": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-23", "title": "CISA adds CVE-2023-20273 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-22", "title": "First fixed release, 17.9.4a, published", "body": null, "sourceUrl": "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-20", "title": "Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-18", "title": "Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-18", "title": "Google TAG: government-backed actors exploiting the WinRAR bug", "body": null, "sourceUrl": "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-16", "title": "Cisco advisory and Talos write-up on active exploitation; CISA adds CVE-2023-20198 to KEV", "body": null, "sourceUrl": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-04", "title": "CISA adds CVE-2023-42793 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793" }, { "incident": "trend-micro-apex-one-and-worry-free-business-cve-2023-41179", "incidentTitle": "Trend Micro Apex One and Worry-Free Business Security: Remote Code Execution (CVE-2023-41179)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-21", "title": "CISA added CVE-2023-41179 to the KEV catalog (due 2023-10-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/trend-micro-apex-one-and-worry-free-business-cve-2023-41179" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-18", "title": "Earliest malicious activity found by Cisco Talos", "body": null, "sourceUrl": "https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793", "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-18", "title": "JetBrains releases TeamCity 2023.05.4 and a security patch plugin", "body": null, "sourceUrl": "https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/", "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-24", "title": "CISA adds CVE-2023-38831 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-23", "title": "Group-IB: zero-day exploited since April 2023 against traders", "body": null, "sourceUrl": "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-02", "title": "WinRAR 6.23 released with the fix", "body": null, "sourceUrl": "https://www.rarlab.com/rarnew.htm", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "citrix-netscaler-rce-cve-2023-3519", "incidentTitle": "NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-20", "title": "CISA advisory AA23-201A: webshell dropped on a critical infrastructure organisation's NetScaler in June 2023", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a", "url": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519" }, { "incident": "citrix-netscaler-rce-cve-2023-3519", "incidentTitle": "NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-19", "title": "CISA adds CVE-2023-3519 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519" }, { "incident": "citrix-netscaler-rce-cve-2023-3519", "incidentTitle": "NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-18", "title": "Citrix publishes CTX561482 and fixed builds; exploits seen on unmitigated appliances", "body": null, "sourceUrl": "https://support.citrix.com/external/article/CTX561482/citrix-adc-and-citrix-gateway-security-b.html", "url": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519" }, { "incident": "microsoft-windows-cve-2023-36884", "incidentTitle": "Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-17", "title": "CISA added CVE-2023-36884 to the KEV catalog (due 2023-08-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36884" }, { "incident": "solarview-compact-cve-2022-29303", "incidentTitle": "SolarView Compact: Command Injection (CVE-2022-29303)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-13", "title": "CISA added CVE-2022-29303 to the KEV catalog (due 2023-08-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/solarview-compact-cve-2022-29303" }, { "incident": "zyxel-multiple-network-attached-storage-nas-cve-2023-27992", "incidentTitle": "Zyxel Multiple Network-Attached Storage (NAS) Devices: Command Injection (CVE-2023-27992)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-23", "title": "CISA added CVE-2023-27992 to the KEV catalog (due 2023-07-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zyxel-multiple-network-attached-storage-nas-cve-2023-27992" }, { "incident": "vmware-aria-operations-for-networks-cve-2023-20887", "incidentTitle": "VMware Aria Operations for Networks: Command Injection (CVE-2023-20887)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-22", "title": "CISA added CVE-2023-20887 to the KEV catalog (due 2023-07-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/vmware-aria-operations-for-networks-cve-2023-20887" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-15", "title": "Mandiant attributes the campaign to China-nexus UNC4841", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997", "incidentTitle": "FortiOS SSL-VPN pre-auth heap overflow (XORtigate, CVE-2023-27997)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-13", "title": "CISA adds CVE-2023-27997 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997" }, { "incident": "fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997", "incidentTitle": "FortiOS SSL-VPN pre-auth heap overflow (XORtigate, CVE-2023-27997)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-12", "title": "Fortinet publishes FG-IR-23-097 and a blog post on exploitation and Volt Typhoon", "body": null, "sourceUrl": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign", "url": "https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-06", "title": "Barracuda tells customers to replace compromised appliances immediately, regardless of patch level", "body": null, "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "zyxel-multiple-firewalls-cve-2023-33009-33010", "incidentTitle": "Zyxel Multiple Firewalls: 2 exploited vulnerabilities (CVE-2023-33009, CVE-2023-33010)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-05", "title": "CISA added CVE-2023-33009 to the KEV catalog (due 2023-06-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010" }, { "incident": "zyxel-multiple-firewalls-cve-2023-33009-33010", "incidentTitle": "Zyxel Multiple Firewalls: 2 exploited vulnerabilities (CVE-2023-33009, CVE-2023-33010)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-05", "title": "CISA added CVE-2023-33010 to the KEV catalog (due 2023-06-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010" }, { "incident": "zyxel-multiple-firewalls-cve-2023-28771", "incidentTitle": "Zyxel Multiple Firewalls: OS Command Injection (CVE-2023-28771)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-31", "title": "CISA added CVE-2023-28771 to the KEV catalog (due 2023-06-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-28771" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-30", "title": "Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware", "body": null, "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-26", "title": "CISA adds CVE-2023-2868 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-20", "title": "Security patch pushed to all ESG appliances worldwide", "body": null, "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-18", "title": "Barracuda notices anomalous traffic from ESG appliances", "body": null, "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "ruckus-wireless-multiple-products-cve-2023-25717", "incidentTitle": "Ruckus Wireless Multiple Products: CSRF and RCE (CVE-2023-25717)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-12", "title": "CISA added CVE-2023-25717 to the KEV catalog (due 2023-06-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ruckus-wireless-multiple-products-cve-2023-25717" }, { "incident": "papercut-mf-ng-auth-bypass-cve-2023-27350", "incidentTitle": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-11", "title": "CISA and FBI advisory AA23-131A: Bl00dy Ransomware Gang targeting education via PaperCut", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350" }, { "incident": "tp-link-archer-ax21-cve-2023-1389", "incidentTitle": "TP-Link Archer AX21: AX-21 Command Injection (CVE-2023-1389)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-05-01", "title": "CISA added CVE-2023-1389 to the KEV catalog (due 2023-05-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tp-link-archer-ax21-cve-2023-1389" }, { "incident": "papercut-mf-ng-auth-bypass-cve-2023-27350", "incidentTitle": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-04-21", "title": "PaperCut warns that unpatched servers are being exploited in the wild; CISA adds CVE-2023-27350 to KEV", "body": null, "sourceUrl": "https://www.papercut.com/kb/Main/PO-1216-and-PO-1219", "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350" }, { "incident": "fortra-cobalt-strike-cve-2022-39197-42948", "incidentTitle": "Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-30", "title": "CISA added CVE-2022-39197 to the KEV catalog (due 2023-04-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948" }, { "incident": "fortra-cobalt-strike-cve-2022-39197-42948", "incidentTitle": "Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-30", "title": "CISA added CVE-2022-42948 to the KEV catalog (due 2023-04-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948" }, { "incident": "adobe-coldfusion-cve-2023-26360", "incidentTitle": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-03-15", "title": "CISA added CVE-2023-26360 to the KEV catalog (due 2023-04-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360" }, { "incident": "teclib-glpi-cve-2022-35914", "incidentTitle": "Teclib GLPI: Remote Code Execution (CVE-2022-35914)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-07", "title": "CISA added CVE-2022-35914 to the KEV catalog (due 2023-03-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/teclib-glpi-cve-2022-35914" }, { "incident": "apache-spark-cve-2022-33891", "incidentTitle": "Apache Spark: Command Injection (CVE-2022-33891)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-03-07", "title": "CISA added CVE-2022-33891 to the KEV catalog (due 2023-03-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apache-spark-cve-2022-33891" }, { "incident": "zoho-manageengine-cve-2022-28810", "incidentTitle": "Zoho ManageEngine: ADSelfService Plus Remote Code Execution (CVE-2022-28810)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-03-07", "title": "CISA added CVE-2022-28810 to the KEV catalog (due 2023-03-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zoho-manageengine-cve-2022-28810" }, { "incident": "cacti-cve-2022-46169", "incidentTitle": "Cacti: Command Injection (CVE-2022-46169)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-02-16", "title": "CISA added CVE-2022-46169 to the KEV catalog (due 2023-03-09).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cacti-cve-2022-46169" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-10", "title": "CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-it-breached-130-orgs-using-goanywhere-zero-day/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-07", "title": "Emergency patch: GoAnywhere MFT 7.1.2", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" }, { "incident": "sugarcrm-multiple-products-cve-2023-22952", "incidentTitle": "SugarCRM Multiple Products: Remote Code Execution (CVE-2023-22952)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-02", "title": "CISA added CVE-2023-22952 to the KEV catalog (due 2023-02-23).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sugarcrm-multiple-products-cve-2023-22952" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-01", "title": "Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" }, { "incident": "zoho-manageengine-cve-2022-47966", "incidentTitle": "Zoho ManageEngine: Remote Code Execution (CVE-2022-47966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-01-23", "title": "CISA added CVE-2022-47966 to the KEV catalog (due 2023-02-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/zoho-manageengine-cve-2022-47966" }, { "incident": "cwp-control-web-panel-cve-2022-44877", "incidentTitle": "CWP Control Web Panel: OS Command Injection (CVE-2022-44877)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-01-17", "title": "CISA added CVE-2022-44877 to the KEV catalog (due 2023-02-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877" }, { "incident": "microsoft-exchange-server-cve-2022-41080", "incidentTitle": "Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-01-10", "title": "CISA added CVE-2022-41080 to the KEV catalog (due 2023-01-31).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080" } ] }