https://pwn.watch/t/rce Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce gitlab-cve-2026-110264-regex-rce:2026-10-22:Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ Status: live, patched https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml linux-kernel-zdi-reports-leaked-to-lkml:2026-10-22:Greg Kroah-Hartman replies to the reports: "For some reason you sent this to public lists, and did not include a patch" and "Please fix your submission process..." Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://lore.kernel.org/dri-devel/2026102254-protector-seventy-6454@gregkh/ Status: live, unpatched https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml linux-kernel-zdi-reports-leaked-to-lkml:2026-10-22:Eric Dumazet says a patch for the skb_zerocopy bug, reported by someone else a week earlier, will be available soon. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://lore.kernel.org/lkml/BYAPR01MB3830CECF5D0871064C59BA0280662@BYAPR01MB3830.prod.exchangelabs.com/ Status: live, unpatched https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml linux-kernel-zdi-reports-leaked-to-lkml:2026-10-22:Phoronix reports the leak. ksmbd maintainer Namjae Jeon says the ksmbd race is already fixed in his tree. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities Status: live, unpatched https://pwn.watch/i/isc-bind-cve-2026-94300 isc-bind-cve-2026-94300:2026-10-22:Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable. Thu, 22 Oct 2026 00:00:00 GMT high Source: https://security-tracker.debian.org/tracker/CVE-2026-94300 Status: live, partial https://pwn.watch/i/isc-bind-cve-2026-94300 isc-bind-cve-2026-94300:2026-10-22:Japan's registry JPRS issues an urgent alert telling BIND operators to upgrade. Thu, 22 Oct 2026 00:00:00 GMT high Source: https://x.com/JPRS_official/status/2113158713569882272 Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:AWS CISO CJ Moses: PHP2Shell is now being broadly exploited in the wild, with first attempts on Oct 17 and varied payloads suggesting multiple actors. VirusTotal tracks 5.1M+ exposed PHP hosts (about 3.8M with an open port). Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:UK tech minister Baroness Lloyd tells the House of Lords that 32 UK government services are unavailable and four partly unavailable, largely as precautions while patches are applied; no confirmed compromise of central government systems. The NCSC sent 50,000 warnings. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840 Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Citrix: NetScaler is affected because its management portal runs on PHP (NSIP GUI, management-enabled SNIPs, Cluster IP GUI) on all supported versions; the fix is pending. Restrict GUI/API management access to trusted networks now. NetScaler Console and SVM are not affected. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.heise.de/en/news/php2shell-Updates-roll-out-as-websites-go-offline-and-attacks-begin-11496464.html Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.forum-nas.fr/threads/vuln%C3%A9rabilit%C3%A9s-dans-php-php2shell-affectant-plusieurs-produits-qnap.27227/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:OX Security: of 2.2M+ publicly exposed PHP instances it tracked, only 14,151 visible on Shodan were patched 24 hours after disclosure (99.3% still unpatched, by its measurement). Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.ox.security/blog/php2shell-24-hours-in-99-3-of-measurable-php-instances-are-still-unpatched/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749 Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:UK: 32 government services are offline and four partly down as a precaution (the OBR among them; DVLA, police and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet also reported disruption). The minister says there is no confirmed compromise of UK public-sector systems. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840 Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Japan: after PM Sanae Takaichi urged site owners on X to patch or suspend services, MUFG halted some online-banking transactions, Mizuho and Daiwa Securities ran emergency maintenance, and regional banks (Shizuoka, Aomori Michinoku, Yamanashi Chuo, San-in Godo) paused apps or services. Parts of the Health and Finance Ministry sites and Sapporo city's site went offline. The Japan Bankers Association says the interbank settlement network is unaffected, and no unauthorized access is confirmed. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.japantimes.co.jp/business/2026/10/22/tech/japan-php-vulnerabilities/ Status: live, partial https://pwn.watch/i/nextjs-october-2026-rce-security-release nextjs-october-2026-rce-security-release:2026-10-22:GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://github.com/advisories/GHSA-2464-fhr4-w9xw Status: live, patched https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce gitlab-cve-2026-110264-regex-rce:2026-10-21:GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml linux-kernel-zdi-reports-leaked-to-lkml:2026-10-21:ZDI sends ZDI-CAN-33549, 33774, 33367, 34068 and 34076 to security@kernel.org with public lists (linux-kernel, linux-cifs, netdev, dri-devel) in Cc. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/ Status: live, unpatched https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml linux-kernel-zdi-reports-leaked-to-lkml:2026-10-21:Stefan Metzmacher asks the reporter to test his for-7.5/smbdirect branch, saying the SMB Direct bug is probably already fixed there. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/ Status: live, unpatched https://pwn.watch/i/isc-bind-cve-2026-94300 isc-bind-cve-2026-94300:2026-10-21:ISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently. Wed, 21 Oct 2026 00:00:00 GMT high Source: https://kb.isc.org/docs/cve-2026-94300 Status: live, partial https://pwn.watch/i/nodejs-october-2026-security-releases nodejs-october-2026-security-releases:2026-10-21:Node.js published the Wednesday security releases and advisory. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, patched https://pwn.watch/i/nodejs-october-2026-security-releases nodejs-october-2026-security-releases:2026-10-21:Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, patched https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.php.net/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Cloudflare deploys free default WAF rules (request + response signals) for all customers. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21/22:PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain). Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.investing.com/news/stock-market-news/factboxwebsites-taken-offline-over-php-risks-4963631 Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 Status: live, partial https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-10-21:CISA KEV warning; patch-by Oct 23 for federal agencies. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931 eg-secure-solutions-siteguard-server-edition-cve-2026-106931:2026-10-20:CISA added CVE-2026-106931 to the KEV catalog (due 2026-10-23). Tue, 20 Oct 2026 00:00:00 GMT high Status: live, patched https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-20:Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC. Tue, 20 Oct 2026 00:00:00 GMT critical Status: live, partial https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-10-20:CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655). Tue, 20 Oct 2026 00:00:00 GMT critical Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: live, patched https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-17:Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure. Sat, 17 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Status: live, partial https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-17:AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure. Sat, 17 Oct 2026 00:00:00 GMT critical Status: live, partial https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-10-17:Honeypot exploitation (XMRig + proxy) observed. Sat, 17 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-10-16:Public write-up. Fri, 16 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/isc-bind-cve-2026-94300 isc-bind-cve-2026-94300:2026-10-14:ISC sends early notification of the flaw to its customers. Wed, 14 Oct 2026 00:00:00 GMT high Source: https://kb.isc.org/docs/cve-2026-94300 Status: live, partial https://pwn.watch/i/nextjs-october-2026-rce-security-release nextjs-october-2026-rce-security-release:2026-10-14:Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features. Wed, 14 Oct 2026 00:00:00 GMT critical Source: https://nextjs.org/blog/nextjs-security-update-october-14-2026 Status: live, patched https://pwn.watch/i/nextjs-october-2026-rce-security-release nextjs-october-2026-rce-security-release:2026-10-14:Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution. Wed, 14 Oct 2026 00:00:00 GMT critical Source: https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/ Status: live, patched https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134 ahsay-ahsaycbs-cve-2026-105134:2026-10-14:CISA added CVE-2026-105134, CVE-2026-105133 to the KEV catalog (due 2026-10-17). Wed, 14 Oct 2026 00:00:00 GMT high Status: live, patched https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322 palo-alto-networks-pan-os-cve-2026-0322:2026-10-14:CISA added CVE-2026-0322 to the KEV catalog (due 2026-10-17). Wed, 14 Oct 2026 00:00:00 GMT high Status: live, patched https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-13:Ivanti discloses and patches CVE-2026-104935; Volexity publishes. Tue, 13 Oct 2026 00:00:00 GMT high Status: live, partial https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-13/16:CISA KEV listing; federal patching deadline reported as Oct 16. Tue, 13 Oct 2026 00:00:00 GMT high Status: live, partial https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce gitlab-cve-2026-110264-regex-rce:2026-10-12:Prior critical regex patch released (separate CVE); some operators stopped there. Mon, 12 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-03:Volexity sees UTA0576 chaining for unauth root. Sat, 03 Oct 2026 00:00:00 GMT high Status: live, partial https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-03:Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root. Sat, 03 Oct 2026 00:00:00 GMT high Source: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ Status: live, partial https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-01:Defused reports first signs of exploitation. Thu, 01 Oct 2026 00:00:00 GMT high Status: live, partial https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml linux-kernel-zdi-reports-leaked-to-lkml:2026-09-30:Namjae Jeon commits a ksmbd fix for the negotiation race ("ksmbd: wait for negotiation before receiving another PDU") after a separate report. Wed, 30 Sep 2026 00:00:00 GMT critical Source: https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git/commit/?id=68f410faedaf6ee74d81e574733c50ebcc1bd8ed Status: live, unpatched https://pwn.watch/i/nextjs-october-2026-rce-security-release nextjs-october-2026-rce-security-release:2026-09-27:sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg). Sun, 27 Sep 2026 00:00:00 GMT critical Source: https://github.com/advisories/GHSA-wq5f-xc86-pv6w Status: live, patched https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660 microsoft-sharepoint-cve-2026-65660:2026-09-25:CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28). Fri, 25 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/wordpress-core-cve-2026-87902 wordpress-core-cve-2026-87902:2026-09-25:CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). Fri, 25 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/n-able-n-central-cve-2026-86218 n-able-n-central-cve-2026-86218:2026-09-08:CISA added CVE-2026-86218 to the KEV catalog (due 2026-09-11). Tue, 08 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869 kestra-kestra-oss-cve-2026-49869:2026-09-02:CISA added CVE-2026-49869 to the KEV catalog (due 2026-09-05). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/sangoma-switchvox-cve-2026-9586 sangoma-switchvox-cve-2026-9586:2026-09-02:CISA added CVE-2026-9586 to the KEV catalog (due 2026-09-05). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/gitea-gitea-cve-2026-60004 gitea-gitea-cve-2026-60004:2026-08-25:CISA added CVE-2026-60004 to the KEV catalog (due 2026-08-28). Tue, 25 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570 synacor-zimbra-collaboration-suite-zcs-cve-2026-73570:2026-08-21:CISA added CVE-2026-73570 to the KEV catalog (due 2026-08-24). Fri, 21 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/trueconf-server-cve-2026-72530 trueconf-server-cve-2026-72530:2026-08-20:CISA added CVE-2026-72530, CVE-2026-72529 to the KEV catalog (due 2026-09-03). Thu, 20 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824 microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824:2026-08-18:CISA added CVE-2026-33824 to the KEV catalog (due 2026-08-21). Tue, 18 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/ray-project-ray-cve-2025-62593 ray-project-ray-cve-2025-62593:2026-08-17:CISA added CVE-2025-62593 to the KEV catalog (due 2026-08-20). Mon, 17 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/progress-loadmaster-cve-2026-8037 progress-loadmaster-cve-2026-8037:2026-08-07:CISA added CVE-2026-8037 to the KEV catalog (due 2026-08-10). Fri, 07 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077 jetbrains-teamcity-cve-2026-63077:2026-08-05:CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08). Wed, 05 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-08-04:Plex ships 1.43.3.10861. Tue, 04 Aug 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/ibm-langflow-cve-2026-9198 ibm-langflow-cve-2026-9198:2026-08-04:CISA added CVE-2026-9198 to the KEV catalog (due 2026-08-07). Tue, 04 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-07-27:Zach Main reports issues to Plex. Mon, 27 Jul 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812 arista-velocloud-orchestrator-cve-2026-16812:2026-07-27:CISA added CVE-2026-16812 to the KEV catalog (due 2026-07-30). Mon, 27 Jul 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/wordpress-core-cve-2026-60137 wordpress-core-cve-2026-60137:2026-07-21:CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04). Tue, 21 Jul 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089 fortinet-fortisandbox-cve-2026-25089:2026-07-16:CISA added CVE-2026-25089, CVE-2026-39808 to the KEV catalog (due 2026-07-19). Thu, 16 Jul 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/joomlack-page-builder-cve-2026-56290 joomlack-page-builder-cve-2026-56290:2026-07-07:CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10). Tue, 07 Jul 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/ivanti-sentry-cve-2026-10520 ivanti-sentry-cve-2026-10520:2026-06-11:CISA added CVE-2026-10520 to the KEV catalog (due 2026-06-14). Thu, 11 Jun 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/berriai-litellm-cve-2026-42271 berriai-litellm-cve-2026-42271:2026-06-08:CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22). Mon, 08 Jun 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/drupal-core-cve-2026-9082 drupal-core-cve-2026-9082:2026-05-22:CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27). Fri, 22 May 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973 ivanti-endpoint-manager-mobile-epmm-cve-2026-6973:2026-05-07:CISA added CVE-2026-6973 to the KEV catalog (due 2026-05-10). Thu, 07 May 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/apache-activemq-cve-2026-34197 apache-activemq-cve-2026-34197:2026-04-16:CISA added CVE-2026-34197 to the KEV catalog (due 2026-04-30). Thu, 16 Apr 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/f5-big-ip-cve-2025-53521 f5-big-ip-cve-2025-53521:2026-03-27:CISA added CVE-2025-53521 to the KEV catalog (due 2026-03-30). Fri, 27 Mar 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/langflow-langflow-cve-2026-33017 langflow-langflow-cve-2026-33017:2026-03-25:CISA added CVE-2026-33017 to the KEV catalog (due 2026-04-08). Wed, 25 Mar 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719 broadcom-vmware-aria-operations-cve-2026-22719:2026-03-03:CISA added CVE-2026-22719 to the KEV catalog (due 2026-03-24). Tue, 03 Mar 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/roundcube-webmail-cve-2025-49113 roundcube-webmail-cve-2025-49113:2026-02-20:CISA added CVE-2025-49113, CVE-2025-68461 to the KEV catalog (due 2026-03-13). Fri, 20 Feb 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731 beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731:2026-02-13:CISA added CVE-2026-1731 to the KEV catalog (due 2026-02-16). Fri, 13 Feb 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/react-native-community-cli-cve-2025-11953 react-native-community-cli-cve-2025-11953:2026-02-05:CISA added CVE-2025-11953 to the KEV catalog (due 2026-02-26). Thu, 05 Feb 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/sangoma-freepbx-cve-2025-64328 sangoma-freepbx-cve-2025-64328:2026-02-03:CISA added CVE-2025-64328 to the KEV catalog (due 2026-02-24). Tue, 03 Feb 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551 solarwinds-web-help-desk-cve-2025-40551:2026-02-03:CISA added CVE-2025-40551 to the KEV catalog (due 2026-02-06). Tue, 03 Feb 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281 ivanti-endpoint-manager-mobile-epmm-cve-2026-1281:2026-01-29:CISA added CVE-2026-1281 to the KEV catalog (due 2026-02-01). Thu, 29 Jan 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/smartertools-smartermail-cve-2025-52691 smartertools-smartermail-cve-2025-52691:2026-01-26:CISA added CVE-2025-52691, CVE-2026-23760 to the KEV catalog (due 2026-02-16). Mon, 26 Jan 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045 cisco-unified-communications-manager-cve-2026-20045:2026-01-21:CISA added CVE-2026-20045 to the KEV catalog (due 2026-02-11). Wed, 21 Jan 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/digiever-ds-2105-pro-cve-2023-52163 digiever-ds-2105-pro-cve-2023-52163:2025-12-22:CISA added CVE-2023-52163 to the KEV catalog (due 2026-01-12). Mon, 22 Dec 2025 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 react2shell-react-server-components-cve-2025-55182:2025-12-12:Unit 42 updates its threat brief on ongoing exploitation Fri, 12 Dec 2025 00:00:00 GMT critical Source: https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/ Status: closed, patched https://pwn.watch/i/array-networks-arrayos-ag-cve-2025-66644 array-networks-arrayos-ag-cve-2025-66644:2025-12-08:CISA added CVE-2025-66644 to the KEV catalog (due 2025-12-29). Mon, 08 Dec 2025 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 react2shell-react-server-components-cve-2025-55182:2025-12-05:CISA adds CVE-2025-55182 to KEV Fri, 05 Dec 2025 00:00:00 GMT critical Status: closed, patched https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 react2shell-react-server-components-cve-2025-55182:2025-12-03:React discloses a critical vulnerability in React Server Components and ships fixes Wed, 03 Dec 2025 00:00:00 GMT critical Source: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components Status: closed, patched https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 react2shell-react-server-components-cve-2025-55182:2025-12-03:AWS sees China-nexus groups exploiting it within hours Wed, 03 Dec 2025 00:00:00 GMT critical Including Earth Lamia and Jackpot Panda. Source: https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/ Status: closed, patched https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034 fortinet-fortiweb-cve-2025-58034:2025-11-18:CISA added CVE-2025-58034 to the KEV catalog (due 2025-11-25). Tue, 18 Nov 2025 00:00:00 GMT medium Status: closed, patched https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703 cwp-control-web-panel-cve-2025-48703:2025-11-04:CISA added CVE-2025-48703 to the KEV catalog (due 2025-11-25). Tue, 04 Nov 2025 00:00:00 GMT critical Status: closed, patched