{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:32:17.031Z",
  "tag": {
    "id": "sql-injection",
    "label": "SQL injection",
    "isStack": false,
    "url": "https://pwn.watch/t/sql-injection",
    "feed": "https://pwn.watch/t/sql-injection/feed.xml"
  },
  "counts": {
    "incidents": 18,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 17
  },
  "incidents": [
    {
      "slug": "arista-velocloud-orchestrator-cve-2026-114625",
      "title": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625",
      "json": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Arista VeloCloud Orchestrator (VCO) On-Prem",
      "tags": [
        "arista",
        "velocloud",
        "sd-wan",
        "sql-injection",
        "zero-day",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2026-114625"
      ],
      "affectedVersions": [
        "VCO 5.2.x before 5.2.3.18",
        "VCO 6.1.x before 6.1.3.10",
        "VCO 6.4.x before 6.4.2.12"
      ],
      "fixedVersions": [
        "5.2.3.18",
        "6.1.3.10",
        "6.4.2.12"
      ],
      "startedAt": "2026-10-22",
      "closedAt": null,
      "updatedAt": "2026-10-22T19:31:08+02:00",
      "summary": "Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.",
      "xPost": null
    },
    {
      "slug": "cisco-secure-email-gateway-cve-2026-76461",
      "title": "Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461",
      "json": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Secure Email Gateway",
      "tags": [
        "cisco",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-76461"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-14",
      "closedAt": "2026-09-14",
      "updatedAt": "2026-09-14",
      "summary": "Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Added to CISA KEV on 2026-09-14.",
      "xPost": null
    },
    {
      "slug": "sangoma-switchvox-cve-2026-9586",
      "title": "Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/sangoma-switchvox-cve-2026-9586",
      "json": "https://pwn.watch/i/sangoma-switchvox-cve-2026-9586.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Sangoma Switchvox",
      "tags": [
        "sangoma",
        "cisa-kev",
        "rce",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-9586"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-02",
      "closedAt": "2026-09-02",
      "updatedAt": "2026-09-02",
      "summary": "Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Added to CISA KEV on 2026-09-02.",
      "xPost": null
    },
    {
      "slug": "metabase-metabase-cve-2026-72898",
      "title": "Metabase Metabase: Metabase SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/metabase-metabase-cve-2026-72898",
      "json": "https://pwn.watch/i/metabase-metabase-cve-2026-72898.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Metabase Metabase",
      "tags": [
        "metabase",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-72898"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-11",
      "closedAt": "2026-08-11",
      "updatedAt": "2026-08-11",
      "summary": "Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Added to CISA KEV on 2026-08-11.",
      "xPost": null
    },
    {
      "slug": "wordpress-core-cve-2026-60137",
      "title": "WordPress Core: WordPress Core SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137",
      "json": "https://pwn.watch/i/wordpress-core-cve-2026-60137.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WordPress Core",
      "tags": [
        "php",
        "wordpress",
        "cisa-kev",
        "rce",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-60137",
        "CVE-2026-63030"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-21",
      "closedAt": "2026-07-21",
      "updatedAt": "2026-07-21",
      "summary": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "drupal-core-cve-2026-9082",
      "title": "Drupal Core: Drupal Core SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/drupal-core-cve-2026-9082",
      "json": "https://pwn.watch/i/drupal-core-cve-2026-9082.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Drupal Core",
      "tags": [
        "php",
        "drupal",
        "cisa-kev",
        "rce",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-9082"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-22",
      "closedAt": "2026-05-22",
      "updatedAt": "2026-05-22",
      "summary": "Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. Added to CISA KEV on 2026-05-22.",
      "xPost": null
    },
    {
      "slug": "berriai-litellm-cve-2026-42208",
      "title": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208",
      "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42208.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "BerriAI LiteLLM",
      "tags": [
        "python",
        "ai",
        "litellm",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-42208"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-08",
      "closedAt": "2026-05-08",
      "updatedAt": "2026-05-08",
      "summary": "BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08.",
      "xPost": null
    },
    {
      "slug": "fortinet-forticlient-ems-cve-2026-21643",
      "title": "Fortinet FortiClient EMS: Fortinet FortiClient EMS SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643",
      "json": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortinet FortiClient EMS",
      "tags": [
        "fortinet",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-21643"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-13",
      "closedAt": "2026-04-13",
      "updatedAt": "2026-04-13",
      "summary": "Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Added to CISA KEV on 2026-04-13.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortiweb-cve-2025-25257",
      "title": "Fortinet FortiWeb: FortiWeb SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-25257",
      "json": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-25257.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiWeb",
      "tags": [
        "fortinet",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2025-25257"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-07-18",
      "closedAt": "2025-07-18",
      "updatedAt": "2025-07-18",
      "summary": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. Added to CISA KEV on 2025-07-18.",
      "xPost": null
    },
    {
      "slug": "advantive-veracore-cve-2024-57968",
      "title": "Advantive VeraCore: 2 exploited vulnerabilities (CVE-2024-57968, CVE-2025-25181)",
      "url": "https://pwn.watch/i/advantive-veracore-cve-2024-57968",
      "json": "https://pwn.watch/i/advantive-veracore-cve-2024-57968.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Advantive VeraCore",
      "tags": [
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2024-57968",
        "CVE-2025-25181"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-10",
      "closedAt": "2025-03-10",
      "updatedAt": "2025-03-10",
      "summary": "CVE-2024-57968: Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx. CVE-2025-25181: Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter. Added to CISA KEV on 2025-03-10.",
      "xPost": null
    },
    {
      "slug": "sophos-cyberoamos-cve-2020-29574",
      "title": "Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574",
      "json": "https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "unpatched",
      "product": "Sophos CyberoamOS",
      "tags": [
        "sophos",
        "ransomware",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2020-29574"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "None: CISA says the product is end-of-life; discontinue use"
      ],
      "startedAt": "2025-02-06",
      "closedAt": "2025-02-06",
      "updatedAt": "2025-02-06",
      "summary": "CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely. Added to CISA KEV on 2025-02-06.",
      "xPost": null
    },
    {
      "slug": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "title": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "json": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Cloud Services Appliance / Cloud Services Appliance (CSA)",
      "tags": [
        "ivanti",
        "ivanti-csa",
        "zero-day",
        "sql-injection",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-8190",
        "CVE-2024-8963",
        "CVE-2024-9379",
        "CVE-2024-9380"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-09-10",
      "closedAt": "2024-10-09",
      "updatedAt": "2024-10-11",
      "summary": "Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.",
      "xPost": null
    },
    {
      "slug": "progress-whatsup-gold-cve-2024-6670",
      "title": "Progress WhatsUp Gold SQL Injection",
      "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670",
      "json": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Progress WhatsUp Gold",
      "tags": [
        "progress",
        "whatsup-gold",
        "cisa-kev",
        "ransomware",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2024-6670"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-08-29",
      "closedAt": "2024-09-16",
      "updatedAt": "2024-09-16",
      "summary": "Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. Added to the CISA KEV catalog on 2024-09-16. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "palo-alto-networks-expedition-cve-2024-5910-9463-9465",
      "title": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities",
      "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465",
      "json": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Palo Alto Networks Expedition",
      "tags": [
        "palo-alto",
        "expedition",
        "cisa-kev",
        "pan-os",
        "rce",
        "sql-injection",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2024-5910",
        "CVE-2024-9463",
        "CVE-2024-9465"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-07-10",
      "closedAt": "2024-11-14",
      "updatedAt": "2024-11-14",
      "summary": "CVE-2024-5910: Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. CVE-2024-9463: Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. CVE-2024-9465: Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. Added to the CISA KEV catalog on 2024-11-07, 2024-11-14.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-epm-cve-2024-29824",
      "title": "Ivanti Endpoint Manager (EPM) SQL Injection",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager (EPM)",
      "tags": [
        "ivanti",
        "ivanti-epm",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2024-29824"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-05-31",
      "closedAt": "2024-10-02",
      "updatedAt": "2024-10-02",
      "summary": "Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code. Added to the CISA KEV catalog on 2024-10-02.",
      "xPost": null
    },
    {
      "slug": "fortinet-forticlient-ems-cve-2023-48788",
      "title": "Fortinet FortiClient EMS SQL Injection",
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788",
      "json": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiClient EMS",
      "tags": [
        "fortinet",
        "forticlient",
        "cisa-kev",
        "ransomware",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2023-48788"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-03-12",
      "closedAt": "2024-03-25",
      "updatedAt": "2024-03-25",
      "summary": "Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2023-48788 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "f5-big-ip-configuration-utility-cve-2023-46747-46748",
      "title": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)",
      "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748",
      "json": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "F5 BIG-IP Configuration Utility",
      "tags": [
        "f5",
        "ransomware",
        "cisa-kev",
        "sql-injection",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2023-46747",
        "CVE-2023-46748"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-31",
      "closedAt": "2023-10-31",
      "updatedAt": "2023-10-31",
      "summary": "F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748. F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747. Added to CISA KEV on 2023-10-31. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "moveit-transfer-cl0p-mass-exploitation-2023",
      "title": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023",
      "json": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Progress MOVEit Transfer",
      "tags": [
        "progress",
        "moveit",
        "cl0p",
        "zero-day",
        "sql-injection",
        "data-breach",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-34362",
        "CVE-2023-35036",
        "CVE-2023-35708"
      ],
      "affectedVersions": [
        "CVE-2023-34362: before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1) (NVD)",
        "CVE-2023-35036: before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), 2023.0.2 (15.0.2) (NVD)",
        "CVE-2023-35708: before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3) (NVD)"
      ],
      "fixedVersions": [
        "2021.0.8 (13.0.8)",
        "2021.1.6 (13.1.6)",
        "2022.0.6 (14.0.6)",
        "2022.1.7 (14.1.7)",
        "2023.0.3 (15.0.3)",
        "Older branches: see vendor advisory"
      ],
      "startedAt": "2023-05-27",
      "closedAt": "2023-06-16",
      "updatedAt": "2023-06-16",
      "summary": "Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Dark Web Informer",
      "handle": "DarkWebInformer",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2109088203504287744/BJcETLaO_bigger.jpg",
      "text": "🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited\n\nArista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.\n⠀\nThe SQL injection flaw allows any authenticated user, including someone https://t.co/YmvPfvAwhb",
      "date": "2026-10-22T15:33:25.000Z",
      "url": "https://x.com/DarkWebInformer/status/2113292650828726321",
      "media": [],
      "incident": "arista-velocloud-orchestrator-cve-2026-114625"
    }
  ],
  "changes": [
    {
      "incident": "arista-velocloud-orchestrator-cve-2026-114625",
      "incidentTitle": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected.",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625"
    },
    {
      "incident": "cisco-secure-email-gateway-cve-2026-76461",
      "incidentTitle": "Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-14",
      "title": "CISA added CVE-2026-76461 to the KEV catalog (due 2026-09-17).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461"
    },
    {
      "incident": "sangoma-switchvox-cve-2026-9586",
      "incidentTitle": "Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-02",
      "title": "CISA added CVE-2026-9586 to the KEV catalog (due 2026-09-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sangoma-switchvox-cve-2026-9586"
    },
    {
      "incident": "metabase-metabase-cve-2026-72898",
      "incidentTitle": "Metabase Metabase: Metabase SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-11",
      "title": "CISA added CVE-2026-72898 to the KEV catalog (due 2026-08-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/metabase-metabase-cve-2026-72898"
    },
    {
      "incident": "wordpress-core-cve-2026-60137",
      "incidentTitle": "WordPress Core: WordPress Core SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-21",
      "title": "CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137"
    },
    {
      "incident": "drupal-core-cve-2026-9082",
      "incidentTitle": "Drupal Core: Drupal Core SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-22",
      "title": "CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/drupal-core-cve-2026-9082"
    },
    {
      "incident": "berriai-litellm-cve-2026-42208",
      "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-08",
      "title": "CISA added CVE-2026-42208 to the KEV catalog (due 2026-05-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208"
    },
    {
      "incident": "fortinet-forticlient-ems-cve-2026-21643",
      "incidentTitle": "Fortinet FortiClient EMS: Fortinet FortiClient EMS SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-13",
      "title": "CISA added CVE-2026-21643 to the KEV catalog (due 2026-04-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643"
    },
    {
      "incident": "fortinet-fortiweb-cve-2025-25257",
      "incidentTitle": "Fortinet FortiWeb: FortiWeb SQL Injection Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-18",
      "title": "CISA added CVE-2025-25257 to the KEV catalog (due 2025-08-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-25257"
    },
    {
      "incident": "advantive-veracore-cve-2024-57968",
      "incidentTitle": "Advantive VeraCore: 2 exploited vulnerabilities (CVE-2024-57968, CVE-2025-25181)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-10",
      "title": "CISA added CVE-2024-57968 to the KEV catalog (due 2025-03-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/advantive-veracore-cve-2024-57968"
    },
    {
      "incident": "advantive-veracore-cve-2024-57968",
      "incidentTitle": "Advantive VeraCore: 2 exploited vulnerabilities (CVE-2024-57968, CVE-2025-25181)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-10",
      "title": "CISA added CVE-2025-25181 to the KEV catalog (due 2025-03-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/advantive-veracore-cve-2024-57968"
    },
    {
      "incident": "sophos-cyberoamos-cve-2020-29574",
      "incidentTitle": "Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "unpatched",
      "date": "2025-02-06",
      "title": "CISA added CVE-2020-29574 to the KEV catalog (due 2025-02-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574"
    },
    {
      "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465",
      "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-14",
      "title": "CISA added CVE-2024-9463 to the KEV catalog (federal deadline 2024-12-05)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465"
    },
    {
      "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465",
      "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-14",
      "title": "CISA added CVE-2024-9465 to the KEV catalog (federal deadline 2024-12-05)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465"
    },
    {
      "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465",
      "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-07",
      "title": "CISA added CVE-2024-5910 to the KEV catalog (federal deadline 2024-11-28)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-11",
      "title": "FortiGuard Labs details the zero-day chain used against Ivanti CSA",
      "body": null,
      "sourceUrl": "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-09",
      "title": "CISA added CVE-2024-9379 to the KEV catalog (federal deadline 2024-10-30)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-09",
      "title": "CISA added CVE-2024-9380 to the KEV catalog (federal deadline 2024-10-30)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465",
      "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-09",
      "title": "CVE-2024-9463 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9463",
      "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465"
    },
    {
      "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465",
      "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-09",
      "title": "CVE-2024-9465 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9465",
      "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-08",
      "title": "CVE-2024-9379 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9379",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-08",
      "title": "CVE-2024-9380 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9380",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-endpoint-manager-epm-cve-2024-29824",
      "incidentTitle": "Ivanti Endpoint Manager (EPM) SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-02",
      "title": "CISA added CVE-2024-29824 to the KEV catalog (federal deadline 2024-10-23)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-19",
      "title": "CVE-2024-8963 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8963",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-19",
      "title": "CISA added CVE-2024-8963 to the KEV catalog (federal deadline 2024-10-10)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "progress-whatsup-gold-cve-2024-6670",
      "incidentTitle": "Progress WhatsUp Gold SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-16",
      "title": "CISA added CVE-2024-6670 to the KEV catalog (federal deadline 2024-10-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-13",
      "title": "CISA added CVE-2024-8190 to the KEV catalog (federal deadline 2024-10-04)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-10",
      "title": "CVE-2024-8190 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8190",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-10",
      "title": "Ivanti publishes the advisory for CVE-2024-8190",
      "body": null,
      "sourceUrl": "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "progress-whatsup-gold-cve-2024-6670",
      "incidentTitle": "Progress WhatsUp Gold SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-29",
      "title": "CVE-2024-6670 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-6670",
      "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670"
    },
    {
      "incident": "palo-alto-networks-expedition-cve-2024-5910-9463-9465",
      "incidentTitle": "Palo Alto Networks Expedition: 3 actively exploited vulnerabilities",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-07-10",
      "title": "CVE-2024-5910 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-5910",
      "url": "https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465"
    },
    {
      "incident": "ivanti-endpoint-manager-epm-cve-2024-29824",
      "incidentTitle": "Ivanti Endpoint Manager (EPM) SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-31",
      "title": "CVE-2024-29824 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-29824",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824"
    },
    {
      "incident": "fortinet-forticlient-ems-cve-2023-48788",
      "incidentTitle": "Fortinet FortiClient EMS SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-25",
      "title": "CISA added CVE-2023-48788 to the KEV catalog (federal deadline 2024-04-15)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788"
    },
    {
      "incident": "fortinet-forticlient-ems-cve-2023-48788",
      "incidentTitle": "Fortinet FortiClient EMS SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-12",
      "title": "CVE-2023-48788 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-48788",
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788"
    },
    {
      "incident": "f5-big-ip-configuration-utility-cve-2023-46747-46748",
      "incidentTitle": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-31",
      "title": "CISA added CVE-2023-46747 to the KEV catalog (due 2023-11-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748"
    },
    {
      "incident": "f5-big-ip-configuration-utility-cve-2023-46747-46748",
      "incidentTitle": "F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-31",
      "title": "CISA added CVE-2023-46748 to the KEV catalog (due 2023-11-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-16",
      "title": "Third round of fixes for CVE-2023-35708 after a public proof of concept",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35708",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-09",
      "title": "Progress fixes more SQL injection bugs found during code review (CVE-2023-35036)",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35036",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-07",
      "title": "CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-02",
      "title": "CISA adds CVE-2023-34362 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-31",
      "title": "Progress discloses the critical MOVEit Transfer vulnerability and ships patches",
      "body": null,
      "sourceUrl": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-27",
      "title": "Earliest exploitation of the MOVEit Transfer zero-day seen by Mandiant",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    }
  ]
}