Threat intelligence
Reviewed AI-agent threat campaigns
Only records that pass source verification, agent-relevance, editorial review, and security review become public campaigns. Publication is permanent: when active tracking ends, the record stays at its URL as labeled historical research instead of disappearing.
0 under active tracking100 permanent research records
All reviewed campaigns
Newest observations first. Historical records are labeled and remain citable at their permanent URLs.
- Historical recordcritical severity
Rails Active Storage: a crafted upload can write and read files on the server through ImageMagick and FFmpeg (GHSA-f3w6-w445-fwh9, GHSA-v924-7rp8-4mxh)
On 2026-11-04 (UTC) Rails released 8.0.5.2 and 8.1.4.1, fixing 21 security issues. GHSA-f3w6-w445-fwh9 (Critical, CVSS 9.8): Active Storage ran ImageMagick analysis on attach with no coder restrictions, so an unauthenticated attacker who can upload a crafted file may write arbitrary files on the server and, with the Disk service, read files readable by the app process such as secret_key_base. It affects apps using variant_processor :mini_magick (default on load_defaults 6.1 or earlier) under an ImageMagick policy that does not deny the coders involved (Debian and Ubuntu policies do not). GHSA-v924-7rp8-4mxh (High, CVSS 8.8): Active Storage kept the uploaded extension on tempfiles passed to ffprobe, ffmpeg and ImageMagick, letting the uploader pick the decoder; an FFmpeg built with AviSynth evaluates .avs files as scripts, which could disclose files through a preview image or load an uploaded native library. Both affect activestorage < 8.0.5.2 and >= 8.1, < 8.1.4.1. No CVE IDs, not on CISA KEV, and no known exploitation at publication.
Last observed Nov 4, 2026 · Reviewed Nov 4, 2026
Read the campaign record - Historical recordhigh severity
WordPress core update hijack now exploited: attackers race the few seconds a site spends updating (CVE-2026-119977, CISA KEV)
CVE-2026-119977 is the WordPress core upgrade race fixed in WordPress 7.1.4 on 2026-10-28. During a full-package core update, WordPress 4.7.0 through 7.1.3 staged the new files at a predictable, web-accessible path under wp-content/upgrade/, so an unauthenticated attacker who requested the staged installer during the update window could run code on the server. Wordfence, as CNA, published the CVE on 2026-10-31 with CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N) and CWE-367; WordPress's own advisory GHSA-4w3m-c66w-69mg rates it Low. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-11-03 with a 2026-11-06 due date, forensic triage marked Yes and ransomware use Unknown. Fixed releases exist for every branch back to 4.7 (7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 down to 4.7.39). The update that installed 7.1.4 still ran the old upgrader, so the open question for patched sites is whether an earlier update was raced.
Last observed Nov 3, 2026 · Reviewed Nov 3, 2026
Read the campaign record - Historical recordcritical severity
Docker Desktop for Windows on WSL 2: a container can slip past the AF_VSOCK block and reach host services and Windows files (CVE-2026-112917)
CVE-2026-112917 (CVSS 4.0 9.2 from Docker, CWE-424) was published on 2026-11-03 alongside Docker Desktop 4.98.0. In Docker Desktop for Windows with the WSL 2 backend, an unprivileged Linux container can use the 32-bit socketcall system call to bypass the default seccomp restriction on AF_VSOCK, which can expose host-facing services and Windows files accessible to the logged-in user. It affects x86-64 WSL 2; LinuxKit-based backends are unaffected. Docker says the issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later (released 2026-10-09 with WSL kernel 6.18.54.1); Docker Desktop 4.98.0 on an older WSL remains affected. The upstream moby default seccomp profile allows socket() only for listed address families (AF_VSOCK, 40, is not listed) but allows socketcall with no argument filter and includes the 32-bit x86 sub-architecture. Not on CISA KEV and no known exploitation as of 2026-11-03.
Last observed Nov 3, 2026 · Reviewed Nov 3, 2026
Read the campaign record - Historical recordcritical severity
Barracuda Email Security Gateway chained from no login to root through the admin interface (CVE-2026-116606, CVE-2026-111560)
Barracuda and Mandiant disclosed two bugs on 2026-11-02. CVE-2026-116606 (CVSS 4.0 9.3, CWE-288) is an authentication bypass in Barracuda Email Security Gateway (ESG) that lets an unauthenticated remote attacker invoke the configuration-import function and restore a crafted, compatible backup, modifying the appliance's global configuration. CVE-2026-111560 (CVSS 4.0 8.6, CWE-78) is an OS command injection in the timezone configuration field that runs as root and needs administrator privileges; it affects ESG, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center. Barracuda says that exploited in combination they can bypass authorization controls and give root on the device, and that exploitation requires access to the administrative interface. Barracuda's Campus page names ESG firmware 9.4.0.029 as the fix; the CVE record and Mandiant list the bypass as affecting versions earlier than 9.4.0.030. Patch IDs: ESG BNSF-40425 (9.4.017+) and BNSF-40430 (older), ADC and WAF BNADC-16586, BMA BNMA-32468, WCC BNWF-60060, WSG BNYF-24789. No exploitation reported and not on CISA KEV as of catalog 2026.10.30.
Last observed Nov 2, 2026 · Reviewed Nov 2, 2026
Read the campaign record - Historical recordcritical severity
Node-RED editors with no login are being hijacked to run a Linux bot and webshells (CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced)
CVE-2026-58115 (CVSS v3.1 10.0 and CVSS v4.0 10.0, CWE-306) was published by Siemens ProductCERT on 2026-08-11 in SSA-834709 and republished by CISA as ICSA-26-237-03 on 2026-08-25. SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) devices before V4.3.4.1 running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, so an unauthenticated remote attacker can create flows with nodes that execute system commands, with maximum privileges. The root cause is the Node-RED default: the editor and admin API are unsecured unless adminAuth is configured, so any Node-RED instance reachable without adminAuth accepts the same request. VulnCheck reported in-the-wild exploitation caught by a canary on 2026-10-30: a single POST /flows deploying an inject node wired to an exec node that downloads bot-linux-amd64 to /dev/shm/.b and runs it, followed by 16 events from the same AS8075 source through 2026-11-01 including a staged script, a second payload server, and http-in webshell flows. VulnCheck added the CVE to its own KEV; it is not on CISA KEV as of catalog 2026.10.30.
Last observed Nov 1, 2026 · Reviewed Nov 3, 2026
Read the campaign record - Historical recordcritical severity
Ivanti Connect Secure chained to root: login bypass plus two more CISA KEV bugs (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527)
Ivanti Connect Secure (ICS) has an authentication bypass by spoofing (CWE-290) that lets a remote unauthenticated attacker execute arbitrary commands on the VPN appliance. Ivanti disclosed it on 2026-10-13, rates it CVSS 8.6 (High), and says it is aware of exploitation in the wild affecting a limited number of customers. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-10-16 due date. Fixed builds: 25.1.1.2 (for 25.1.1.1 and prior), 25.1.3.0 or 25.1.3.1 (for 25.1.2.2 and prior), and 22.8R2.5 (for 22.8R2.4 and prior); Ivanti recommends 22.8 customers move to 25.1.1.2. ICS 22.7R2.14 and earlier are not affected. Ivanti says there are no reliable indicators of compromise yet and points suspected victims to its 22.8x and 25x recovery steps. Update 2026-10-30: the October 13 builds fixed only the first step of a three-bug chain. Volexity documented an attacker (UTA0576) exploiting ICS 22.8R2.4 from 2026-10-03 by combining the welcome.cgi X-DSCGI-PATH routing bypass (CVE-2026-104935) with a wu.cgi upload that lands at a predictable MD5-of-filename path (CVE-2026-118527) and a dsinvoked/DSCache trust flaw that runs attacker code as root (CVE-2026-111357). Ivanti fixed the last two on 2026-10-29 in 25.1.1.3 and 22.8R2.6; 25.1.1.2 and 22.8R2.5 remain affected. CISA added both to KEV on 2026-10-30 (catalog 2026.10.30): CVE-2026-111357 due 2026-11-02 with forensic triage, CVE-2026-118527 due 2026-11-13.
Last observed Oct 30, 2026 · Reviewed Oct 30, 2026
Read the campaign record - Historical recordcritical severity
ClickHouse Server unauthenticated RCE (CVE-2026-116366): self-hosted servers reachable on the network can be taken over without a password
On 2026-10-30 ClickHouse disclosed CVE-2026-116366: under certain conditions, an unauthenticated user with network access can execute arbitrary code on ClickHouse Server. The ClickHouse CNA rates it CVSS 4.0 9.5 (AV:N/AC:H/PR:N/UI:N), classifies it as CWE-190 integer overflow, and credits Elshad Toklayev. Fixed open-source builds are 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable. ClickHouse says the fix is applied to all ClickHouse Cloud and BYOC deployments. ClickHouse has not named the affected interface, the conditions, or published a proof of concept. Unsupported trains (26.7, 26.4 to 26.6, 26.1, 26.2, 25.x and older) receive no fix. Langfuse and SigNoz self-host defaults bundle ClickHouse 25.12 and 25.5.6 images, which are off support.
Last observed Oct 30, 2026 · Reviewed Oct 30, 2026
Read the campaign record - Historical recordcritical severity
Tampered Claude Code 2.1.313 in Cursor's extension marketplace planted a persistent SSH backdoor on developer machines
Between about 09:27 and 20:35 UTC on 2026-10-29, the Cursor VS Code extension marketplace served a maliciously modified Anthropic.claude-code version 2.1.313 that Anthropic did not build. Cursor says at most 5,000 users were affected. A 66-line loader prepended to extension.js runs when the extension loads: it appends an attacker Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a reverse SSH tunnel to [email protected][.]225 that retries about every 60 seconds, installs persistence (macOS LaunchAgent com.apple.sysmond, Linux @reboot crontab, Windows SysMon scheduled task or Startup sysmon.cmd), and POSTs host details, Git email and up to 40 secret-looking environment variable names to hxxp://134.209.82[.]225:8099/beacon. Cursor says enabling SSH fails without admin rights on most macOS and Windows hosts, but the key, persistence and beacon still happen. Cursor removed the version, shut down and rebuilt its marketplace, rotated keys and had the C2 server taken offline. Clean 2.1.314 was published on 2026-10-30.
Last observed Oct 30, 2026 · Reviewed Oct 30, 2026
Read the campaign record - Historical recordhigh severity
Cisco ASA and FTD SSL VPN crash bug exploited as a zero-day: unauthenticated reloads via secondary authentication (CVE-2026-76418, CISA KEV)
On 2026-10-28 Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, CWE-690), a denial-of-service bug in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not required. A device is vulnerable only if it runs an affected release, the SSL VPN login service is reachable (webvpn enabled on an interface), and secondary-authentication-server-group is set on an in-scope tunnel group: every tunnel group including DefaultWEBVPNGroup when tunnel-group-list enable is configured, otherwise DefaultWEBVPNGroup. Cisco PSIRT became aware of active exploitation in October 2026. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-29 (version 2026.10.29) with a 2026-11-01 due date; forensic triage is not required and ransomware use is unknown. SecurityWeek and BleepingComputer report it is the second ASA/FTD VPN denial-of-service zero-day since August, after CVE-2026-20349.
Last observed Oct 29, 2026 · Reviewed Oct 29, 2026
Read the campaign record - Historical recordcritical severity
GitLab critical patch: no-login code execution on self-managed servers (CVE-2026-97229)
GitLab shipped an out-of-band critical patch release on 2026-10-12 (19.4.2, 19.3.5, 19.2.8) for CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler. GitLab says a specially crafted regular expression in a CI/CD configuration could let an unauthenticated user execute arbitrary code on the GitLab server, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. GitLab.com is already patched; GitLab Dedicated needs no action. The same release fixes 23 other issues, five rated high, and the bug-fix list adds Ruby regexp program size and repeat-range double-free patches for Ruby 3.3 and 3.4. Update 2026-10-29: CISA added CVE-2026-97229 to the Known Exploited Vulnerabilities catalog (version 2026.10.29) with a 2026-11-01 due date and forensic triage required. Alpine Linux reported that on 2026-10-20 and 2026-10-21 a newly registered account sent crafted CI configurations to its GitLab (then on unfixed 19.3.4), crashing workers 8 times; Alpine found no evidence of code execution, could not rule it out, and rebuilt the server. Its 2026-10-22 upgrade to 19.3.6 did not fix the flaw because its image used standard Ruby: the fix is a patch to Onigmo in the Ruby GitLab bundles, released upstream in Ruby 3.3.13, 3.4.12 and 4.0.9 on 2026-10-23.
Last observed Oct 29, 2026 · Reviewed Oct 29, 2026
Read the campaign record - Historical recordcritical severity
Langflow OSS 33-CVE disclosure: no-login auth bypass and code execution through 1.12.8 (CVE-2026-93680, CVE-2026-110186), fixed in 1.13.0
On 2026-10-29 between 15:14 and 15:19 UTC, IBM (the CNA for Langflow) published 33 CVE records for Langflow OSS, backed by three IBM security bulletins dated 2026-10-19 (nodes 7293015 and 7293016) and 2026-10-28 (node 7294467). Four IDs affect every release from 1.0.0 through 1.12.8 and are fixed only in 1.13.0 (released 2026-10-22): CVE-2026-93680 (9.8, improper authentication, no login), CVE-2026-110186 (9.8, code execution via improper control of code generation, no login), CVE-2026-110193 (8.8, a low-privileged user makes the Agentic Assistant generate or submit component code that runs OS commands) and CVE-2026-110192 (6.5, insufficiently protected credentials). Sixteen IDs through 1.12.3 are fixed in 1.12.4, including the unauthenticated CVE-2026-104339 (9.8) and message-broker deserialization CVE-2026-104317 (8.1). Thirteen through 1.12.4 are fixed in 1.12.5, including three authenticated 9.9 code-execution bugs (CVE-2026-107327, 107328, 107329). Release builds of 1.12.x default LANGFLOW_AUTO_LOGIN to true, which signs visitors in as the bootstrap superuser, so account-required bugs are reachable by anyone who can open the UI on a default install. Langflow 1.13.0 turns auto-login off by default and requires a superuser password. A Metasploit auxiliary module for CVE-2026-93680 (released 2026-10-23) opens the MCP SSE endpoint at /api/v1/mcp/sse without credentials; the module lists 1.5.0 through 1.11.4.
Last observed Oct 29, 2026 · Reviewed Oct 29, 2026
Read the campaign record - Historical recordmedium severity
VMware ESX logging bypass let attackers run ESXi commands that never reached the logs, used as a zero-day and now on CISA KEV (CVE-2026-41709)
CVE-2026-41709 is an insufficient logging flaw in VMware ESX: an administrator can perform certain operations without them being logged. Broadcom fixed it in VMSA-2026-0006 on 2026-07-29 and rated it Low (CVSS 2.7), crediting Ian Barton of CrowdStrike. On 2026-10-28 CrowdStrike reported that the China-nexus adversary WARP PANDA, after deploying malware in victims' vCenter environments at US entities including the legal sector, exploited this ESXi command logging bypass as a zero-day in several cases as late as early 2026. CISA added it to KEV the same day with a 2026-11-11 due date. It grants no access on its own; its value to attackers is hiding post-compromise activity on the hypervisor, so local ESXi logs from affected periods may be incomplete.
Last observed Oct 28, 2026 · Reviewed Oct 28, 2026
Read the campaign record - Historical recordhigh severity
Fragnesia (CVE-2026-46300): a Linux kernel bug that rewrites read-only files in memory, used to turn PHP2Shell web shells into root, now on CISA KEV
CVE-2026-46300 (Fragnesia) is a Linux kernel local privilege escalation in the XFRM ESP-in-TCP path. skb_try_coalesce() moved page-cache-backed fragments between socket buffers without preserving the SKBFL_SHARED_FRAG marker, so ESP input decrypted them in place and XORed attacker-chosen AES-GCM keystream bytes into the page cache of read-only files. V12 disclosed it on 2026-05-13 with a public exploit that overwrites /usr/bin/su in memory; the fix (commit f84eca581739, 'net: skbuff: preserve shared-frag marker during coalescing') is in stable 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208 and in distribution kernels. Dream reported on 2026-10-27 that attackers chained a custom PHP2Shell exploit with Fragnesia to root 25 servers, mostly firewall appliances, including systems on a US government-affiliated network, overwriting /etc/pam.d/su with pam_permit.so. CISA added it to KEV on 2026-10-28 with a 2026-10-31 due date and forensic triage required. The change lives in the page cache, not on disk, so a reboot or cache drop removes both the backdoor and the evidence.
Last observed Oct 28, 2026 · Reviewed Oct 28, 2026
Read the campaign record - Historical recordhigh severity
WordPress 7.1.4: a race in the core upgrade process let an unauthenticated visitor reach the unpacked installer mid-update (plus 21 account-required fixes)
WordPress 7.1.4, released 2026-10-28, fixes 22 vulnerabilities across 17 advisories. The only one that needs no account is a race in the core upgrade process reported by Umut Bayram: during an install or update WordPress unpacks the package into wp-content/upgrade/, a web-served folder. Before 7.1.4 the working folder name was predictable for admin-uploaded packages and the pre-unpack cleanup deleted the folder's index.php, so a visitor who requested the right path during the seconds an update ran could reach the unpacked copy's wp-admin/setup-config.php. The fix (commit e7b33f536d) appends 16 random characters to the folder name, keeps and recreates index.php, and stops update_core() copying a wp-config.php out of the working directory. The window opens on every update, including automatic background updates. The other 21 issues need a logged-in user, mostly Contributor or above: stored XSS in the Interactivity API (seven advisories sharing a KSES data-* root cause), Customizer selective refresh, the Categories, Comments Pagination and Post Navigation Link blocks and block delimiters; Editor+ XSS on the personal data erasure screen; plus an unauthenticated leak of unpublished Customizer changesets and a Notes permission bug for custom roles. HelpHub lists fixed releases for every branch back to 4.7.39.
Last observed Oct 28, 2026 · Reviewed Oct 28, 2026
Read the campaign record - Historical recordhigh severity
Tailworm: Tailscale SSH socket forwarding gave a trusted device root on the servers it could reach (TS-2026-014, fixed in 1.104.4)
Tailworm is the name Cyberdione Labs gave to 11 findings in Tailscale 1.104.2 and headscale 0.29.5, published on 2026-10-25 before any patch existed. The most serious (Tailscale bulletin TS-2026-014) is in Tailscale SSH: Unix socket forwarding (ssh -L and ssh -R) validated paths by name but performed dial, bind and unlink as the root tailscaled process, and a race defeated the path allowlist. A device already permitted by an SSH rule could reach root-only sockets such as the Docker socket or the tailscaled local API and gain root on the target; in the researcher's lab the chain spread host to host in under a second per hop. Tailscale also bulletined SSH session memory exhaustion (TS-2026-015), tailscale serve Unix backends reaching the local API (TS-2026-016) and an HTTP/2 capability bleed across serve mounts (TS-2026-017). Tailscale 1.104.4, tagged 2026-10-27, fixes all four by running forwarding as the session user, bounding session memory and rechecking serve targets on every dial. Headscale control-server findings and part of the app connector finding are not fixed by the client release.
Last observed Oct 28, 2026 · Reviewed Oct 28, 2026
Read the campaign record - Historical recordcritical severity
LiteLLM Enterprise proxy leaks its master key to a request with no API key (GHSA-w4c7-34wj-hqm8)
An unauthenticated request to any LLM route on a LiteLLM proxy running with an Enterprise license could make the proxy read a local file and send its contents to a URL chosen by the attacker. Reading the process environment exposes LITELLM_MASTER_KEY and provider API keys, which gives full admin on the proxy; in some configurations this leads to arbitrary Python execution as root. The root cause, per PR #48599, is that failure logs for rejected requests were built from the raw request body, so a caller with no valid key could set per-request logging parameters such as the Langfuse or LangSmith host and the GCS bucket and service-account path. Fixed in litellm 1.103.10, 1.104.8, 1.105.6 and 1.106.5, whose release notes describe the change only as a logging change with 'No action needed to upgrade'. Open source deployments without a license are not affected.
Last observed Oct 27, 2026 · Reviewed Oct 27, 2026
Read the campaign record - Historical recordcritical severity
Magento PolyShell lets anyone upload a webshell through the guest cart REST API, now on CISA KEV (CVE-2026-48356)
CVE-2026-48356, named PolyShell by Sansec, is an unrestricted file upload (CWE-434) in Adobe Commerce and Magento Open Source. The REST guest cart endpoints POST /rest/V1/guest-carts/:cartId/items and PUT /rest/V1/guest-carts/:cartId/items/:itemId accept a file_info object (base64 data, MIME type, filename) inside cart item custom options and write it to pub/media/custom_options/quote/. Sansec found that Magento did not check that the option ID belongs to the product, did not require a file-type option, and did not restrict the extension; the only gate was an image header check, so a GIF89a-prefixed PHP file passes. Whether the upload becomes remote code execution or stored XSS depends on whether the web server serves or executes files in that folder. Adobe fixed it in Magento 2.4.9 (May 2026) and backported the fix to supported lines in APSB26-73 on 2026-07-14 (CVSS 9.3). Sansec documented exploitation from March 2026, including 471 stores compromised in one hour on 2026-03-30 and a skimmer-loader crew that has used PolyShell uploads on Magento stores through October 2026. CISA added CVE-2026-48356 to the KEV catalog on 2026-10-27 with a 2026-11-10 due date.
Last observed Oct 27, 2026 · Reviewed Oct 27, 2026
Read the campaign record - Historical recordhigh severity
Node.js Brotli decoder writes out of bounds on a malformed stream, reachable through fetch(), Express 5 and zlib (CVE-2026-111497)
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that Node.js bundles in deps/brotli. The Node.js project rates it high and describes the impact as remote code execution; it affects the 26.x, 24.x and 22.x lines, and end-of-life lines are always affected. Node.js fixed it on 2026-10-21 in 22.23.4, 24.22.1 and 26.12.1 by cherry-picking upstream Brotli commit 0ed4268a ('Detect and report invalid stream earlier'). In the old code, a stream that declared a single block type and then requested a block switch made DecodeBlockTypeAndLength return false, but on the fast decoding path the block-switch wrappers were void functions, so the failure was ignored and decoding continued. The fix returns the new error BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) and stops. Node exposes that constant in zlib.constants, which gives operators a one-line patched/unpatched check. Exposure comes from any code that decodes attacker-influenced Brotli: fetch() (undici) decodes Content-Encoding: br responses, body-parser 2.x (Express 5) decodes br request bodies by default, axios requests br by default, and direct zlib Brotli decompression calls. Brotli itself shipped the fix in 1.2.1, 1.1.1 and 1.0.10 on 2026-10-21. Update 2026-10-27: CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog (version 2026.10.27) with a 2026-11-10 due date; forensic triage is not required and ransomware use is unknown. On 2026-10-26 at 15:08 UTC ELLIO's sensors recorded a 23,069,983-byte Brotli request body from 94.154.43.7 built for the official Node.js 24.22.0 x86-64 binary, reusing public PoC delivery with an original ROP chain; ELLIO's replay of that chain crashed the target in 50 of 50 attempts without a shell, while the public chain does return a shell.
Last observed Oct 27, 2026 · Reviewed Oct 27, 2026
Read the campaign record - Historical recordcritical severity
PHP2Shell: crafted HTTP requests run code on PHP web servers without a login (CVE-2026-109618, CVE-2026-109619)
Two critical bugs in the PHP interpreter (CVSS v4.0 9.2 each) allow unauthenticated remote code execution as the web worker. CVE-2026-109618: PHP's longjmp()-based out-of-memory bailout can leave partially initialized request memory that request shutdown later consumes; multipart parsing (unbounded per-part headers, empty file controls, nested field names) lets a request stay under post_max_size yet exhaust memory_limit, and under Apache mod_php this happens before any application code runs. CVE-2026-109619: request-owned global state (error, session, object, extension state) can survive a fatal error into the next request on the same worker and be consumed before normal initialization, a use-after-free; confirmed producers are PHP 8.5 fatal_error_backtraces and session upload progress. Details leaked on 2026-10-20; PHP shipped fixes 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting partners reported exploitation attempts to Patchstack and Cloudflare reported early attacks. Update 2026-10-26: CISA added both CVEs to the Known Exploited Vulnerabilities catalog (version 2026.10.26) with a 2026-10-29 due date and forensic triage required under BOD 26-04. On 2026-10-24 a researcher's honeypots running PHP 8.4.26 under Apache mod_php recorded 35 shells launched by the web server through a four-stage chain consistent with CVE-2026-109618.
Last observed Oct 26, 2026 · Reviewed Oct 26, 2026
Read the campaign record - Historical recordhigh severity
One gzipped POST crashes Express via body-parser before routing (CVE-2026-111181)
CVE-2026-111181 / GHSA-27r3-jxmh-p828 is a high-severity denial of service in the npm package body-parser. When a request carries Content-Encoding (gzip, deflate, or on 2.x Brotli), body-parser pipes the body into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that Node raises as an uncaught exception, terminating the process. Parsing runs before routing, so no authentication and no matching route are required. Fixed in body-parser 1.20.9 and 2.4.0. Express 4.22.3 declares body-parser ~1.20.5 and Express 5.3.0 declares ^2.3.0, so updating express alone does not pull the patched versions when the lockfile is pinned. Workaround: pass inflate: false to reject encoded bodies before a decoder is created. Same-day sibling multer CVE-2026-113872 (GHSA-q7qp-rjg7-q26m) is a separate DoS for asynchronous fileFilter, fixed in multer 2.5.0.
Last observed Oct 22, 2026 · Reviewed Oct 22, 2026
Read the campaign record - Historical recordhigh severity
Railway breach exposed customer environment variables: rotate every secret stored in Railway
On 2026-10-21 Railway disclosed that an unauthorized third party may have accessed the systems that store customer environment variables and, for some of them, obtained the decrypted contents. Environment variables on Railway commonly hold API keys, database passwords, registry credentials and wallet private keys. Railway says impact may be limited to a subset of users but recommends every user roll all environment variables, API keys and private registry credentials stored in Railway and review service logs. Railway believes the intrusion is part of a series of attacks on platform companies aimed at compromising AI inference providers, and says it notified those providers to revoke keys. Railway paused builds, rotated S3 credentials for every storage bucket, invalidated GitHub tokens it held, invalidated OAuth sessions and all Railway API tokens, and published per-provider recovery guides. Researcher Taylor Monahan reported that wallet private keys stored in Railway were swept by address 0xd9773325282874d18cb83f1fe50f14c39750b2ee (about $371,000, 500+ transactions, 19+ EVM chains), with the first theft at 19:36 UTC on 2026-10-21, before Railway's 21:59 UTC notice. No CVE applies.
Last observed Oct 22, 2026 · Reviewed Oct 22, 2026
Read the campaign record - Historical recordcritical severity
GitLab servers taken over with no login through a crafted Org-mode file, even after the Oct 12 patch (CVE-2026-110264)
CVE-2026-110264 (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is an integer overflow in Onigmo, the Ruby regular expression engine bundled with GitLab CE/EE, that can let an unauthenticated user execute arbitrary code on a self-managed GitLab server. GitLab's detection write-ups describe the path: the org-ruby gem that renders .org files interpolates a raw #+TODO: keyword into Regexp.new, and a keyword with more than 32,767 generic repeats wraps Onigmo's signed 16-bit repeat ID, causing an out-of-bounds write at match time that GitLab says can be turned into a system() call as the git user. Every version from 7.0 is affected. GitLab fixed it on 2026-10-21 in 19.5.1, 19.4.3 and 19.3.6 and backported the fix to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The Oct 12 fixes for CVE-2026-97229 (19.4.2, 19.3.5, 19.2.8) are below the new fixed versions, so those servers are exposed again. Reported by joaxcar through HackerOne.
Last observed Oct 21, 2026 · Reviewed Oct 21, 2026
Read the campaign record - Historical recordcritical severity
eMudhra CA keys leaked: forged HTTPS certificates still pass in unpatched Go, Python, Node.js and Java (CVE-2026-111943)
eMudhra created eight intermediate CAs (EM DV, OV and EV TLS CA G3B and G3C, plus EM OV CS CA G3B and G3C) at an April 30, 2025 key ceremony with P-384 private keys below 256, so anyone can recover them from the public certificates. Sectigo cross-signed all eight under AAA Certificate Services. A researcher proved key control to the root programs on October 17, 2026. Chrome, Firefox, Apple and Microsoft blocked the intermediates through CRLSet, OneCRL and their own channels between October 17 and 20, eMudhra revoked them on October 18 and Sectigo revoked the cross-signs on October 19. Mozilla and Chrome are removing emSign ECC Root CA - G3. Clients outside the browser that skip revocation and Certificate Transparency, including Go, Python certifi, Node.js, Java cacerts, Linux ca-certificates and macOS /etc/ssl/cert.pem, accept forged certificates for any hostname until updated: Go 1.27.3/1.26.10 (CVE-2026-111943), certifi 2026.10.18+, Node.js 22.23.4/24.22.1/26.12.1, NSS 3.131.1 and distro ca-certificates updates.
Last observed Oct 21, 2026 · Reviewed Oct 21, 2026
Read the campaign record - Historical recordcritical severity
LiteLLM 1.107.0 shipped a credential stealer on PyPI and the Docker latest tag
All seven litellm 1.107.0 wheels uploaded to PyPI at 11:39 UTC on 2026-10-21 contained three extra files under litellm-1.107.0.data/purelib/ (cook.pth, cook.py, sitecustomize.py) that pip installs into site-packages root. cook.pth imports cook.py at every Python start; it collects host info, browser passwords, SSH and cloud credentials, CI and registry tokens, AI tool configs, other processes' environments and, when DATABASE_URL is set, LiteLLM's credential and model tables, then POSTs an encrypted bundle to www.litellm.dev. sitecustomize.py adds an hourly remote-code loader keyed off a GitHub dead-drop file. The v1.107.0 git tag is clean; the sdist pyproject.toml carries an injected maturin data = "cook" line. PyPI removed 1.107.0. The Docker v1.107.0 image and the floating latest, main-latest and main-stable tags on GHCR and Docker Hub share digest sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e and still resolved to it at 13:44 UTC.
Last observed Oct 21, 2026 · Reviewed Oct 21, 2026
Read the campaign record - Historical recordcritical severity
Plex Media Server hijacked without a login through the Plex2Shell chain, on CISA KEV (CVE-2026-96652)
Plex2Shell chains four Plex Media Server bugs fixed in 1.43.3.10861: an SSRF in /player/timeline that accepts any X-Plex-Token value (CVE-2026-96652), unescaped identifiers in the loopback-only agent searchOne API that let an attacker call other plugins' functions (CVE-2026-96654), a transcoder path SSRF and owner-token exposure (CVE-2026-96655), and an admin file write through the TranscoderH264Options preference that drops a shared library into the Codecs folder, which Plex loads on the next transcode (CVE-2026-96656). Plex says that chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. A public proof of concept was released on 2026-10-16, a honeypot recorded in-the-wild exploitation on 2026-10-17 delivering an XMRig-based miner and myawesomeproxy proxy software, Plex confirmed active and widespread exploitation on 2026-10-19, and CISA added all four CVEs to KEV on 2026-10-20.
Last observed Oct 19, 2026 · Reviewed Oct 20, 2026
Read the campaign record - Historical recordcritical severity
Atlassian Data Center lets strangers read files from Jira, Confluence and Bitbucket (CVE-2026-21589)
CVE-2026-21589 lets an unauthenticated attacker read specific files inside the web application root of self-hosted Atlassian Data Center products. Atlassian published fixes on 2026-10-05. watchTowr reports in-the-wild exploitation observed as of 2026-10-06, and CISA added the CVE to KEV on 2026-10-15. Atlassian Cloud is patched with no evidence of exploitation found.
Last observed Oct 15, 2026 · Reviewed Oct 15, 2026
Read the campaign record - Historical recordcritical severity
Next.js October 2026 security update: unauthenticated Image Optimization and use cache RCEs (CVE-2026-96889)
On 2026-10-14 Vercel published Next.js advisories for two unauthenticated remote code execution bugs and a Server Actions denial of service. GHSA-2464-fhr4-w9xw (CVE-2026-96889) is an Image Optimization RCE when SVG is processed through sharp/librsvg on glibc Linux. GHSA-673q-mjm6-r5xr is an unauthenticated RCE in use cache functions that return typed arrays (Next.js 16 only). GHSA-p3m5-59mp-jv5r is a high-severity Server Actions DoS. Fixed in next 15.5.28 and 16.4.1, with sharp 0.35.5 required for the image path. On the 15.x line, [email protected] still accepts sharp ^0.34.3 || ^0.35.5, so a lockfile that already resolved sharp 0.34 can keep the vulnerable decoder after upgrading Next.js.
Last observed Oct 14, 2026 · Reviewed Oct 14, 2026
Read the campaign record - Historical recordhigh severity
Malicious HTTP/2 servers can crash curl during uploads (CVE-2026-92392)
On 2026-10-14 the curl project published CVE-2026-92392 as High: during an HTTP/2 upload, mishandling RST_STREAM with reason HTTP_1_1_REQUIRED or REFUSED_STREAM can use-after-free a struct Curl_easy. The advisory says the UAF has been proven convertible to remote code execution only when many exact criteria line up (curl object layout, architecture, libc heap, nghttp2 and OpenSSL/TLS 1.3 behavior, pinned CA geometry, two parallel transfers, short-command constraint). Affects curl and libcurl 8.12.0 through 8.22.0. Fixed in 8.23.0 (also advisory branch floors 8.14.3, 8.16.2, 8.20.2). Not listed on CISA KEV catalog version 2026.10.13 and no known-in-the-wild mark on the Guard feed at publish time. Oct 14 also shipped 20 Low curl advisories on the same 8.23.0 upgrade train.
Last observed Oct 14, 2026 · Reviewed Oct 14, 2026
Read the campaign record - Historical recordhigh severity
Exploited Windows zero-day lets crafted files skip the Mark of the Web warning (CVE-2026-96951)
Microsoft fixed CVE-2026-96951 in the October 2026 Patch Tuesday release (2026-10-13). It is a command injection (CWE-77) in Windows Shell that lets an unauthorized attacker bypass a security feature over a network; Microsoft's FAQ says the bypassed feature is Mark of the Web (MOTW), so a crafted file sent by email or instant message, or reached through a link, can open without the internet-origin protections. Microsoft rates it Important, CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), marks it Exploitation Detected and not publicly disclosed. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-10-16 due date. Affected: Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. Outlook.com is also listed and was fixed service-side in release 20260925.100.
Last observed Oct 13, 2026 · Reviewed Oct 13, 2026
Read the campaign record - Historical recordcritical severity
No-login code execution in Magento and Adobe Commerce, fixed in October 2026 update (CVE-2026-103849)
Adobe published APSB26-153 on 2026-10-13 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. CVE-2026-103849 (CWE-1336, CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C) allows arbitrary code execution without authentication. CVE-2026-92909 (CWE-863, CVSS 9.8, no authentication) is marked B2B by Adobe. The bulletin also fixes two stored XSS issues rated 9.3, an admin-level code execution bug (CVE-2026-92464) and B2B authorization bypasses. Adobe rates the update Priority 2 and says it is not aware of exploits in the wild. Fixed builds are 2.4.4-2026-oct through 2.4.9-2026-oct for Commerce, 2.4.7-2026-oct through 2.4.9-2026-oct for Open Source, B2B 1.3.3-2026-oct through 1.5.3-2026-oct, and 2.4.10-alpha1. Adobe instructs merchants to also apply the September hotfix for CVE-2026-75650.
Last observed Oct 13, 2026 · Reviewed Oct 13, 2026
Read the campaign record - Historical recordhigh severity
Opening a LibreOffice spreadsheet can run remote Java code (CVE-2026-63277)
The Document Foundation fixed six LibreOffice bugs on 2026-10-05 in 26.2.5 and 26.8.0. All stem from Calc external data links saved in the document (calcext:data-mappings) that were honored while the document loaded. CVE-2026-63277 lets a document name a Java database (JDBC) driver to be loaded from a remote location, so opening the file could run that Java code (CNA CVSS 4.0 8.5, CWE-829). Siblings: 63266 file write via embedded Firebird backup, 63267 local file read and GET SSRF via the csv provider, 63268 local text file read via the sql provider, 63269 local file read and SSRF via GStreamer HLS playlists on Linux, 63270 environment/INI value exfiltration via XForms and the csv/sql providers (gap in the CVE-2024-12426 check). Highest exposure: servers that open untrusted documents automatically (headless soffice conversion, previews, mail pipelines).
Last observed Oct 5, 2026 · Reviewed Oct 5, 2026
Read the campaign record - Historical recordhigh severity
NetScaler SAML memory overflow hits CISA KEV
CISA added CVE-2026-88779 to KEV on 2026-10-04 (due 2026-10-07, forensic triage Yes, catalogVersion 2026.10.04). Citrix NetScaler ADC/Gateway memory-buffer overflow (CWE-119) on appliances configured as SAML SP (samlAction) or SAML IdP (samlIdPProfile): unauthenticated network path can cause denial of service. Vendor CVSS v4.0 base 8.7 High (availability High only). Fixed builds: 14.1-73.41+, 13.1-64.28+, FIPS 14.1-73.41 FIPS / 13.1-37.282+. Customer-managed appliances only; Citrix-managed cloud patched by CSG. Distinct from September CVE-2026-88771 RCE cluster.
Last observed Oct 4, 2026 · Reviewed Oct 4, 2026
Read the campaign record - Historical recordcritical severity
Zammad session fixation to root hits CISA KEV
CISA added Zammad CVE-2026-102489 and CVE-2026-102490 to KEV on 2026-10-02. Session fixation can reach RCE as the zammad user; that user can escalate to root. Upgrade to Zammad 7.2.0. Due 2026-10-05.
Last observed Oct 2, 2026 · Reviewed Oct 2, 2026
Read the campaign record - Historical recordcritical severity
FortiMail unauthenticated path traversal hits CISA KEV
CISA added CVE-2026-104286 to KEV on 2026-10-01 (due 2026-10-04, forensic triage Yes, catalogVersion 2026.10.01). Fortinet FortiMail path traversal (CWE-22) plus NULL-byte neutralization (CWE-158) in the GUI/IBE path: unauthenticated attackers can write arbitrary files over crafted HTTP/HTTPS. Fortinet rates Critical CVSSv3 9.8, Known Exploited Yes, and published IoCs. Workaround: disable IBE or keep management off the public internet. Upcoming fixes: 8.0.2 / 7.6.7 / 7.4.9; 7.2 fleets move to 7.4+.
Last observed Oct 1, 2026 · Reviewed Oct 1, 2026
Read the campaign record - Historical recordhigh severity
Next.js image optimizer can hit private IPs (CVE-2026-94483 cluster)
Same-day Next.js September 2026 Security Release (Wed Sep 30, 2026). High CVE-2026-94483 Image Optimization SSRF when images.remotePatterns is configured (attacker-controlled allow-listed URL can reach private IP ranges; no remotePatterns means not affected). Medium cluster: self-hosted Pages Router SSG/ISR cache poison (Vercel not affected), catch-all shared cache poison, App Router metadata image dynamicParams bypass (webpack; Turbopack not affected), nested use cache root-param leak, Draft Mode content bleed via pending use cache fill. Low: next dev MCP endpoint info disclosure (production not affected). Fixed: [email protected] and [email protected].
Last observed Sep 30, 2026 · Reviewed Sep 30, 2026
Read the campaign record - Historical recordcritical severity
Cisco SD-WAN Manager admin API open without a login (CVE-2026-76504)
Same-day Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU for CVE-2026-76504. Improper URI encoding handling in Cisco Catalyst SD-WAN Manager API session auth lets an unauthenticated remote attacker bypass an auth rule and reach the API as the admin user. CVSS 3.1 base 9.8. CWE-177. Affected regardless of configuration. No workarounds. Cisco PSIRT became aware of active exploitation in September 2026. Fixed on-prem releases: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1. Cloud Hosted already on 20.15.605.
Last observed Sep 30, 2026 · Reviewed Sep 30, 2026
Read the campaign record - Historical recordhigh severity
Apple CoreGraphics file OOB write hits CISA KEV
CISA added CVE-2026-86950 to KEV on 2026-09-29 (due 2026-10-02, forensic triage Yes, catalogVersion 2026.09.29). Apple CoreGraphics out-of-bounds write (CWE-787): processing a maliciously crafted file may lead to arbitrary code execution. Fixed 2026-09-28 in iOS/iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1. Apple is aware of a report that this may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Credit: Meta Product Security. Known ransomware campaign use: Unknown.
Last observed Sep 29, 2026 · Reviewed Sep 29, 2026
Read the campaign record - Historical recordhigh severity
Unsloth RCE via malicious Hugging Face model config.json (CVE-2026-93348)
Same-day CVE-2026-93348 (CVSS 8.6 HIGH, CWE-94): Unsloth Zoo get_transformers_model_type() collected nested model_type from config.json without an [a-z0-9_] allowlist, so newlines survived into unsloth_compile_transformers() exec() import path. Affects unsloth-zoo >=2025.9.9 <2026.8.14 and unsloth >=2025.9.9 <2026.8.20. Requires loading a malicious model (UI:P). Fix: upgrade unsloth-zoo to 2026.8.14+ and unsloth to 2026.8.20+. Patch in unsloth-zoo PR #1083 / #1108; credit Ariel Fogel (Pillar Security).
Last observed Sep 28, 2026 · Reviewed Sep 28, 2026
Read the campaign record - Historical recordcritical severity
BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, on CISA KEV (CVE-2026-102764)
CVE-2026-102764 is an improper origin validation flaw in an internal messaging component of BeyondTrust Remote Support (CWE-290) that lets an unauthenticated remote attacker perform file operations on the appliance. Mandiant reports the suspected PRC-nexus actor ARMORY CASTLE (formerly UNC5221) exploited it as a zero-day from late August 2026, planting the SAWFLY web shell, escalating to root via a SUID shell copy, adding reboot-persistent sudoers changes, attempting to dump the appliance credential vault with bt-secrets, tunneling through a HAProxy route, and deleting logs. BeyondTrust patched SaaS by 2026-10-09 and disclosed on 2026-10-15. CISA added it to KEV on 2026-10-16.
Last observed Sep 28, 2026 · Reviewed Oct 16, 2026
Read the campaign record - Historical recordcritical severity
Unauthenticated NetScaler RCE hits every appliance (CVE-2026-88771)
Same-day Citrix NetScaler ADC/Gateway bulletin CTX697096. Lead issue CVE-2026-88771 is unauthenticated remote code execution on every customer-managed NetScaler ADC and Gateway deployment, including default configuration. Citrix rates CVSS v4.0 9.5 and states exploits of CVE-2026-88771 and CVE-2026-88772 have been observed on unmitigated deployments. Fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1.37.279 FIPS/NDcPP. Seven sibling CVEs share the same upgrade train.
Last observed Sep 27, 2026 · Reviewed Sep 27, 2026
Read the campaign record - Historical recordcritical severity
WordPress page template include hits CISA KEV
CISA added CVE-2026-87902 to KEV on 2026-09-25 (due 2026-09-28, forensic triage Yes). WordPress Core unauthenticated path traversal in get_page_template() can include a chosen readable local .php outside active theme dirs (CWE-98). Conditional RCE when the theme has a page-* top-level directory and a readable target such as pearcmd.php with register_argc_argv On. Fixed in 7.1.2 with backports through 4.7.37. Patchstack reports probing hours after the patch and pearcmd write-to-disk attempts.
Last observed Sep 25, 2026 · Reviewed Sep 25, 2026
Read the campaign record - Historical recordcritical severity
MikroTik RouterOS SSH flaws chain into unauthenticated takeover
MikroTik RouterOS SSH bugs in the MikroTrick cluster let attackers abuse exposed SSH. CVE-2026-67279 is an SSH pre-auth rekey state bypass that CISA added to KEV on 2026-09-25 (due 2026-09-28); it can chain with CVE-2026-86060 for unauthenticated admin access. CVE-2026-67276 is incomplete RSA public-key matching. Fixed in RouterOS 7.24.2, 7.23.4, and 6.49.21.
Last observed Sep 25, 2026 · Reviewed Sep 25, 2026
Read the campaign record - Historical recordhigh severity
SharePoint on-prem code injection RCE hits CISA KEV
CISA added CVE-2026-65660 to KEV on 2026-09-25 (due 2026-09-28, forensic triage Yes). Microsoft rated the August 2026 SharePoint Server row Important Remote Code Execution via CWE-94 code injection, CVSS 8.8 with privileges required Low. Fixed builds: Subscription Edition 16.0.19725.20522 (KB5002893), 2019 16.0.10417.20198 (KB5002894), 2016/Enterprise 2016 16.0.5565.1001 (KB5002905). SharePoint Online is not in the MSRC affectedProduct list. MSRC still lists exploited: No; CISA KEV is the later exploitation signal.
Last observed Sep 25, 2026 · Reviewed Sep 25, 2026
Read the campaign record - Historical recordcritical severity
F5 BIG-IP APM OAuth VIP can run attacker code with no login
F5 disclosed CVE-2026-94127 on 2026-09-22: heap overflow RCE on BIG-IP APM when access policy and OAuth share a VIP. Unauthenticated. Appliance mode included. CISA added it to KEV the same day. Fixed by ENG hotfixes Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. Temporary iRule available via F5 Support for triage before patch.
Last observed Sep 22, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordcritical severity
CVE-2026-94545 Next.js next/og ImageResponse RCE on Node.js (GHSA-vcvr-r3jv-pc5j)
Same-day Critical remote code execution in the Node.js ImageResponse implementation from next/og (CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j). Improper SVG escaping in upstream Satori can lead to RCE when attacker-controlled values are passed into SVG content, attributes, or styles. Patched Next.js is 16.3.6. Next.js 15.x is not affected by the RCE; 15.5.26 is hardening only. Edge ImageResponse is not affected.
Last observed Sep 22, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordcritical severity
Erlang TLS 1.3 client can trust a server with no certificate
CVE-2026-89422 is a Critical (CVSS 4.0 9.3) TLS 1.3 client authentication bypass in Erlang/OTP ssl: an unsolicited ServerHello pre_shared_key extension causes ssl:connect to return {ok, Socket} without validating the peer certificate. Same-day siblings CVE-2026-68956 (SSH idle session-channel memory DoS) and CVE-2026-65634 (ASN.1 OID decode CPU DoS during TLS cert parse) share the OTP 29.1.1 / 28.5.0.7 / 27.3.4.18 patch train.
Last observed Sep 22, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordhigh severity
Temporal namespace write can shell the Worker Service host
Temporal Server 1.31.0 before 1.31.3 includes a Worker Controller subprocess compute provider that can execute caller-supplied program and argv on the Worker Service host for an authenticated namespace writer. Sibling CVE-2026-87858 can retarget completion callbacks at the internal frontend as system administrator. Upgrade to 1.32.0, 1.31.3, or 1.30.7. On 1.30.7 and 1.31.3, after pre-fix servers have drained, also set callback.inspectSourceHeader=false; 1.32.0 ships it disabled.
Last observed Sep 21, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordcritical severity
LMDeploy pickle RCE in disaggregated serving
LMDeploy 0.9.2 through versions before 0.16.0 can allow unauthenticated remote code execution when disaggregated serving is enabled because peer messages are deserialized with pickle. Upgrade to 0.16.0 or later.
Last observed Sep 21, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordhigh severity
Headroom WebSocket proxy can spend OpenAI keys for reachable browsers
Headroom before 0.35.0 is vulnerable to cross-site WebSocket hijacking because the proxy does not validate Origin. A malicious browser client that can reach the proxy can make arbitrary LLM requests using the configured OpenAI key. Upgrade to 0.35.0 or later and rotate exposed keys if applicable.
Last observed Sep 21, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordhigh severity
n8n member RCE via MCP node-schema path traversal
CVE-2026-77068 is a high-severity n8n RCE in MCP node-schema path handling. Versions before 2.33.4 and 2.34.x before 2.34.1 are affected; upgrade to 2.33.4 or 2.34.1 as appropriate.
Last observed Sep 21, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordhigh severity
DB-GPT skill upload path traversal
DB-GPT v0.8.1 contains the original CVE-2026-80104 skill-upload filename fix, but the tagged v0.8.2 source regresses that validation. Do not use v0.8.2 as a blanket fixed floor for this CVE.
Last observed Sep 21, 2026 · Reviewed Sep 21, 2026
Read the campaign record - Historical recordhigh severity
Hugging Face Accelerate path traversal lets attackers read arbitrary files
Hugging Face Accelerate through 1.14.0 is affected by path traversal that can read arbitrary files. The cited current sources do not identify a patched release.
Last observed Sep 21, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordhigh severity
WordPress unauth comment XSS before 7.1.1
WordPress 7.1.1 fixes a stored XSS issue in `wpautop()` that can accept unauthenticated input subject to comment approval. Update 7.1 sites to 7.1.1. WordPress version documentation lists 7.0.5, 6.9.8, 6.8.9, and 6.7.8 as released with all 11 security fixes from 7.1.1. Verify other older branches individually.
Last observed Sep 21, 2026 · Reviewed Sep 21, 2026
Read the campaign record - Historical recordcritical severity
OpenShift console unauth Devfile SSRF and DoS
Unauthenticated callers can hit OpenShift console `/api/devfile/` and `/api/devfile/samples/` with crafted Devfile payloads, driving SSRF toward internal services and unbounded memory growth for DoS. Red Hat rates this Important (CVSS 9.3) and currently lists the affected console components without errata or a fixed build.
Last observed Sep 18, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Unbound DNSKEY digest overflow can RCE resolvers
NLnet Labs Unbound through 1.26.0 can overflow a digest buffer while validating a malicious DNSKEY (owner compression pointer into its own RDATA), enabling DoS and possible remote code execution when the resolver digests attacker-controlled zone data. Upgrade to Unbound 1.26.1 or later.
Last observed Sep 16, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Multer aborted uploads leave orphaned disk files
multer 2.2.0–2.3.0 on disk storage can leave orphaned files when a multipart upload is aborted after multer's abort cleanup already ran, so repeated abort storms fill the disk. Upgrade to multer 2.4.0. This is a follow-on class after earlier abort-handling work, not the same bug as the prior 5038-era fix alone.
Last observed Sep 16, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
ScreenConnect guest-to-host file execution (CISA KEV)
ConnectWise ScreenConnect clients before 26.6.5 can, under certain conditions, transfer and execute files through an active remote session without Host confirmation. CISA added CVE-2026-84869 to KEV. Upgrade to 26.6.5 or later and refresh Host clients / access agents.
Last observed Sep 11, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
GitLab unauth commits API file read (CISA KEV)
Self-managed GitLab CE/EE in affected 18.7–19.3 trains had improper path confinement on the commits API so that, under certain conditions, an unauthenticated user could read arbitrary files from the GitLab server. CISA added it to KEV. Upgrade to 19.1.8, 19.2.6, or 19.3.2.
Last observed Sep 11, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Artifactory anonymous token chain (CISA KEV)
Self-hosted JFrog Artifactory could hand an internal anonymous-user token to an unauthenticated caller even when anonymous access was disabled, opening a path into sensitive resources. CISA KEV and public in-the-wild reporting apply. Upgrade past the fixed builds for your Artifactory train and rotate credentials if exposure is plausible.
Last observed Sep 11, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Express compression leaks native memory until the process dies
Express compression zlib abort handling can leak native memory until the process dies. Upgrade to the patched release.
Last observed Sep 11, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Unauth Artemis CORE session steal and OpenWire queue delete
Apache Artemis is affected by unauthenticated CORE session reattach and OpenWire queue delete. Upgrade to the patched release.
Last observed Sep 10, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
PAN-OS XML overflow can give unauth root on PA-Series
A buffer overflow in PAN-OS XML processing lets an unauthenticated attacker with network access to the management web or dataplane interface cause DoS on VM-Series or execute arbitrary code as root on PA-Series hardware firewalls. Upgrade to the fixed PAN-OS / Prisma Access builds for your train.
Last observed Sep 10, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
AWS postgres MCP read-only denylist missed set_config()
AWS says awslabs postgres-mcp-server before 1.1.7 has incomplete SQL input validation that can let crafted SQL embedded in submitted content modify data beyond the intended read-only scope when an authenticated user interacts with the MCP server. AWS fixed CVE-2026-85787 in version 1.1.7.
Last observed Sep 8, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordhigh severity
Fastify-cli debug-host bind can expose Inspector RCE
fastify-cli debug-host bind can expose Node Inspector and enable RCE. Upgrade to the patched release.
Last observed Sep 8, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Magento still needs APSB26-138 after the StyleSmuggler hotfix
Adobe Commerce / Magento still needs APSB26-138 authorization fixes after the StyleSmuggler hotfix. Apply the bulletin.
Last observed Sep 8, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Adobe Commerce StyleSmuggler template RCE (unauth)
Adobe Commerce / Magento Open Source are affected by improper neutralization of special elements in a template engine (CWE-1336) that can lead to arbitrary code execution. Exploitation does not require authentication per Adobe's advisory. Apply APSB26-146 and the patched Commerce/Magento builds.
Last observed Sep 7, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
FreeIPA unauthenticated LDAP client can become admin
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this to obtain FreeIPA administrator-group membership.
Last observed Sep 7, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
OpenMAIC unauth SSRF can pull cloud credentials via IMDS
OpenMAIC before 1.0.1 skips SSRF validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services via x-base-url / baseUrl. Fixed in 1.0.1.
Last observed Sep 6, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
libpcap crafted BPF filters can walk process memory
Crafted BPF filters can cause libpcap to walk process memory (rpcap / filter handling). Operators should upgrade to the fixed libpcap release cited by the vendor/NVD for their train.
Last observed Sep 5, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Fastify malformed URLs can skip not-found auth
Fastify before 5.12.2 can let malformed URLs reach encapsulated not-found handlers and skip intended authentication. Upgrade to 5.12.2.
Last observed Sep 4, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Nango runner missing auth lets remote callers run code
Nango before 0.71.6 is missing authentication on the runner tRPC server, allowing anyone who can reach the runner to execute code. Fixed in 0.71.6.
Last observed Sep 4, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Fastify middie absolute-form requests can skip auth
@fastify/middie before 9.3.4 allows absolute-form requests to skip path-scoped middleware auth. Upgrade to 9.3.4.
Last observed Sep 4, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Chrome V8 type confusion exploited in the wild
Google reports a Chrome V8 type-confusion vulnerability (CVE-2026-85046) as exploited in the wild. CISA KEV listed. Upgrade Chrome to the patched stable build (152.0.7977.82 or matching channel).
Last observed Sep 3, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Undici WebSocket deflate bug can crash the Node process
Undici WebSocket permessage-deflate handling can crash the Node process. Upgrade to the patched release.
Last observed Sep 3, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Ollama model pulls can SSRF internal hosts via blob redirects
Ollama 0.30.0 through 0.33.2 can follow cross-host tensor blob redirects during model pulls, enabling SSRF into internal hosts. Ollama v0.34.2 adds redirect-target validation to the tensor transfer path; upgrade to 0.34.2 or later.
Last observed Sep 3, 2026 · Reviewed Sep 21, 2026
Read the campaign record - Historical recordhigh severity
Hermes Agent runs Git config before the first prompt (RCE)
Hermes Agent runs Git config before the first prompt, enabling RCE. Upgrade to the patched release.
Last observed Sep 2, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
JFrog Artifactory unauth admin on default config
Self-hosted JFrog Artifactory on vulnerable trains can allow unauthenticated administrative access under default configuration conditions. CISA marked CVE-2026-82329 as actively exploited and added it to KEV on 2026-09-02. Upgrade to the fixed build for your train.
Last observed Sep 2, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordhigh severity
One Rancher annotation copies another cluster's secrets
Rancher cross-cluster project secret leak via annotation. Upgrade to the patched release.
Last observed Sep 1, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Redis TLS pending-list use-after-free (public RCE PoC)
Redis TLS pending-list use-after-free. Upgrade to the patched release.
Last observed Aug 31, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
TeamViewer Linux chat link command injection
TeamViewer Linux chat link command injection. Upgrade to the patched release.
Last observed Aug 30, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
WatchGuard Fireware iked type-confusion on IKE_AUTH
WatchGuard Fireware iked is affected by a pre-authentication type-confusion on IKE_AUTH. Upgrade to patched Fireware builds.
Last observed Aug 28, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
PaperCut NG/MF unauth admin config plus class-loading
PaperCut NG/MF is affected by an unauthenticated admin configuration path combined with class-loading risk. Apply vendor patches promptly.
Last observed Aug 28, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
OpenSSL CMS decrypt writes past the unwrap buffer
OpenSSL CMS decrypt unwrap heap overflow. Upgrade to the patched release.
Last observed Aug 25, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Chainlit MCP stdio unauthenticated RCE
Chainlit versions from 2.4.0rc0 through 2.11.1 are affected by CVE-2026-45018 when features.mcp.enabled is true. The stdio MCP path can allow unauthenticated remote command execution. Chainlit rates the issue Critical at CVSS 9.8 and identifies 2.12.0 as the fixed release in the advisory details.
Last observed Aug 25, 2026 · Reviewed Sep 22, 2026
Read the campaign record - Historical recordcritical severity
Next.js unauth RCE in image optimization on Windows servers
Next.js image optimization on affected configurations (including Windows servers) can allow unauthenticated remote code execution. Upgrade to patched releases.
Last observed Aug 25, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Apache Hive HiveServer2 SAML bearer impersonation
Apache Hive HiveServer2 SAML bearer impersonation. Upgrade to the patched release.
Last observed Aug 25, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Vault privilege escalation via slash injection in templated policy paths
Vault privilege escalation via slash injection in templated policy paths. Upgrade to the patched release.
Last observed Aug 24, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
fast-uri SSRF via repeated hostname decoding
fast-uri SSRF via repeated hostname decoding. Upgrade to the patched release.
Last observed Aug 24, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Grafana MCP server SSRF via caller-controlled URL headers
Grafana MCP before 1.1.0 allows callers who can invoke grafana_api_request to use X-Grafana-URL to redirect outbound requests to internal, loopback, or link-local services and read the responses. Grafana rates CVE-2026-19516 Critical at CVSS 9.1 and fixes it in 1.1.0 and later.
Last observed Aug 21, 2026 · Reviewed Oct 5, 2026
Read the campaign record - Historical recordhigh severity
OpenSearch Dashboards TSVB prototype pollution RCE
OpenSearch Dashboards TSVB prototype pollution RCE. Upgrade to the patched release.
Last observed Aug 21, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Frontend Admin WordPress unauthenticated admin takeover
Frontend Admin for WordPress allows unauthenticated admin takeover on affected versions. Patch or remove promptly.
Last observed Aug 19, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
Agno PythonTools path traversal escapes base_dir
Agno PythonTools path traversal escapes base_dir. Upgrade to the patched release.
Last observed Aug 19, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
SiYuan template calculation RCE in desktop client
SiYuan desktop client template calculation is affected by an RCE vulnerability. Upgrade to the patched release.
Last observed Aug 18, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
SiYuan basic-auth lockout bypass enables admin brute force
SiYuan basic-auth lockout can be bypassed, enabling admin credential brute force. Upgrade to the patched release.
Last observed Aug 18, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Pandora TAR path traversal enables arbitrary file write
Pandora is affected by a TAR path traversal that can enable arbitrary file write. Upgrade to the patched release.
Last observed Aug 18, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
Pods WordPress Plugin Unauthenticated Admin Takeover
Pods WordPress Plugin Unauthenticated Admin Takeover. See NVD and the HOL operator write-up for impact, affected products, and remediation.
Last observed Aug 16, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
@fastify/multipart aborted upload DoS
@fastify/multipart aborted uploads can cause denial of service. Upgrade to the patched release.
Last observed Aug 16, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
@fastify/jwt key override authorization bypass
@fastify/jwt is affected by a key-override authorization bypass. Upgrade to the patched release.
Last observed Aug 15, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordcritical severity
@fastify/oauth2 login CSRF via plantable state cookies
@fastify/oauth2 is affected by login CSRF via plantable state cookies. Upgrade to the patched release.
Last observed Aug 15, 2026 · Reviewed Sep 20, 2026
Read the campaign record - Historical recordhigh severity
OpenWrt luci-app-lxc ACL bypass to root code execution
OpenWrt luci-app-lxc ACL bypass to root code execution. Upgrade to the patched release.
Last observed Aug 14, 2026 · Reviewed Sep 20, 2026
Read the campaign record
JSON feed of active campaignsActive-campaign dataset (JSON)Security hub RSS
Campaign questions, answered
A reviewed longitudinal record of one attacker campaign against AI agents and their tooling: what happened and when, which artifacts and indicators were reviewed, what Guard coverage exists, where the evidence is uncertain, and every primary source behind the claims.
Every record passes source verification against tier-1 primary sources, agent-relevance review, editorial review, and security review. Indicators are defanged before publication, and each claim stays traceable to its cited sources.
Publication is permanent by design. When active tracking ends, the record stays at its URL as labeled historical research instead of disappearing, so incident retrospectives and citations keep resolving.
Each record exports a JSON record, an artifact CSV, and a STIX 2.1 bundle from its own page. The collection additionally offers a JSON feed of active campaigns and the security hub RSS.
When the next campaign lands, respond with reviewed policy
Turn campaign guidance into emergency policy starting points, then let Guard enforce them locally before anything executes.