Threat Watch– active
Live incidents
Incident archive
Every exploited vulnerability, breach and supply chain attack Threat Watch has logged, grouped by the day it started. Each date opens that day's log.
2,909 incidents, newest first. Page 2 of 30. 100 incidents from 22 September 2026 to 21 October 2026.
21 October 2026
- Node.js: October 2026 security releases fix DNS truncation, TLS hostname bypasses, Brotli RCE and HTTP keep-alive flaws (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074) High · Patch now
- pypdf: Crafted PDFs with repeated malformed cross-reference entries cause long runtimes / DoS (CVE-2026-115585) High · Patch now
- Cisco IOS XR (ASR 9000/9900 Series): crafted IPv4 packets can reset or shut down line card network processors, causing DoS (CVE-2026-76505) High · Patch now
- Cisco Secure Client Secure Firewall Posture module: local privilege escalation via crafted IPC messages (CVE-2026-76462) High · Patch now
20 October 2026
- Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173) Critical · Patch now
- Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280) Critical · Patch now
- Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.) Critical · Patch now
- ChromeOS / ChromeOS Flex: Stable channel update fixes critical and high kernel/browser vulnerabilities (CVE-2026-106200) High · Patch now
- Happy DOM: unsanitized ESM import alias enables host code execution (CVE-2026-115895) High · Patch now
- Atlassian: October bulletin patches 75 third-party CVEs across Data Center and Server products (multiple CVEs incl. CVE-2026-65637, CVE-2026-65182, CVE-2026-68525, CVE-2026-58062, CVE-2026-75595, CVE-2026-77185) High · Patch now
- EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (CVE-2026-106931) High · Patch now
- Plex Media Server External Control of File Name or Path Vulnerability (CVE-2026-96656) High · Patch now
- Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96652) Medium · Patch now
- Frontier Communications: $625,000 Connecticut settlement over April 2024 RansomHub ransomware data breach Medium · Breach
- Parkview Health patient portal outage after suspected cyber incident Medium · Breach
- Welsh ransomware breach: Ogi Networks & Data Cymru — weak passwords led to theft of 3,300 children's records (no CVE) Medium · Breach
- Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96655) Medium · Patch now
- Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVE-2026-96654) Medium · Patch now
- Siemens Software Center Uncontrolled Search Path Element Vulnerability (CVE-2026-110936) Medium · Patch now
19 October 2026
- Wasmtime: two critical Cranelift sandbox-escape flaws let malicious Wasm modules break out (CVE-2026-115889, CVE-2026-115893) Critical · Patch now
- OVHcloud CLI: GitHub release binaries swapped with GlassWorm credential stealer (no CVE) Critical · Supply chain
- Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509) Critical · Patch now
- OpenCode: Malicious MCP servers can execute PowerShell commands during OAuth sign-in on Windows/WSL (no CVE assigned) Critical · Patch now
- Capcom: breach of CAPCOM ID service exposes 11.7 million email addresses and account details Medium · Breach
18 October 2026
- OpenCode distillation attack breach — OpenCode Console users with linked AI providers had credentials exposed; attacker can run inference on victim accounts (no CVE) High · Breach
- postal-mime: Quadratic CPU DoS when decoding headers with many joinable RFC 2047 base64 encoded words (no CVE) High · Patch now
17 October 2026
- PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619) Critical · Patch now
- TeamUpdraft (UpdraftPlus/UpdraftCentral): website breach exposed connection keys used to install backdoor plugins on WordPress sites (no CVE) Critical · Breach
- Rank Math SEO PRO 3.0.123: malware distributed in some downloads via compromised update channel (Oct 15–16, 2026) High · Supply chain
- Pillow: decompression bomb check bypass in SpiderImagePlugin.seek() enables multi-GB allocation DoS (CVE-2026-96637) High · Patch now
- filelock: local attacker can plant symlinks/journal files to overwrite or unlink lock user's files via SQLite-backed ReadWriteLock (CVE-2026-112940) High · Patch now
- Pillow: four high-severity DoS/memory-safety flaws in PDF append, TarIO, PNG eXIf, and WMF/EMF rendering (CVE-2026-96640, CVE-2026-96642) High · Patch now
- Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8) High · Supply chain
- BCHP / XTIUM 2024 healthcare data breach — $2.7M NY/CT settlement Medium · Breach
16 October 2026
- Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999) Critical · Patch now
- Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393) Critical · Patch now
- BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764) Critical · Patch now
- Bullhorn: Cyberattack forced recruitment platform offline with possible data theft (no CVE) High · Breach
- @azure/msal-node: authorization code flow may disclose auth parameters to attacker-controlled endpoint (CVE-2026-109461) High · Patch now
- n8n creators portal: templates still in review were readable without logging in Medium · Breach
- Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624) Medium · Patch now
- State Bank of India: 3,897 customer records with personal data found on dark web in ~375,000-record leak Medium · Breach
15 October 2026
- Google Chrome: Extended Stable update fixes 10 security flaws including two critical CVEs (CVE-2026-110151, CVE-2026-110922) Critical · Patch now
- Lightning AI: unauthorized access to credentials forced the Studio platform offline High · Breach
- undici: fetch() DoS via unhandled error on excessive content-encodings (CVE-2026-109869) High · Patch now
- Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589) High · Patch now
14 October 2026
- Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519) Critical · Patch now
- Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134) Critical · Patch now
- Next.js: Unauthenticated RCE in Image Optimization API via sharp memory vulnerability when SVG files are used (CVE-2026-96889) Critical · Patch now
- Next.js: Unauthenticated RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr) Critical · Patch now
- PAN-OS: Authenticated RCE in Management Interface Allows Root Code Execution (CVE-2026-0322) High · Patch now
- Next.js: Denial of Service in App Router using Server Actions (CVE-2026-94482) High · Patch now
- GitPython: submodule path validated after clone lets attacker plant executable git hooks (CVE-2026-114145) High · Patch now
- Ahsay AhsayCBS Improper Authentication Vulnerability (CVE-2026-105133) High · Patch now
13 October 2026
- October 2026 Patch Tuesday: Microsoft — record 1,413+ CVE batch incl. two zero-days, Outlook RCE, iSCSI/RDP RCEs, SharePoint EoP/XSS, Visio RCE Critical · Patch now
- Fortinet FortiSandbox: two authentication bypass flaws in GUI and Fabric API allow unauthenticated attackers to access the management interface and API endpoints (CVE-2026-107656, CVE-2026-106172) Critical · Patch now
- Fortinet: four advisories including unauthenticated path traversal RCE in FortiSIEM phQueryMaster (CVE-2026-106173) Critical · Patch now
- Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935) High · Patch now
- Microsoft Windows Command Injection Vulnerability (CVE-2026-96951) High · Patch now
- Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2026-87695) Medium · Patch now
12 October 2026
- DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive in shadow root content on DOM output modes (GHSA-cg2g-xh64-v4q7) Critical · Patch now · Closed
- nbconvert: Arbitrary file write via path traversal in cell output filenames when exporting notebooks (CVE-2026-114140) High · Patch now · Closed
- Storybook: dev server exposes WebSocket auth token to LAN peers, enabling code injection and potential RCE on developer machines (CVE-2026-114126) High · Patch now · Closed
- Ahold Delhaize: cyberattack forced IT systems, websites and apps offline across US and European brands (no CVE) High · Breach · Closed
10 October 2026
- LiteLLM: malicious 1.107.0 release on PyPI/Docker steals credentials and includes dormant C2 Critical · Supply chain · Closed
- ConnectWise Cloud Backup: Storm-0940 (China-linked) used stolen app credentials and AI pentest tool ARTEX to access 2,250+ Microsoft 365 tenants Critical · Supply chain · Closed
- Black: GitHub Action installs unvalidated required-version from pyproject.toml enabling RCE (CVE-2026-114134) High · Supply chain · Closed
9 October 2026
- Neogen data breach: 435K accounts exposed Medium · Breach · Closed
8 October 2026
- ONLYOFFICE Docs Server Path Traversal Vulnerability (CVE-2021-3199) Critical · Patch now · Closed
- ProFTPD Improper Access Control Vulnerability (CVE-2015-3306) Critical · Patch now · Closed
- ISC BIND Data Processing Errors Vulnerability (CVE-2015-5477) High · Patch now · Closed
- Apache Struts Command Injection Vulnerability (CVE-2016-3081) High · Patch now · Closed
- Strapi Cleartext Storage of Sensitive Information Vulnerability (CVE-2023-22894) Medium · Patch now · Closed
7 October 2026
- Splunk Enterprise: unauthenticated Patroni REST API flaw allows OS command execution on search head cluster members (CVE-2026-76268) Critical · Patch now · Closed
- Cisco Meraki: Critical hardening release fixes 7 internally discovered vulnerability groups across MG, MR, MS, MV, MX and Campus Gateways (CVE-2026-76463 et al.) Critical · Patch now · Closed
- Angel One data breach: 6.8M accounts exposed High · Breach · Closed
- Double Counter data breach: 274K accounts exposed Medium · Breach · Closed
- CyrusOne data breach: 373K accounts exposed Medium · Breach · Closed
6 October 2026
- SonicWall SMA 1000: Actively exploited max-severity SSRF in WorkPlace interface allows unauthenticated attackers to reach internal services (CVE-2026-102255) Critical · Patch now · Closed
- Django REST framework: JSONParser applies attacker-named codec to request stream, defeating DATA_UPLOAD_MAX_MEMORY_SIZE (CVE-2026-114136) High · Patch now · Closed
- Django REST framework: unauthenticated CPU-exhaustion DoS via crafted Accept header and silent token revocation failure (CVE-2026-114138, CVE-2026-114137) High · Patch now · Closed
4 October 2026
2 October 2026
- Zammad GmbH Zammad Session Fixation Vulnerability (CVE-2026-102489) Critical · Patch now · Closed
- Zammad GmbH Zammad Improper Privilege Management Vulnerability (CVE-2026-102490) High · Patch now · Closed
1 October 2026
- Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) Critical · Patch now · Closed
30 September 2026
- Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (CVE-2026-76504) Critical · Patch now · Closed
- @graphql-tools/utils: Prototype pollution in mergeIncrementalResult lets a malicious upstream GraphQL response write to Object.prototype (CVE-2026-114604) High · Patch now · Closed
- Medela data breach: 423K accounts exposed High · Breach · Closed
29 September 2026
- Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950) High · Patch now · Closed
27 September 2026
- Citrix NetScaler ADC/Gateway zero-days: two pre-auth RCEs exploited since early September, plus an exploited SAML flaw (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779) Critical · Patch now · Closed
- Citrix NetScaler Improper Input Validation Vulnerability (CVE-2026-88771) Critical · Patch now · Closed
- Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88772) High · Patch now · Closed
25 September 2026
- Microsoft SharePoint Code Injection Vulnerability (CVE-2026-65660) High · Patch now · Closed
- WordPress Core Remote File Inclusion Vulnerability (CVE-2026-87902) High · Patch now · Closed
- Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVE-2026-67279) Medium · Patch now · Closed
24 September 2026
- WSO2 Multiple Products Path Traversal Vulnerability (CVE-2026-5430) Critical · Patch now · Closed
- Adobe Commerce and Magento Incorrect Authorization Vulnerability (CVE-2026-71362) Critical · Patch now · Closed
- @sentry/nextjs: Middleware bypass via tunnelRoute lets requests skip authorization middleware (CVE-2026-114139) Critical · Patch now · Closed
23 September 2026
22 September 2026
- Arista VeloCloud Orchestrator Improper Input Validation Vulnerability (CVE-2026-93952) Critical · Patch now · Closed