{"category":"patch","changes":[{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.wiz.io/blog/php2shell-php-rce","status":"live","title":"Wiz publishes analysis of PHP2Shell: AI-uncovered critical PHP engine RCE and Heartbleed-style memory disclosure affecting ~70% of the Internet","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","incidentTitle":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Open%20Source%20Snort%203%20Control%20Channel%20Socket%20Arbitrary%20Command%20Execution%20Vulnerability%26vs_k=1","status":"live","title":"Open Source Snort 3 control channel socket allows low-privilege local arbitrary command execution (CVE-2026-76524)","url":"https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-186","status":"live","title":"Fortinet PSIRT details PHP core RCE patches for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.8)","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466","incidentTitle":"Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Information%20Disclosure%20Vulnerability%26vs_k=1","status":"live","title":"Cisco Expressway Series hardening batch adds unauthenticated information disclosure via MRA provisioning (CVE-2026-76435)","url":"https://helix.ml/threat-watch/i/cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo","incidentTitle":"Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Manager%20Improper%20Access%20Control%20Vulnerability%26vs_k=1","status":"live","title":"October 2026 UC hardening release also fixes Unified CM/Unified CM SME improper access control flaw (CVE-2026-76487)","url":"https://helix.ml/threat-watch/i/cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-secure-email-gateway-cve-2026-76519","incidentTitle":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519)","kind":"advisory","patchStatus":"unknown","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20Arbitrary%20File%20Write%20Vulnerability%26vs_k=1","status":"live","title":"Cisco publishes dedicated advisory for Secure Email Gateway arbitrary file write via AMP attachment handling (CVE-2026-76519)","url":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-cve-2026-76519"},{"body":null,"category":"patch","date":"2026-10-25","incident":"gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264","incidentTitle":"GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","status":"live","title":"GitLab critical patch release 19.5.1/19.4.3/19.3.6/19.2.9/19.1.9/19.0.10/18.11.13 includes fixes for CVE-2026-110264 and CVE-2026-112212","url":"https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html","status":"live","title":"New interview details confirm PHP2Shell exploitation began four days before public disclosure","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry","status":"live","title":"PHP2Shell exploitation attempts and leaked details trigger industry-wide red alert remediation","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"beyondtrust-remote-support-cve-2026-102764","incidentTitle":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs","status":"live","title":"BeyondTrust Remote Support CVE-2026-102764 zero-day reported under active exploitation","url":"https://helix.ml/threat-watch/i/beyondtrust-remote-support-cve-2026-102764"},{"body":null,"category":"patch","date":"2026-10-25","incident":"ivanti-connect-secure-cve-2026-104935","incidentTitle":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching","status":"live","title":"Ivanti ICS CVE-2026-104935 authentication bypass/RCE zero-day under active exploitation after partial July patch","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-cve-2026-104935"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://therecord.media/php-php2shell-exploitation-attempts-pocs","status":"live","title":"PHP2Shell exploitation attempts grow; exposure extends to bundled runtimes, containers and hosted apps","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20","incidentTitle":"Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-5x8w-8jj5-q52h","status":"live","title":"New Pillow heap buffer overflow in FlashPix (FPX) JPEG-tile decoding enables code execution via crafted image files (CVE-2026-112398)","url":"https://helix.ml/threat-watch/i/pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html","status":"live","title":"PHP releases 14:00 UTC patch for PHP2Shell flaws as exploits are already public and experts warn the suggested workaround setting is insufficient","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"palo-alto-networks-pan-os-cve-2026-0322","incidentTitle":"Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226","status":"live","title":"Unit 42 reports PAN-OS compromises attacked by multiple ransomware groups since June","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0322"},{"body":null,"category":"patch","date":"2026-10-25","incident":"collabora-collabora-online-built-in-code-server-cve-2026-110447","incidentTitle":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://securityaffairs.com/201652/security/u-s-cisa-adds-collabora-online-flaw-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Collabora Online CVE-2026-110447 to Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","incidentTitle":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Visual%20Basic%20for%20Applications%20Buffer%20Overflow%20Denial%20of%20Service%20Vulnerability%26vs_k=1","status":"live","title":"Cisco discloses four additional Snort 3 denial-of-service vulnerabilities (CVE-2026-20218, CVE-2026-76445, CVE-2026-20221, CVE-2026-20011) affecting multiple products","url":"https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497","status":"live","title":"Node2Shell evolves to HTTP2Shell: CVE-2026-111497 blast radius extends to libraries/apps using HTTP with Brotli","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","status":"live","title":"Node2Shell: Node.js Brotli flaw CVE-2026-111497 enables remote code execution","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/373","status":"live","title":"Brotli v1.2.1 released fixing CVE-2026-111497; downstream releases tracked via patchtheplanet","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","status":"live","title":"Node2Shell Brotli flaw (CVE-2026-111497) expands to HTTP2Shell, affecting libraries and apps using HTTP with Brotli","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html","status":"live","title":"PHP ships out-of-cycle emergency patches (8.5.12, 8.4.27, 8.3.36, 8.2.35) for PHP2Shell as exploit attempts emerge","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-109618-cve-2026-109619/","status":"live","title":"NodeZero releases Rapid Response check for PHP2Shell (CVE-2026-109618/CVE-2026-109619)","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg","incidentTitle":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive in shadow root content on DOM output modes (GHSA-cg2g-xh64-v4q7)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-mrv2-3pqr-j5jr","status":"live","title":"New DOMPurify IN_PLACE incomplete-fix bypass (GHSA-mrv2-3pqr-j5jr) leaves detached subtree event handlers armed after hook removes parent/sibling","url":"https://helix.ml/threat-watch/i/dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg"},{"body":null,"category":"patch","date":"2026-10-25","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625, CVSS 9.4) to its Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html","status":"live","title":"PHP warns of new code execution flaw CVE-2026-115560 (session upload progress) days after PHP2Shell patches; no emergency fix, mitigation is disabling session upload progress","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html","status":"live","title":"Node2Shell PoC shows Brotli decoder OOB write (CVE-2026-111497) enables RCE on official Node.js builds and also affects Bun, Python brotli/brotlicffi, and Envoy","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"plex-media-server-cve-2026-96652","incidentTitle":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96652)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html","status":"live","title":"CISA adds Plex2Shell Plex Media Server vulnerabilities to KEV catalog citing active exploitation","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96652"},{"body":null,"category":"patch","date":"2026-10-25","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/","status":"live","title":"Attackers actively exploit third Arista VCO zero-day SQL injection flaw to gain operator privileges","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-25","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"patch","patchStatus":"unknown","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html","status":"live","title":"Arista confirms active exploitation of VeloCloud Orchestrator zero-day and releases patches","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-25","incident":"collabora-collabora-online-built-in-code-server-cve-2026-110447","incidentTitle":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html","status":"live","title":"CISA adds Collabora Online CODE Server CVE-2026-110447 to KEV citing active exploitation","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447"},{"body":null,"category":"patch","date":"2026-10-23","incident":"collabora-collabora-online-built-in-code-server-cve-2026-110447","incidentTitle":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-110447","status":"live","title":"CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 26, 2026)","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447"},{"body":null,"category":"patch","date":"2026-10-23","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-114625","status":"live","title":"CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 26, 2026)","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-22","incident":"x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat","incidentTitle":"x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html","status":"live","title":"x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)","url":"https://helix.ml/threat-watch/i/x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat"},{"body":null,"category":"patch","date":"2026-10-22","incident":"mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324","incidentTitle":"mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7587-9684-52r6","status":"live","title":"mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)","url":"https://helix.ml/threat-watch/i/mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324"},{"body":null,"category":"patch","date":"2026-10-22","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","status":"live","title":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-22","incident":"pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026","incidentTitle":"Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v9pv-5gc8-w2m6","status":"live","title":"Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)","url":"https://helix.ml/threat-watch/i/pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026"},{"body":null,"category":"patch","date":"2026-10-21","incident":"cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466","incidentTitle":"Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1","status":"live","title":"Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)","url":"https://helix.ml/threat-watch/i/cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466"},{"body":null,"category":"patch","date":"2026-10-21","incident":"cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo","incidentTitle":"Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Products%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","status":"live","title":"Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)","url":"https://helix.ml/threat-watch/i/cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo"},{"body":null,"category":"patch","date":"2026-10-21","incident":"gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264","incidentTitle":"GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html","status":"live","title":"GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)","url":"https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264"},{"body":null,"category":"patch","date":"2026-10-21","incident":"cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","incidentTitle":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","status":"live","title":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","url":"https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl"},{"body":null,"category":"patch","date":"2026-10-21","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","status":"live","title":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-20","incident":"apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling","incidentTitle":"Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/374","status":"live","title":"Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)","url":"https://helix.ml/threat-watch/i/apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling"},{"body":null,"category":"patch","date":"2026-10-20","incident":"fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv","incidentTitle":"Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html","status":"live","title":"Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)","url":"https://helix.ml/threat-watch/i/fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv"},{"body":null,"category":"patch","date":"2026-10-20","incident":"chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1","incidentTitle":"Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","status":"live","title":"Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)","url":"https://helix.ml/threat-watch/i/chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1"},{"body":null,"category":"patch","date":"2026-10-20","incident":"siemens-software-center-cve-2026-110936","incidentTitle":"Siemens Software Center Uncontrolled Search Path Element Vulnerability (CVE-2026-110936)","kind":"exploitation","patchStatus":"patched","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-110936","status":"live","title":"CISA added CVE-2026-110936 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 3, 2026)","url":"https://helix.ml/threat-watch/i/siemens-software-center-cve-2026-110936"},{"body":null,"category":"patch","date":"2026-10-20","incident":"plex-media-server-cve-2026-96652","incidentTitle":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96652)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96652","status":"live","title":"CISA added CVE-2026-96652 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 3, 2026)","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96652"},{"body":null,"category":"patch","date":"2026-10-20","incident":"plex-media-server-cve-2026-96654","incidentTitle":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVE-2026-96654)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96654","status":"live","title":"CISA added CVE-2026-96654 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96654"},{"body":null,"category":"patch","date":"2026-10-20","incident":"plex-media-server-cve-2026-96655","incidentTitle":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96655)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96655","status":"live","title":"CISA added CVE-2026-96655 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 3, 2026)","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96655"},{"body":null,"category":"patch","date":"2026-10-20","incident":"plex-media-server-cve-2026-96656","incidentTitle":"Plex Media Server External Control of File Name or Path Vulnerability (CVE-2026-96656)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96656","status":"live","title":"CISA added CVE-2026-96656 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96656"},{"body":null,"category":"patch","date":"2026-10-20","incident":"eg-secure-solutions-siteguard-server-edition-cve-2026-106931","incidentTitle":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (CVE-2026-106931)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-106931","status":"live","title":"CISA added CVE-2026-106931 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)","url":"https://helix.ml/threat-watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931"},{"body":null,"category":"patch","date":"2026-10-19","incident":"wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889","incidentTitle":"Wasmtime: Cranelift bit-packing overflow enables sandbox escape via crafted Wasm module (CVE-2026-115889)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","status":"live","title":"Wasmtime: Cranelift bit-packing overflow enables sandbox escape via crafted Wasm module (CVE-2026-115889)","url":"https://helix.ml/threat-watch/i/wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889"},{"body":null,"category":"patch","date":"2026-10-19","incident":"linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999","incidentTitle":"Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.theregister.com/virtualization/2026/10/19/linux-kvm-guest-host-escape-rated-critical-may-represent-a-new-way-to-attack-penguin-powered-networking/5303744","status":"live","title":"Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999)","url":"https://helix.ml/threat-watch/i/linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999"},{"body":null,"category":"patch","date":"2026-10-19","incident":"laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509","incidentTitle":"Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","status":"live","title":"Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)","url":"https://helix.ml/threat-watch/i/laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509"},{"body":null,"category":"patch","date":"2026-10-16","incident":"pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20","incidentTitle":"Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html","status":"live","title":"Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)","url":"https://helix.ml/threat-watch/i/pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20"},{"body":null,"category":"patch","date":"2026-10-16","incident":"fortinet-multiple-products-cve-2025-61624","incidentTitle":"Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624","status":"live","title":"CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 19, 2026)","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-61624"},{"body":null,"category":"patch","date":"2026-10-16","incident":"beyondtrust-remote-support-cve-2026-102764","incidentTitle":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764","status":"live","title":"CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 19, 2026)","url":"https://helix.ml/threat-watch/i/beyondtrust-remote-support-cve-2026-102764"},{"body":null,"category":"patch","date":"2026-10-15","incident":"google-chrome-extended-stable-update-fixes-10-security-flaws-including-two-critical-cves-cve-2026-110151-cve-2026-110922","incidentTitle":"Google Chrome: Extended Stable update fixes 10 security flaws including two critical CVEs (CVE-2026-110151, CVE-2026-110922)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"http://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_01598036246.html","status":"live","title":"Google Chrome: Extended Stable update fixes 10 security flaws including two critical CVEs (CVE-2026-110151, CVE-2026-110922)","url":"https://helix.ml/threat-watch/i/google-chrome-extended-stable-update-fixes-10-security-flaws-including-two-critical-cves-cve-2026-110151-cve-2026-110922"},{"body":null,"category":"patch","date":"2026-10-15","incident":"atlassian-multiple-products-cve-2026-21589","incidentTitle":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589","status":"live","title":"CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 18, 2026)","url":"https://helix.ml/threat-watch/i/atlassian-multiple-products-cve-2026-21589"},{"body":null,"category":"patch","date":"2026-10-14","incident":"next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr","incidentTitle":"Next.js: Unauthenticated RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-673q-mjm6-r5xr","status":"live","title":"Next.js: Unauthenticated RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr)","url":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr"},{"body":null,"category":"patch","date":"2026-10-14","incident":"next-js-unauthenticated-rce-in-image-optimization-api-via-sharp-memory-vulnerability-when-svg-files-are-used-cve-2026-96","incidentTitle":"Next.js: Unauthenticated RCE in Image Optimization API via sharp memory vulnerability when SVG files are used (CVE-2026-96889)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","status":"live","title":"Next.js: Unauthenticated RCE in Image Optimization API via sharp memory vulnerability when SVG files are used (CVE-2026-96889)","url":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-image-optimization-api-via-sharp-memory-vulnerability-when-svg-files-are-used-cve-2026-96"},{"body":null,"category":"patch","date":"2026-10-14","incident":"palo-alto-networks-pan-os-cve-2026-0322","incidentTitle":"Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322","status":"live","title":"CISA added CVE-2026-0322 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0322"},{"body":null,"category":"patch","date":"2026-10-14","incident":"ahsay-ahsaycbs-cve-2026-105133","incidentTitle":"Ahsay AhsayCBS Improper Authentication Vulnerability (CVE-2026-105133)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-105133","status":"live","title":"CISA added CVE-2026-105133 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)","url":"https://helix.ml/threat-watch/i/ahsay-ahsaycbs-cve-2026-105133"},{"body":null,"category":"patch","date":"2026-10-14","incident":"cisco-secure-email-gateway-cve-2026-76519","incidentTitle":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76519","status":"live","title":"CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)","url":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-cve-2026-76519"},{"body":null,"category":"patch","date":"2026-10-14","incident":"ahsay-ahsaycbs-cve-2026-105134","incidentTitle":"Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-105134","status":"live","title":"CISA added CVE-2026-105134 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)","url":"https://helix.ml/threat-watch/i/ahsay-ahsaycbs-cve-2026-105134"},{"body":null,"category":"patch","date":"2026-10-13","incident":"fortinet-fortisandbox-two-authentication-bypass-flaws-in-gui-and-fabric-api-allow-unauthenticated-attackers-to-access-th","incidentTitle":"Fortinet FortiSandbox: two authentication bypass flaws in GUI and Fabric API allow unauthenticated attackers to access the management interface and API endpoints (CVE-2026-107656, CVE-2026-106172)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-185","status":"live","title":"Fortinet FortiSandbox: two authentication bypass flaws in GUI and Fabric API allow unauthenticated attackers to access the management interface and API endpoints (CVE-2026-107656, CVE-2026-106172)","url":"https://helix.ml/threat-watch/i/fortinet-fortisandbox-two-authentication-bypass-flaws-in-gui-and-fabric-api-allow-unauthenticated-attackers-to-access-th"},{"body":null,"category":"patch","date":"2026-10-13","incident":"microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","incidentTitle":"Microsoft: October 2026 Patch Tuesday fixes 1,413 CVEs incl. two zero-days, one actively exploited (CVE-2026-96951, CVE-2026-108398)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102208","status":"live","title":"Microsoft: October 2026 Patch Tuesday fixes 1,413 CVEs incl. two zero-days, one actively exploited (CVE-2026-96951, CVE-2026-108398)","url":"https://helix.ml/threat-watch/i/microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026"},{"body":null,"category":"patch","date":"2026-10-13","incident":"microsoft-windows-cve-2026-96951","incidentTitle":"Microsoft Windows Command Injection Vulnerability (CVE-2026-96951)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","status":"live","title":"CISA added CVE-2026-96951 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 16, 2026)","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-96951"},{"body":null,"category":"patch","date":"2026-10-13","incident":"ivanti-connect-secure-cve-2026-104935","incidentTitle":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104935","status":"live","title":"CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 16, 2026)","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-cve-2026-104935"},{"body":null,"category":"patch","date":"2026-10-12","incident":"dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg","incidentTitle":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive in shadow root content on DOM output modes (GHSA-cg2g-xh64-v4q7)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7","status":"live","title":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive in shadow root content on DOM output modes (GHSA-cg2g-xh64-v4q7)","url":"https://helix.ml/threat-watch/i/dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg"},{"body":null,"category":"patch","date":"2026-10-08","incident":"proftpd-proftpd-cve-2015-3306","incidentTitle":"ProFTPD Improper Access Control Vulnerability (CVE-2015-3306)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306","status":"closed","title":"CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/proftpd-proftpd-cve-2015-3306"},{"body":null,"category":"patch","date":"2026-10-08","incident":"onlyoffice-docs-cve-2021-3199","incidentTitle":"ONLYOFFICE Docs Server Path Traversal Vulnerability (CVE-2021-3199)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3199","status":"closed","title":"CISA added CVE-2021-3199 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/onlyoffice-docs-cve-2021-3199"},{"body":null,"category":"patch","date":"2026-10-08","incident":"strapi-strapi-cve-2023-22894","incidentTitle":"Strapi Cleartext Storage of Sensitive Information Vulnerability (CVE-2023-22894)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22894","status":"closed","title":"CISA added CVE-2023-22894 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/strapi-strapi-cve-2023-22894"},{"body":null,"category":"patch","date":"2026-10-08","incident":"apache-struts-cve-2016-3081","incidentTitle":"Apache Struts Command Injection Vulnerability (CVE-2016-3081)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081","status":"closed","title":"CISA added CVE-2016-3081 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/apache-struts-cve-2016-3081"},{"body":null,"category":"patch","date":"2026-10-08","incident":"isc-bind-cve-2015-5477","incidentTitle":"ISC BIND Data Processing Errors Vulnerability (CVE-2015-5477)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5477","status":"closed","title":"CISA added CVE-2015-5477 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/isc-bind-cve-2015-5477"},{"body":null,"category":"patch","date":"2026-10-07","incident":"cisco-meraki-critical-hardening-release-fixes-7-internally-discovered-vulnerability-groups-across-mg-mr-ms-mv-mx-and-cam","incidentTitle":"Cisco Meraki: Critical hardening release fixes 7 internally discovered vulnerability groups across MG, MR, MS, MV, MX and Campus Gateways (CVE-2026-76463 et al.)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Meraki%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","status":"closed","title":"Cisco Meraki: Critical hardening release fixes 7 internally discovered vulnerability groups across MG, MR, MS, MV, MX and Campus Gateways (CVE-2026-76463 et al.)","url":"https://helix.ml/threat-watch/i/cisco-meraki-critical-hardening-release-fixes-7-internally-discovered-vulnerability-groups-across-mg-mr-ms-mv-mx-and-cam"},{"body":null,"category":"patch","date":"2026-10-07","incident":"splunk-enterprise-unauthenticated-patroni-rest-api-flaw-allows-os-command-execution-on-search-head-cluster-members-cve-2","incidentTitle":"Splunk Enterprise: unauthenticated Patroni REST API flaw allows OS command execution on search head cluster members (CVE-2026-76268)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-76268/","status":"closed","title":"Splunk Enterprise: unauthenticated Patroni REST API flaw allows OS command execution on search head cluster members (CVE-2026-76268)","url":"https://helix.ml/threat-watch/i/splunk-enterprise-unauthenticated-patroni-rest-api-flaw-allows-os-command-execution-on-search-head-cluster-members-cve-2"},{"body":null,"category":"patch","date":"2026-10-06","incident":"sonicwall-sma-1000-actively-exploited-max-severity-ssrf-in-workplace-interface-allows-unauthenticated-attackers-to-reach","incidentTitle":"SonicWall SMA 1000: Actively exploited max-severity SSRF in WorkPlace interface allows unauthenticated attackers to reach internal services (CVE-2026-102255)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.darkreading.com/vulnerabilities-threats/max-severity-ssrf-flaw-sonicwall-sma-devices-under-attack","status":"closed","title":"SonicWall SMA 1000: Actively exploited max-severity SSRF in WorkPlace interface allows unauthenticated attackers to reach internal services (CVE-2026-102255)","url":"https://helix.ml/threat-watch/i/sonicwall-sma-1000-actively-exploited-max-severity-ssrf-in-workplace-interface-allows-unauthenticated-attackers-to-reach"},{"body":null,"category":"patch","date":"2026-10-04","incident":"citrix-netscaler-cve-2026-88779","incidentTitle":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779","status":"closed","title":"CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 7, 2026)","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88779"},{"body":null,"category":"patch","date":"2026-10-02","incident":"zammad-gmbh-zammad-cve-2026-102489","incidentTitle":"Zammad GmbH Zammad Session Fixation Vulnerability (CVE-2026-102489)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102489","status":"closed","title":"CISA added CVE-2026-102489 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 5, 2026)","url":"https://helix.ml/threat-watch/i/zammad-gmbh-zammad-cve-2026-102489"},{"body":null,"category":"patch","date":"2026-10-02","incident":"zammad-gmbh-zammad-cve-2026-102490","incidentTitle":"Zammad GmbH Zammad Improper Privilege Management Vulnerability (CVE-2026-102490)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102490","status":"closed","title":"CISA added CVE-2026-102490 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 5, 2026)","url":"https://helix.ml/threat-watch/i/zammad-gmbh-zammad-cve-2026-102490"},{"body":null,"category":"patch","date":"2026-10-01","incident":"fortinet-fortimail-cve-2026-104286","incidentTitle":"Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286","status":"closed","title":"CISA added CVE-2026-104286 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 4, 2026)","url":"https://helix.ml/threat-watch/i/fortinet-fortimail-cve-2026-104286"},{"body":null,"category":"patch","date":"2026-09-30","incident":"cisco-catalyst-sd-wan-manager-cve-2026-76504","incidentTitle":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (CVE-2026-76504)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76504","status":"closed","title":"CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 3, 2026)","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504"},{"body":null,"category":"patch","date":"2026-09-29","incident":"apple-multiple-products-cve-2026-86950","incidentTitle":"Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86950","status":"closed","title":"CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 13, 2026)","url":"https://helix.ml/threat-watch/i/apple-multiple-products-cve-2026-86950"},{"body":null,"category":"patch","date":"2026-09-27","incident":"citrix-netscaler-cve-2026-88771","incidentTitle":"Citrix NetScaler Improper Input Validation Vulnerability (CVE-2026-88771)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88771","status":"closed","title":"CISA added CVE-2026-88771 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 30, 2026)","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88771"},{"body":null,"category":"patch","date":"2026-09-27","incident":"citrix-netscaler-cve-2026-88772","incidentTitle":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88772)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88772","status":"closed","title":"CISA added CVE-2026-88772 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 30, 2026)","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88772"},{"body":null,"category":"patch","date":"2026-09-25","incident":"wordpress-core-cve-2026-87902","incidentTitle":"WordPress Core Remote File Inclusion Vulnerability (CVE-2026-87902)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902","status":"closed","title":"CISA added CVE-2026-87902 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 28, 2026)","url":"https://helix.ml/threat-watch/i/wordpress-core-cve-2026-87902"},{"body":null,"category":"patch","date":"2026-09-25","incident":"microsoft-sharepoint-cve-2026-65660","incidentTitle":"Microsoft SharePoint Code Injection Vulnerability (CVE-2026-65660)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660","status":"closed","title":"CISA added CVE-2026-65660 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 28, 2026)","url":"https://helix.ml/threat-watch/i/microsoft-sharepoint-cve-2026-65660"},{"body":null,"category":"patch","date":"2026-09-25","incident":"mikrotik-routeros-cve-2026-67279","incidentTitle":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVE-2026-67279)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279","status":"closed","title":"CISA added CVE-2026-67279 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 28, 2026)","url":"https://helix.ml/threat-watch/i/mikrotik-routeros-cve-2026-67279"},{"body":null,"category":"patch","date":"2026-09-24","incident":"sentry-nextjs-middleware-bypass-via-tunnelroute-lets-requests-skip-authorization-middleware-cve-2026-114139","incidentTitle":"@sentry/nextjs: Middleware bypass via tunnelRoute lets requests skip authorization middleware (CVE-2026-114139)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-mchm-gjx6-7h55","status":"closed","title":"@sentry/nextjs: Middleware bypass via tunnelRoute lets requests skip authorization middleware (CVE-2026-114139)","url":"https://helix.ml/threat-watch/i/sentry-nextjs-middleware-bypass-via-tunnelroute-lets-requests-skip-authorization-middleware-cve-2026-114139"},{"body":null,"category":"patch","date":"2026-09-24","incident":"adobe-commerce-and-magento-cve-2026-71362","incidentTitle":"Adobe Commerce and Magento Incorrect Authorization Vulnerability (CVE-2026-71362)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362","status":"closed","title":"CISA added CVE-2026-71362 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 27, 2026)","url":"https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2026-71362"},{"body":null,"category":"patch","date":"2026-09-24","incident":"wso2-multiple-products-cve-2026-5430","incidentTitle":"WSO2 Multiple Products Path Traversal Vulnerability (CVE-2026-5430)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430","status":"closed","title":"CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 27, 2026)","url":"https://helix.ml/threat-watch/i/wso2-multiple-products-cve-2026-5430"},{"body":null,"category":"patch","date":"2026-09-22","incident":"check-point-multiple-products-cve-2026-85102","incidentTitle":"Check Point Multiple Products Improper Certificate Validation Vulnerability (CVE-2026-85102)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102","status":"closed","title":"CISA added CVE-2026-85102 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)","url":"https://helix.ml/threat-watch/i/check-point-multiple-products-cve-2026-85102"},{"body":null,"category":"patch","date":"2026-09-22","incident":"check-point-multiple-products-cve-2026-93616","incidentTitle":"Check Point Multiple Products Path Traversal Vulnerability (CVE-2026-93616)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616","status":"closed","title":"CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)","url":"https://helix.ml/threat-watch/i/check-point-multiple-products-cve-2026-93616"},{"body":null,"category":"patch","date":"2026-09-22","incident":"f5-big-ip-apm-cve-2026-94127","incidentTitle":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability (CVE-2026-94127)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127","status":"closed","title":"CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)","url":"https://helix.ml/threat-watch/i/f5-big-ip-apm-cve-2026-94127"},{"body":null,"category":"patch","date":"2026-09-22","incident":"arista-velocloud-orchestrator-cve-2026-93952","incidentTitle":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability (CVE-2026-93952)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952","status":"closed","title":"CISA added CVE-2026-93952 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 25, 2026)","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-93952"},{"body":null,"category":"patch","date":"2026-09-21","incident":"zyxel-gs1900-series-switches-cve-2026-7273","incidentTitle":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability (CVE-2026-7273)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273","status":"closed","title":"CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 24, 2026)","url":"https://helix.ml/threat-watch/i/zyxel-gs1900-series-switches-cve-2026-7273"},{"body":null,"category":"patch","date":"2026-09-18","incident":"linux-kernel-cve-2025-39682","incidentTitle":"Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2025-39682)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39682","status":"closed","title":"CISA added CVE-2025-39682 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 21, 2026)","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2025-39682"},{"body":null,"category":"patch","date":"2026-09-18","incident":"linux-kernel-cve-2026-53266","incidentTitle":"Linux Kernel Out-of-Bounds Write Vulnerability (CVE-2026-53266)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266","status":"closed","title":"CISA added CVE-2026-53266 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 21, 2026)","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2026-53266"},{"body":null,"category":"patch","date":"2026-09-18","incident":"linux-kernel-cve-2025-39964","incidentTitle":"Linux Kernel Race Condition Vulnerability (CVE-2025-39964)","kind":"exploitation","patchStatus":"patched","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964","status":"closed","title":"CISA added CVE-2025-39964 to the Known Exploited Vulnerabilities catalog (federal remediation due Sep 21, 2026)","url":"https://helix.ml/threat-watch/i/linux-kernel-cve-2025-39964"}],"feeds":{"changes":"https://helix.ml/threat-watch/c/patch/changes.json","json":"https://helix.ml/threat-watch/c/patch/feed.json","llms":"https://helix.ml/threat-watch/c/patch/llms.txt","page":"https://helix.ml/threat-watch?c=patch","rss":"https://helix.ml/threat-watch/c/patch/feed.xml"},"generatedAt":"2026-10-25T11:12:49Z","site":"https://helix.ml/threat-watch"}